Snyk SAST Importer - Error with "Close Old Findings"

[almasnyk]

Hi,
When uploading Snyk Code scans - Defect Dojo reads the JSON file uploaded correctly but on re-import with the flag of "Close old findings" turned to true all the findings but one get closed even if re-uploading the exact same file again

Original scan

Now re-importing

And all get closed but one

Here is the file for testing a well if needed
snykcodeoutput.json

Expecting for no issues to be closed

[paulOsinski]

Hi Alma, I ran some tests and this is due to some inconsistencies with the Snyk parser. Dojo is set up to be able to handle both Snyk Code and Snyk Container files, but we're seeing strange deduplication behaviour when a Snyk Code file is uploaded. I think that's the source of this problem.

Even the initial upload of your attached JSON file led to lots of Findings getting incorrectly flagged as duplicates, so we're going to create a separate parser for Snyk Code files. I'll give your reimport method another try once that's in place, and we'll see if the problem continues.

[mtesauro]

@almasnyk The reason behind the issue your finding is that the deduplication hash code is configured for SCA results which don't overlap particularly well with SAST results.

So, as it stands today, you could adjust the dudup hash code to better fit the Snyk SAST results assuming you're not also using SCA.

As @paulOsinski said ^ the real fix is to split out these two parsers. That will be coming in a future release.

[manuel-sommer]

I guess this can be closed becuase of the PR of FelixHernandes @mtesauro