Repository navigation
DefectDojo hook makes findings disappear #746
Description
The DefectDojo-Hook appears to "eat" some of my results. With the hook active, four findings from git-repo-scanner get truncated into a single finding, and with semgrep support (from the WIP branch over at #744) 9 findings are turned into 5 findings, with some findings that found the same issue in different files being removed. If I import the semgrep results into DefectDojo by hand using either the WebUI or the API, all 9 findings are found, so the issue has to be in our hook, I would assume.
I will investigate this more tomorrow / on thursday, leaving this issue here to document my progress. Did not have the time to reproduce the issue on a fresh setup today, will do so and add instructions for reproducing the issue if I can't debug this myself.
Activity
malexmave commentedon Oct 21, 2021
From experiments together with @J12934, it seems like DefectDojo has inconsistent behavior between two different methods of importing findings, and we are currently using the version that is incorrectly de-duplicating findings on import. I was able to reproduce the finding directly inside the DefectDojo UI, so this is not an issue with the defectdojo integration in the sense that the bug is outside our control. However, I will leave this issue open as it may require re-working parts of our hook to work around the bug if it is not fixed in DefectDojo. I have raised this in the DefectDojo slack and, after discussions there, created an issue to track progress on this: DefectDojo/django-DefectDojo#5312
[-]DefectDojo hook makes findings disappear (?)[/-][+]DefectDojo hook makes findings disappear[/+]damiencarol commentedon Oct 21, 2021
@malexmave @J12934 it may come from a lack of configuration of the Generic parser. (see my comment on DefectDojo/django-DefectDojo#5312 )
malexmave commentedon Oct 22, 2021
Documenting knowledge from the other issue over here:
DEDUPLICATION_ALGORITHM_PER_PARSER ['Generic Findings Import'] = DEDUPE_ALGO_UNIQUE_ID_FROM_TOOLin the local_settings.py. However, this may have different effects on different inputs, as the solution relies on theunique_id_from_toolbeing set and consistent over multiple runs in the uploaded findings file, which may not always be the case for secureCodeBox. The DefectDojo devs will discuss if this issue can be resolved somehow, but given that the generic importer accepts more or less arbitrary data, any sort of deduplication will be challenging.I think a warning in the documentation of the secureCodeBox DefectDojo hook may be warranted (I will send a pull request with one today), and this is also a good reason to make it possible to disable hooks on a per-scan basis as discussed in #728. I will close this issue as soon as we have updated the docs.
malexmave commentedon Oct 22, 2021
I have created the PR with the documentation update. I think we should add an option to exclude individual scans from the DefectDojo hook, either as discussed in #728 or using a DefectDojo-specific scan annotation (something like
defectdojo.securecodebox.io/exclude: true) - although I think that the first option is preferrable, as it is more general.Weltraumschaf commentedon Jul 27, 2023
Already done