Repository navigation
DefectDojo persistence provider unable to use new SecureCodeBox Findings Importer #490
Description
🐞 Bug report
Describe the bug
The DefectDojo persistence provider is unable to import scan results using the new (unreleased) secureCodeBox parser. This is because the code expects a corresponding test type (i.e. "SecureCodeBox Findings Importer". As (briefly) explained in #4431, the test types are no longer updated for new importers.
This can be seen when manually importing scan results with the DefectDojo UI. Only a Scan Type has to be provided, which is derived from the available importers (see here). The same details have to be provided to the ImportScanSerializer in DefectDojo (API).
Due to the fact that SecureCodeBox's java wrapper/client is not up to date (#6), we can't currently fix this issue in this project. However, when the wrapper is updated, we will have to update the persistence-provider. This needs to be updated in order for the new parser to function.
If you need any more info, send me a msg on slack!
Steps To Reproduce
- Enable generic parser:
- Setup SecureCodeBox + locally built persistence provider ^^.
- Run an instance of parser-SCB
- Start a random scan.
Exception in thread "main" io.securecodebox.persistence.exceptions.DefectDojoPersistenceException: Could not find test type 'SecureCodeBox Findings Import' in DefectDojo API. DefectDojo might be running in an unsupported version.
at io.securecodebox.persistence.strategies.VersionedEngagementsStrategy.lambda$createTest$7(VersionedEngagementsStrategy.java:242)
at java.base/java.util.Optional.orElseThrow(Optional.java:408)
at io.securecodebox.persistence.strategies.VersionedEngagementsStrategy.createTest(VersionedEngagementsStrategy.java:242)
at io.securecodebox.persistence.strategies.VersionedEngagementsStrategy.run(VersionedEngagementsStrategy.java:83)
at io.securecodebox.persistence.DefectDojoPersistenceProvider.main(DefectDojoPersistenceProvider.java:58)
System (please complete the following information):
Additional context
Check out #6 in the defectdojo wrapper.
Activity
[-]DefectDojo persistence provider unable to user new SecureCodeBox Findings Importer[/-][+]DefectDojo persistence provider unable to use new SecureCodeBox Findings Importer[/+]J12934 commentedon Jun 10, 2021
Hi
The DefectDojo PR (DefectDojo/django-DefectDojo#4431) will likely not be the solution we'll settle on. @JohannesZahn is currently working on fixing this problem by using the Generic Finding JSON Importer in DefectDojo 2.0 coming later this month. More on that discussion and development in #332 and the WIP implementation in #487.
I think by using this generic importer we also avoid this issue. Totally not sure thought, @JohannesZahn do you know more about that?
EndPositive commentedon Jun 10, 2021
Looks like Johannes his PR works wonderfully! If we won't use a separate secureCodeBox findings importer, I'll close the issue. I'll keep #6 open for now in case Johannes still wants to update the wrapper.