🎉 added humble #8988

[manuel-sommer]

See #8988

[manuel-sommer]

Waiting for rfc-st/humble#13

[manuel-sommer]

Ready to review :-)

[kiblik]

Please follow

• https://documentation.defectdojo.com/contributing/how-to-write-a-parser/#endpoint-validation
• url != host https://documentation.defectdojo.com/contributing/how-to-write-a-parser/#do-not-parse-urls-by-hand

[manuel-sommer]

Done @kiblik

[mtesauro]

Approved

[kiblik]

First sorry, I forgot to come back to this PR

Not that sure that Do not parse URLs by hand means

            import re
            host = re.compile(r"https?://(www\.)?")
            host = host.sub('', url).strip().strip('/')

Some notes:
The original idea with endpoints (and how most of the parsers are implemented right now) is that: If multiple endpoints have the same Finding, let's define it as one finding and use Endpoint_Status to identify, which Endpoints are affected. Yes, it is not possible in all cases (especially if there are some different metadata for each endpoint - but it is not the case here).
It means that information about the endpoint should not be presented in the Finding.title or Finding.description (if it is possible). It is also the reason why Finding.url:

django-DefectDojo/dojo/models.py

Lines 2157 to 2161 in 393f460

	url = models.TextField(null=True,
	blank=True,
	editable=False,
	verbose_name=_('URL'),
	help_text=_("External reference that provides more information about this flaw.")) # not displayed and pretty much the same as references. To remove?

is not used anywhere anymore (and should be removed).

Next, information about protocol (http vs https) is valuable. So we should not avoid it. Also path (different paths might have different results for scanning). And www. should not be removed from the host as well.

So if it is not necessary because of some specific metadata (which is not in this case), please:

• Avoid adding the name of the endpoint/host to the content of the finding
• Use endpoint in the full form (including protocol and path)

[manuel-sommer]

@kiblik, I accepted your review, but is the finding title now not too general? I would rather make it more unique. Maybe we now need deduplication settings?

[Maffooch]

Maybe we now need deduplication settings?

This would be ideal. Even if they happen to match the default dedupe settings, it affords other users to override the fields used without a code change being required

[dryrunsecurity]

Contextual Security Analysis

As DryRun Security performs checks, we’ll summarize them here. You can always dive into the results in the section below for checks.

Status	DryRun Security Check
✅	Configured Sensitive Files Check
✅	AI-powered Sensitive Files Check

Chat with your AI-powered Security Buddy by typing /dryrunsec: (or /drs:) followed by your question. Example: /dryrunsec: From a security perspective, what are some sensitive files in an Express application?

Install and configure more repositories at DryRun Security

[manuel-sommer]

@Maffooch ready to review and then merge

[manuel-sommer]

@cneill ready to review and merge

[manuel-sommer]

Could you also please merge :-)