diff --git a/dojo/api_v2/serializers.py b/dojo/api_v2/serializers.py index 49e3486fe2c..0380fa6f4ac 100644 --- a/dojo/api_v2/serializers.py +++ b/dojo/api_v2/serializers.py @@ -2135,6 +2135,10 @@ class ImportScanSerializer(serializers.Serializer): help_text="If set to True, the tags will be applied to the findings", required=False, ) + parser_custom_setting = serializers.CharField( + help_text="You can specify custom parser settings, but please take a look at the docs", + required=False, + ) def save(self, push_to_jira=False): data = self.validated_data @@ -2157,6 +2161,7 @@ def save(self, push_to_jira=False): source_code_management_uri = data.get( "source_code_management_uri", None ) + parser_custom_setting = data.get("parser_custom_setting", None) if "active" in self.initial_data: active = data.get("active") @@ -2247,6 +2252,7 @@ def save(self, push_to_jira=False): title=test_title, create_finding_groups_for_all_findings=create_finding_groups_for_all_findings, apply_tags_to_findings=apply_tags_to_findings, + parser_custom_setting=parser_custom_setting, ) if test: @@ -2419,6 +2425,10 @@ class ReImportScanSerializer(TaggitSerializer, serializers.Serializer): help_text="If set to True, the tags will be applied to the findings", required=False ) + parser_custom_setting = serializers.CharField( + help_text="You can specify custom parser settings, but please take a look at the docs", + required=False, + ) def save(self, push_to_jira=False): logger.debug("push_to_jira: %s", push_to_jira) @@ -2432,6 +2442,7 @@ def save(self, push_to_jira=False): "close_old_findings_product_scope" ) apply_tags_to_findings = data.get("apply_tags_to_findings", False) + parser_custom_setting = data.get("parser_custom_setting", False) do_not_reactivate = data.get("do_not_reactivate", False) version = data.get("version", None) build_id = data.get("build_id", None) @@ -2533,6 +2544,7 @@ def save(self, push_to_jira=False): do_not_reactivate=do_not_reactivate, create_finding_groups_for_all_findings=create_finding_groups_for_all_findings, apply_tags_to_findings=apply_tags_to_findings, + parser_custom_setting=parser_custom_setting, ) if test_import: diff --git a/dojo/forms.py b/dojo/forms.py index fd2b6844ec3..e78c5beb0c2 100755 --- a/dojo/forms.py +++ b/dojo/forms.py @@ -477,6 +477,7 @@ class ImportScanForm(forms.Form): required=False, initial=False ) + parser_custom_setting = forms.CharField(max_length=100, required=False, help_text="This is a field to customize (finetune) the behavior of single parsers.") if is_finding_groups_enabled(): group_by = forms.ChoiceField(required=False, choices=Finding_Group.GROUP_BY_OPTIONS, help_text='Choose an option to automatically group new findings by the chosen option.') diff --git a/dojo/importers/importer/importer.py b/dojo/importers/importer/importer.py index baed2c8d421..d3fa328a2c3 100644 --- a/dojo/importers/importer/importer.py +++ b/dojo/importers/importer/importer.py @@ -244,7 +244,7 @@ def close_old_findings(self, test, scan_date_time, user, push_to_jira=None, serv def import_scan(self, scan, scan_type, engagement, lead, environment, active=None, verified=None, tags=None, minimum_severity=None, user=None, endpoints_to_add=None, scan_date=None, version=None, branch_tag=None, build_id=None, commit_hash=None, push_to_jira=None, close_old_findings=False, close_old_findings_product_scope=False, - group_by=None, api_scan_configuration=None, service=None, title=None, create_finding_groups_for_all_findings=True, apply_tags_to_findings=False): + group_by=None, api_scan_configuration=None, service=None, title=None, create_finding_groups_for_all_findings=True, apply_tags_to_findings=False, parser_custom_setting=None): logger.debug(f'IMPORT_SCAN: parameters: {locals()}') @@ -312,7 +312,7 @@ def import_scan(self, scan, scan_type, engagement, lead, environment, active=Non logger.debug('IMPORT_SCAN: Parse findings') parser = get_parser(scan_type) try: - parsed_findings = parser.get_findings(scan, test) + parsed_findings = parser.get_findings(scan, test, parser_custom_setting) except ValueError as e: logger.warning(e) raise ValidationError(e) @@ -367,7 +367,6 @@ def import_scan(self, scan, scan_type, engagement, lead, environment, active=Non for finding in test_import.findings_affected.all(): for tag in tags: finding.tags.add(tag) - logger.debug('IMPORT_SCAN: Generating notifications') notifications_helper.notify_test_created(test) updated_count = len(new_findings) + len(closed_findings) diff --git a/dojo/importers/reimporter/reimporter.py b/dojo/importers/reimporter/reimporter.py index 39db0d7e3e0..216669aa1aa 100644 --- a/dojo/importers/reimporter/reimporter.py +++ b/dojo/importers/reimporter/reimporter.py @@ -572,6 +572,7 @@ def reimport_scan( do_not_reactivate=False, create_finding_groups_for_all_findings=True, apply_tags_to_findings=False, + parser_custom_setting=None, ): logger.debug(f"REIMPORT_SCAN: parameters: {locals()}") @@ -607,7 +608,7 @@ def reimport_scan( else: logger.debug("REIMPORT_SCAN: Parse findings") try: - parsed_findings = parser.get_findings(scan, test) + parsed_findings = parser.get_findings(scan, test, parser_custom_setting) except ValueError as e: logger.warning(e) raise ValidationError(e) diff --git a/dojo/tools/acunetix/parser.py b/dojo/tools/acunetix/parser.py index 3227d20e188..4cb13d8a9d4 100644 --- a/dojo/tools/acunetix/parser.py +++ b/dojo/tools/acunetix/parser.py @@ -23,7 +23,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "XML format" - def get_findings(self, xml_output, test): + def get_findings(self, xml_output, test, parser_custom_setting=None): root = parse(xml_output).getroot() dupes = dict() diff --git a/dojo/tools/acunetix360/parser.py b/dojo/tools/acunetix360/parser.py index 2639e4567f0..dce371db26c 100644 --- a/dojo/tools/acunetix360/parser.py +++ b/dojo/tools/acunetix360/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Acunetix360 JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = dict() scan_date = parser.parse(data["Generated"]) diff --git a/dojo/tools/anchore_engine/parser.py b/dojo/tools/anchore_engine/parser.py index 30ea71238e5..c3b2563b419 100644 --- a/dojo/tools/anchore_engine/parser.py +++ b/dojo/tools/anchore_engine/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Anchore-CLI JSON vulnerability report format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = dict() for item in data["vulnerabilities"]: diff --git a/dojo/tools/anchore_enterprise/parser.py b/dojo/tools/anchore_enterprise/parser.py index 899e600a51e..e772d37e2f3 100644 --- a/dojo/tools/anchore_enterprise/parser.py +++ b/dojo/tools/anchore_enterprise/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Anchore-CLI JSON policy check report format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() try: data = json.loads(str(content, "utf-8")) diff --git a/dojo/tools/anchore_grype/parser.py b/dojo/tools/anchore_grype/parser.py index 31359400a8d..cb1679a6d66 100644 --- a/dojo/tools/anchore_grype/parser.py +++ b/dojo/tools/anchore_grype/parser.py @@ -23,7 +23,7 @@ def get_description_for_scan_types(self, scan_type): "format" ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = json.load(file) dupes = dict() for item in data.get("matches", []): diff --git a/dojo/tools/anchorectl_policies/parser.py b/dojo/tools/anchorectl_policies/parser.py index 1df2fa94f95..57b01ddf78e 100644 --- a/dojo/tools/anchorectl_policies/parser.py +++ b/dojo/tools/anchorectl_policies/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "AnchoreCTLs JSON policies report format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() try: data = json.loads(str(content, "utf-8")) diff --git a/dojo/tools/anchorectl_vulns/parser.py b/dojo/tools/anchorectl_vulns/parser.py index 77c350b56bd..5fb5fad5ae9 100644 --- a/dojo/tools/anchorectl_vulns/parser.py +++ b/dojo/tools/anchorectl_vulns/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "AnchoreCTLs JSON vulnerability report format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = dict() for item in data: diff --git a/dojo/tools/api_blackduck/importer.py b/dojo/tools/api_blackduck/importer.py index cf7a143bb9c..e235f71e1f7 100644 --- a/dojo/tools/api_blackduck/importer.py +++ b/dojo/tools/api_blackduck/importer.py @@ -11,7 +11,7 @@ class BlackduckApiImporter(object): config_id = "BlackDuck API" - def get_findings(self, test): + def get_findings(self, test, parser_custom_setting=None): client, config = self.prepare_client(test) project = client.get_project_by_name(config.service_key_1) version = client.get_version_by_name(project, config.service_key_2) diff --git a/dojo/tools/api_blackduck/parser.py b/dojo/tools/api_blackduck/parser.py index be76f28c6ef..8ab7c955731 100644 --- a/dojo/tools/api_blackduck/parser.py +++ b/dojo/tools/api_blackduck/parser.py @@ -36,7 +36,7 @@ def api_scan_configuration_hint(self): "Service key 2 has to be set to the version of the project" ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file is None: data = BlackduckApiImporter().get_findings(test) else: diff --git a/dojo/tools/api_bugcrowd/importer.py b/dojo/tools/api_bugcrowd/importer.py index 3e41b6be20a..556e09e178b 100644 --- a/dojo/tools/api_bugcrowd/importer.py +++ b/dojo/tools/api_bugcrowd/importer.py @@ -11,7 +11,7 @@ class BugcrowdApiImporter(object): Import from Bugcrowd API """ - def get_findings(self, test): + def get_findings(self, test, parser_custom_setting=None): client, config = self.prepare_client(test) logger.debug( "Fetching submissions program {} and target {}".format( diff --git a/dojo/tools/api_bugcrowd/parser.py b/dojo/tools/api_bugcrowd/parser.py index d78b2eb5af4..1e3d3f0db49 100644 --- a/dojo/tools/api_bugcrowd/parser.py +++ b/dojo/tools/api_bugcrowd/parser.py @@ -46,7 +46,7 @@ def api_scan_configuration_hint(self): "if not supplied, will fetch all submissions in the program" ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): api_scan_config = None if file is None: data, api_scan_config = BugcrowdApiImporter().get_findings(test) diff --git a/dojo/tools/api_cobalt/importer.py b/dojo/tools/api_cobalt/importer.py index 93ba6a06e0c..ad0103f5124 100644 --- a/dojo/tools/api_cobalt/importer.py +++ b/dojo/tools/api_cobalt/importer.py @@ -11,7 +11,7 @@ class CobaltApiImporter(object): Import from Cobalt.io API """ - def get_findings(self, test): + def get_findings(self, test, parser_custom_setting=None): client, config = self.prepare_client(test) findings = client.get_findings(config.service_key_1) return findings diff --git a/dojo/tools/api_cobalt/parser.py b/dojo/tools/api_cobalt/parser.py index 0e77b0d279b..a2f56f41bfb 100644 --- a/dojo/tools/api_cobalt/parser.py +++ b/dojo/tools/api_cobalt/parser.py @@ -37,7 +37,7 @@ def api_scan_configuration_hint(self): "be populated with the asset name while saving the configuration." ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file is None: data = CobaltApiImporter().get_findings(test) else: diff --git a/dojo/tools/api_edgescan/importer.py b/dojo/tools/api_edgescan/importer.py index dc97edf82a8..0c072fc4bdf 100644 --- a/dojo/tools/api_edgescan/importer.py +++ b/dojo/tools/api_edgescan/importer.py @@ -8,7 +8,7 @@ class EdgescanImporter(object): Import from Edgescan API """ - def get_findings(self, test): + def get_findings(self, test, parser_custom_setting=None): client, config = self.prepare_client(test) findings = client.get_findings(config.service_key_1) return findings diff --git a/dojo/tools/api_edgescan/parser.py b/dojo/tools/api_edgescan/parser.py index 3e186e6d6b0..146a415f60f 100644 --- a/dojo/tools/api_edgescan/parser.py +++ b/dojo/tools/api_edgescan/parser.py @@ -31,7 +31,7 @@ def requires_tool_type(self, scan_type): def api_scan_configuration_hint(self): return "In the field Service key 1, provide the Edgescan asset ID(s). Leaving it blank will import all assets' findings." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file: data = json.load(file) else: diff --git a/dojo/tools/api_sonarqube/importer.py b/dojo/tools/api_sonarqube/importer.py index 31a5c62e77c..271a3520960 100644 --- a/dojo/tools/api_sonarqube/importer.py +++ b/dojo/tools/api_sonarqube/importer.py @@ -20,7 +20,7 @@ class SonarQubeApiImporter(object): findings. """ - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): items = self.import_issues(test) if settings.SONARQUBE_API_PARSER_HOTSPOTS: if items: diff --git a/dojo/tools/api_sonarqube/parser.py b/dojo/tools/api_sonarqube/parser.py index f4e7162d311..04bc15bcef6 100644 --- a/dojo/tools/api_sonarqube/parser.py +++ b/dojo/tools/api_sonarqube/parser.py @@ -29,5 +29,5 @@ def api_scan_configuration_hint(self): "can be used for the Organization ID if using SonarCloud." ) - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): return SonarQubeApiImporter().get_findings(json_output, test) diff --git a/dojo/tools/api_vulners/importer.py b/dojo/tools/api_vulners/importer.py index 7bd46269ef0..b6f36e60e5a 100644 --- a/dojo/tools/api_vulners/importer.py +++ b/dojo/tools/api_vulners/importer.py @@ -11,7 +11,7 @@ class VulnersImporter(object): Import from Vulners API """ - def get_findings(self, test): + def get_findings(self, test, parser_custom_setting=None): client, config = self.prepare_client(test) findings = client.get_findings() return findings diff --git a/dojo/tools/api_vulners/parser.py b/dojo/tools/api_vulners/parser.py index deba3c5762f..de8b77a55aa 100644 --- a/dojo/tools/api_vulners/parser.py +++ b/dojo/tools/api_vulners/parser.py @@ -38,7 +38,7 @@ def api_scan_configuration_hint(self): def requires_file(self, scan_type): return False - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): findings = [] if file: diff --git a/dojo/tools/appspider/parser.py b/dojo/tools/appspider/parser.py index 4d3e5eccc7b..701ec55549c 100644 --- a/dojo/tools/appspider/parser.py +++ b/dojo/tools/appspider/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "AppSpider (Rapid7) - Use the VulnerabilitiesSummary.xml file found in the zipped report download." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return diff --git a/dojo/tools/aqua/parser.py b/dojo/tools/aqua/parser.py index d29d6128a6a..bb4b6bfebef 100644 --- a/dojo/tools/aqua/parser.py +++ b/dojo/tools/aqua/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "" - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/arachni/parser.py b/dojo/tools/arachni/parser.py index 22e67fe1b89..c69085624fa 100755 --- a/dojo/tools/arachni/parser.py +++ b/dojo/tools/arachni/parser.py @@ -23,7 +23,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Arachni JSON report format (generated with `arachni_reporter --reporter 'json'`)." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/asff/parser.py b/dojo/tools/asff/parser.py index 6cbe527ff45..ef6f02fa12c 100644 --- a/dojo/tools/asff/parser.py +++ b/dojo/tools/asff/parser.py @@ -26,7 +26,7 @@ def get_description_for_scan_types(self, scan_type): return """AWS Security Finding Format (ASFF). https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format-syntax.html""" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = json.load(file) result = list() for item in data: diff --git a/dojo/tools/auditjs/parser.py b/dojo/tools/auditjs/parser.py index 69031dc16bb..5a66c28874f 100644 --- a/dojo/tools/auditjs/parser.py +++ b/dojo/tools/auditjs/parser.py @@ -32,7 +32,7 @@ def get_severity(self, cvss): else: return "Informational" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): try: data = json.load(filename) except JSONDecodeError: diff --git a/dojo/tools/aws_prowler/parser.py b/dojo/tools/aws_prowler/parser.py index b7320039308..9268be66ba8 100644 --- a/dojo/tools/aws_prowler/parser.py +++ b/dojo/tools/aws_prowler/parser.py @@ -20,7 +20,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Export of AWS Prowler in CSV or JSON format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file.name.lower().endswith(".csv"): return self.process_csv(file, test) elif file.name.lower().endswith(".json"): diff --git a/dojo/tools/aws_prowler_v3/parser.py b/dojo/tools/aws_prowler_v3/parser.py index c36c87ad9be..daa2119895b 100644 --- a/dojo/tools/aws_prowler_v3/parser.py +++ b/dojo/tools/aws_prowler_v3/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Export of AWS Prowler JSON V3 format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file.name.lower().endswith('.json'): return self.process_json(file, test) else: diff --git a/dojo/tools/aws_scout2/parser.py b/dojo/tools/aws_scout2/parser.py index 55b6d31afaa..68f1a1c4cd5 100644 --- a/dojo/tools/aws_scout2/parser.py +++ b/dojo/tools/aws_scout2/parser.py @@ -20,7 +20,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JS file in scout2-report/inc-awsconfig/aws_config.js." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/awssecurityhub/parser.py b/dojo/tools/awssecurityhub/parser.py index 252c4c5a237..8b601c88572 100644 --- a/dojo/tools/awssecurityhub/parser.py +++ b/dojo/tools/awssecurityhub/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "AWS Security Hub exports in JSON format." - def get_findings(self, filehandle, test): + def get_findings(self, filehandle, test, parser_custom_setting=None): tree = json.load(filehandle) if not isinstance(tree, dict): raise ValueError("Incorrect Security Hub report format") diff --git a/dojo/tools/azure_security_center_recommendations/parser.py b/dojo/tools/azure_security_center_recommendations/parser.py index 9d90519fb21..d88b20f9aba 100644 --- a/dojo/tools/azure_security_center_recommendations/parser.py +++ b/dojo/tools/azure_security_center_recommendations/parser.py @@ -18,7 +18,7 @@ def get_description_for_scan_types(self, scan_type): "CSV format." ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file.name.lower().endswith(".csv"): return self.process_csv(file, test) else: diff --git a/dojo/tools/bandit/parser.py b/dojo/tools/bandit/parser.py index 18b03967ad2..13046c4eff3 100644 --- a/dojo/tools/bandit/parser.py +++ b/dojo/tools/bandit/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON report format" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) results = list() diff --git a/dojo/tools/blackduck/parser.py b/dojo/tools/blackduck/parser.py index 804bb1bf5a7..5c83b20eca5 100644 --- a/dojo/tools/blackduck/parser.py +++ b/dojo/tools/blackduck/parser.py @@ -20,7 +20,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Upload the zip file containing the security.csv and components.csv for Security and License risks." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): normalized_findings = self.normalize_findings(filename) return self.ingest_findings(normalized_findings, test) diff --git a/dojo/tools/blackduck_binary_analysis/parser.py b/dojo/tools/blackduck_binary_analysis/parser.py index 55049312569..037fe7c2c74 100644 --- a/dojo/tools/blackduck_binary_analysis/parser.py +++ b/dojo/tools/blackduck_binary_analysis/parser.py @@ -20,7 +20,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Blackduck Binary Analysis CSV file containing vulnerable binaries." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): sorted_findings = self.sort_findings(filename) return self.ingest_findings(sorted_findings, test) diff --git a/dojo/tools/blackduck_component_risk/parser.py b/dojo/tools/blackduck_component_risk/parser.py index 644d525bcd5..827d9c19c13 100644 --- a/dojo/tools/blackduck_component_risk/parser.py +++ b/dojo/tools/blackduck_component_risk/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Upload the zip file containing the security.csv and files.csv." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): """ Function initializes the parser with a file and returns the items. :param filename: Input in Defect Dojo diff --git a/dojo/tools/brakeman/parser.py b/dojo/tools/brakeman/parser.py index 77e32603f1a..bae6f9740de 100644 --- a/dojo/tools/brakeman/parser.py +++ b/dojo/tools/brakeman/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Brakeman Scanner findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return () diff --git a/dojo/tools/bugcrowd/parser.py b/dojo/tools/bugcrowd/parser.py index 941b55fd694..2903a65c57c 100644 --- a/dojo/tools/bugcrowd/parser.py +++ b/dojo/tools/bugcrowd/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "BugCrowd CSV report format" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return () diff --git a/dojo/tools/bundler_audit/parser.py b/dojo/tools/bundler_audit/parser.py index 39b836711b4..cc35aebd0a2 100644 --- a/dojo/tools/bundler_audit/parser.py +++ b/dojo/tools/bundler_audit/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "'bundler-audit check' output (in plain text)" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): lines = filename.read() if isinstance(lines, bytes): lines = lines.decode("utf-8") # passes in unittests, but would fail in production diff --git a/dojo/tools/burp/parser.py b/dojo/tools/burp/parser.py index bd599598672..3378ba4db10 100755 --- a/dojo/tools/burp/parser.py +++ b/dojo/tools/burp/parser.py @@ -28,7 +28,7 @@ def get_description_for_scan_types(self, scan_type): "response fields. These fields will be processed and made available in the 'Finding View' page." ) - def get_findings(self, xml_output, test): + def get_findings(self, xml_output, test, parser_custom_setting=None): tree = etree.parse(xml_output, etree.XMLParser()) return self.get_items(tree, test) diff --git a/dojo/tools/burp_api/parser.py b/dojo/tools/burp_api/parser.py index f82ac67ffb8..1569f8f397c 100644 --- a/dojo/tools/burp_api/parser.py +++ b/dojo/tools/burp_api/parser.py @@ -27,7 +27,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Burp REST API scan data in JSON format (/scan/[task_id] endpoint)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): # API export is a JSON file tree = json.load(file) diff --git a/dojo/tools/burp_enterprise/parser.py b/dojo/tools/burp_enterprise/parser.py index b80e0c54b7d..74b260ffbc6 100644 --- a/dojo/tools/burp_enterprise/parser.py +++ b/dojo/tools/burp_enterprise/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Burp Enterprise Edition findings in HTML format" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): parser = etree.HTMLParser() tree = etree.parse(filename, parser) if tree: diff --git a/dojo/tools/burp_graphql/parser.py b/dojo/tools/burp_graphql/parser.py index 90d91c640c3..22d56423240 100644 --- a/dojo/tools/burp_graphql/parser.py +++ b/dojo/tools/burp_graphql/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Burp Enterprise Edition findings from the GraphQL API" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) if "Issues" not in data: diff --git a/dojo/tools/cargo_audit/parser.py b/dojo/tools/cargo_audit/parser.py index fddf3be36a0..2e3dfd03a44 100644 --- a/dojo/tools/cargo_audit/parser.py +++ b/dojo/tools/cargo_audit/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for cargo audit scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} if data.get("vulnerabilities"): diff --git a/dojo/tools/checkmarx/parser.py b/dojo/tools/checkmarx/parser.py index d8be5b8b680..d68f53b926a 100755 --- a/dojo/tools/checkmarx/parser.py +++ b/dojo/tools/checkmarx/parser.py @@ -381,7 +381,7 @@ def isVerified(self, state): verifiedStates = ["2", "3"] return state in verifiedStates - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file.name.strip().lower().endswith(".json"): return self._get_findings_json(file, test) else: diff --git a/dojo/tools/checkmarx_osa/parser.py b/dojo/tools/checkmarx_osa/parser.py index 30ae18e0f45..6ee4e3c1b19 100644 --- a/dojo/tools/checkmarx_osa/parser.py +++ b/dojo/tools/checkmarx_osa/parser.py @@ -19,7 +19,7 @@ def get_description_for_scan_types(self, scan_type): "CxOSAVulnerabilities.json CxOSALibraries.json`" ) - def get_findings(self, filehandle, test): + def get_findings(self, filehandle, test, parser_custom_setting=None): tree = json.load(filehandle) if len(tree) != 2: logger.error( diff --git a/dojo/tools/checkov/parser.py b/dojo/tools/checkov/parser.py index c98e94537fa..214ff672b74 100644 --- a/dojo/tools/checkov/parser.py +++ b/dojo/tools/checkov/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON reports of Infrastructure as Code vulnerabilities." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): findings = [] if json_output: deserialized = self.parse_json(json_output) diff --git a/dojo/tools/clair/parser.py b/dojo/tools/clair/parser.py index dbf30f4e987..81181e3a415 100644 --- a/dojo/tools/clair/parser.py +++ b/dojo/tools/clair/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON reports of Docker image vulnerabilities." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = self.parse_json(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/clair_klar/parser.py b/dojo/tools/clair_klar/parser.py index 2b5feafea87..ac21ee13eb8 100644 --- a/dojo/tools/clair_klar/parser.py +++ b/dojo/tools/clair_klar/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON reports of Docker image vulnerabilities from clair klar client." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = self.parse_json(json_output) items = list() diff --git a/dojo/tools/cloudsploit/parser.py b/dojo/tools/cloudsploit/parser.py index 38e518fc6ed..96f40e85ac0 100644 --- a/dojo/tools/cloudsploit/parser.py +++ b/dojo/tools/cloudsploit/parser.py @@ -22,7 +22,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Cloudsploit report file can be imported in JSON format (option --json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = json.load(file) find_date = datetime.now() dupes = dict() diff --git a/dojo/tools/cobalt/parser.py b/dojo/tools/cobalt/parser.py index 172982dd67d..7df3469ff5e 100644 --- a/dojo/tools/cobalt/parser.py +++ b/dojo/tools/cobalt/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "CSV Report" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/codechecker/parser.py b/dojo/tools/codechecker/parser.py index 4866145c02e..1c51601ae44 100644 --- a/dojo/tools/codechecker/parser.py +++ b/dojo/tools/codechecker/parser.py @@ -16,7 +16,7 @@ def get_description_for_scan_types(self, scan_type): def get_requires_file(self, scan_type): return True - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return diff --git a/dojo/tools/contrast/parser.py b/dojo/tools/contrast/parser.py index d5a43077025..d402f0e4be2 100644 --- a/dojo/tools/contrast/parser.py +++ b/dojo/tools/contrast/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "CSV Report" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/coverity_api/parser.py b/dojo/tools/coverity_api/parser.py index e25f819a8df..eeccbb96bde 100644 --- a/dojo/tools/coverity_api/parser.py +++ b/dojo/tools/coverity_api/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Coverity API view data in JSON format (/api/viewContents/issues endpoint)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = json.load(file) if "viewContentsV1" not in tree: diff --git a/dojo/tools/crashtest_security/parser.py b/dojo/tools/crashtest_security/parser.py index 0ac2b37c0b4..f5f1264d000 100755 --- a/dojo/tools/crashtest_security/parser.py +++ b/dojo/tools/crashtest_security/parser.py @@ -16,7 +16,7 @@ class CrashtestSecurityJsonParser(object): @param test The test to which the finding belongs """ - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): # Load the data tree = file.read() try: diff --git a/dojo/tools/cred_scan/parser.py b/dojo/tools/cred_scan/parser.py index 2a2e616f44d..1ec6bf770f3 100644 --- a/dojo/tools/cred_scan/parser.py +++ b/dojo/tools/cred_scan/parser.py @@ -22,7 +22,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import CSV output of CredScan scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8-sig") diff --git a/dojo/tools/cyclonedx/parser.py b/dojo/tools/cyclonedx/parser.py index 608a1f8aa51..d86a5a14261 100644 --- a/dojo/tools/cyclonedx/parser.py +++ b/dojo/tools/cyclonedx/parser.py @@ -359,7 +359,7 @@ def get_namespace(self, element): m = re.match(r"\{.*\}", element.tag) return m.group(0) if m else "" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file.name.strip().lower().endswith(".json"): return self._get_findings_json(file, test) else: diff --git a/dojo/tools/dawnscanner/parser.py b/dojo/tools/dawnscanner/parser.py index e191d2da062..5ccaecbbb10 100644 --- a/dojo/tools/dawnscanner/parser.py +++ b/dojo/tools/dawnscanner/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Dawnscanner (-j) output file can be imported in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) find_date = parser.parse(data["scan_started"]) diff --git a/dojo/tools/dependency_check/parser.py b/dojo/tools/dependency_check/parser.py index 89b634d13c6..45888bbc54a 100644 --- a/dojo/tools/dependency_check/parser.py +++ b/dojo/tools/dependency_check/parser.py @@ -354,7 +354,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "OWASP Dependency Check output can be imported in Xml format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): dupes = dict() namespace = "" content = filename.read() diff --git a/dojo/tools/dependency_track/parser.py b/dojo/tools/dependency_track/parser.py index 3150a3f2294..6ebbf83943d 100644 --- a/dojo/tools/dependency_track/parser.py +++ b/dojo/tools/dependency_track/parser.py @@ -247,7 +247,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "The Finding Packaging Format (FPF) from OWASP Dependency Track can be imported in JSON format. See here for more info on this JSON format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): # Exit if file is not provided if file is None: diff --git a/dojo/tools/detect_secrets/parser.py b/dojo/tools/detect_secrets/parser.py index 0da274ba9f7..f57abe182cd 100644 --- a/dojo/tools/detect_secrets/parser.py +++ b/dojo/tools/detect_secrets/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for detect-secrets scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} if data.get("generated_at"): diff --git a/dojo/tools/dockerbench/parser.py b/dojo/tools/dockerbench/parser.py index 870c3bc31be..c9614cf424d 100644 --- a/dojo/tools/dockerbench/parser.py +++ b/dojo/tools/dockerbench/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON reports of Docker CIS benchmark scans." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return get_tests(tree, test) diff --git a/dojo/tools/dockle/parser.py b/dojo/tools/dockle/parser.py index 5c07472bedd..7471832bffc 100644 --- a/dojo/tools/dockle/parser.py +++ b/dojo/tools/dockle/parser.py @@ -24,7 +24,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for Dockle scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} for item in data["details"]: diff --git a/dojo/tools/drheader/parser.py b/dojo/tools/drheader/parser.py index 50fd5554f6d..9383d8e8601 100644 --- a/dojo/tools/drheader/parser.py +++ b/dojo/tools/drheader/parser.py @@ -38,7 +38,7 @@ def return_finding(self, test, finding, url=None): find.unsaved_endpoints = [Endpoint.from_uri(url)] return find - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): items = [] try: data = json.load(filename) diff --git a/dojo/tools/dsop/parser.py b/dojo/tools/dsop/parser.py index 597e69c1053..dbdcf021ad4 100644 --- a/dojo/tools/dsop/parser.py +++ b/dojo/tools/dsop/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import XLSX findings from DSOP vulnerability scan pipelines." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): book = load_workbook(file) items = list() self.__parse_disa(test, items, book["OpenSCAP - DISA Compliance"]) diff --git a/dojo/tools/eslint/parser.py b/dojo/tools/eslint/parser.py index c3e2167b8c3..a3a021fc995 100644 --- a/dojo/tools/eslint/parser.py +++ b/dojo/tools/eslint/parser.py @@ -21,7 +21,7 @@ def _convert_eslint_severity_to_dojo_severity(self, eslint_severity): else: return "Info" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, "utf-8")) diff --git a/dojo/tools/fortify/parser.py b/dojo/tools/fortify/parser.py index 38f3c336a42..6e20f23fabf 100644 --- a/dojo/tools/fortify/parser.py +++ b/dojo/tools/fortify/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Findings from XML file format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): fortify_scan = ElementTree.parse(filename) root = fortify_scan.getroot() diff --git a/dojo/tools/generic/parser.py b/dojo/tools/generic/parser.py index ab0f451b0ad..e242006338a 100644 --- a/dojo/tools/generic/parser.py +++ b/dojo/tools/generic/parser.py @@ -21,7 +21,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Generic findings in CSV or JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename.name.lower().endswith(".csv"): return self._get_findings_csv(filename) elif filename.name.lower().endswith(".json"): diff --git a/dojo/tools/ggshield/parser.py b/dojo/tools/ggshield/parser.py index 3d6373c87e9..099cea40d30 100755 --- a/dojo/tools/ggshield/parser.py +++ b/dojo/tools/ggshield/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Ggshield Scan findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): """ Converts a Ggshield report to DefectDojo findings """ diff --git a/dojo/tools/github_vulnerability/parser.py b/dojo/tools/github_vulnerability/parser.py index 15bf37606c9..a8356f31f9d 100644 --- a/dojo/tools/github_vulnerability/parser.py +++ b/dojo/tools/github_vulnerability/parser.py @@ -15,7 +15,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import vulnerabilities from Github API (GraphQL Query)" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) if "data" not in data: raise ValueError("Invalid report file, no 'data' node found") diff --git a/dojo/tools/gitlab_api_fuzzing/parser.py b/dojo/tools/gitlab_api_fuzzing/parser.py index 270abdc0536..5b46869e461 100644 --- a/dojo/tools/gitlab_api_fuzzing/parser.py +++ b/dojo/tools/gitlab_api_fuzzing/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "GitLab API Fuzzing Report report file can be imported in JSON format (option --json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): findings = [] data = json.load(file) vulnerabilities = data["vulnerabilities"] diff --git a/dojo/tools/gitlab_container_scan/parser.py b/dojo/tools/gitlab_container_scan/parser.py index 0912d2fd2e6..0f0917147bd 100644 --- a/dojo/tools/gitlab_container_scan/parser.py +++ b/dojo/tools/gitlab_container_scan/parser.py @@ -68,7 +68,7 @@ def _get_package_string(self, dependency): else None ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): findings = [] data = json.load(file) # parse date diff --git a/dojo/tools/gitlab_dast/parser.py b/dojo/tools/gitlab_dast/parser.py index fc02d5901bd..fc50f631283 100644 --- a/dojo/tools/gitlab_dast/parser.py +++ b/dojo/tools/gitlab_dast/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "GitLab DAST Report in JSON format (option --json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file is None: return None diff --git a/dojo/tools/gitlab_dep_scan/parser.py b/dojo/tools/gitlab_dep_scan/parser.py index 16692e88199..9e66d8f9a0d 100644 --- a/dojo/tools/gitlab_dep_scan/parser.py +++ b/dojo/tools/gitlab_dep_scan/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import GitLab SAST Report vulnerabilities in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return diff --git a/dojo/tools/gitlab_sast/parser.py b/dojo/tools/gitlab_sast/parser.py index 91fec1e1451..0c37d8c7d50 100644 --- a/dojo/tools/gitlab_sast/parser.py +++ b/dojo/tools/gitlab_sast/parser.py @@ -15,7 +15,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import GitLab SAST Report vulnerabilities in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return diff --git a/dojo/tools/gitlab_secret_detection_report/parser.py b/dojo/tools/gitlab_secret_detection_report/parser.py index f6e89adb844..838d695e543 100644 --- a/dojo/tools/gitlab_secret_detection_report/parser.py +++ b/dojo/tools/gitlab_secret_detection_report/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "GitLab Secret Detection Report file can be imported in JSON format (option --json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): # Load JSON data from uploaded file data = json.load(file) diff --git a/dojo/tools/gitleaks/parser.py b/dojo/tools/gitleaks/parser.py index 513d43dd752..a29d617a62e 100644 --- a/dojo/tools/gitleaks/parser.py +++ b/dojo/tools/gitleaks/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Gitleaks Scan findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): """ Converts a Gitleaks report to DefectDojo findings """ diff --git a/dojo/tools/gosec/parser.py b/dojo/tools/gosec/parser.py index 4d3824913bc..d0d1b019743 100644 --- a/dojo/tools/gosec/parser.py +++ b/dojo/tools/gosec/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Gosec Scanner findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, "utf-8")) diff --git a/dojo/tools/govulncheck/parser.py b/dojo/tools/govulncheck/parser.py index a10f5759649..e5b912d53d7 100644 --- a/dojo/tools/govulncheck/parser.py +++ b/dojo/tools/govulncheck/parser.py @@ -37,7 +37,7 @@ def get_location(data, node): def get_version(data, node): return data["Requires"]["Modules"][str(node)]["Version"] - def get_findings(self, scan_file, test): + def get_findings(self, scan_file, test, parser_custom_setting=None): findings = [] try: data = json.load(scan_file) diff --git a/dojo/tools/h1/parser.py b/dojo/tools/h1/parser.py index 8d3409799f9..c9f1651f155 100644 --- a/dojo/tools/h1/parser.py +++ b/dojo/tools/h1/parser.py @@ -21,7 +21,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import HackerOne cases findings in JSON format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): """ Converts a HackerOne reports to a DefectDojo finding """ diff --git a/dojo/tools/hadolint/parser.py b/dojo/tools/hadolint/parser.py index 9e907160fc5..1b42c1abb92 100644 --- a/dojo/tools/hadolint/parser.py +++ b/dojo/tools/hadolint/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Hadolint Dockerfile check findings in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/harbor_vulnerability/parser.py b/dojo/tools/harbor_vulnerability/parser.py index 7f5d2b88986..af73050bb26 100644 --- a/dojo/tools/harbor_vulnerability/parser.py +++ b/dojo/tools/harbor_vulnerability/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import vulnerabilities from Harbor API." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, "utf-8")) diff --git a/dojo/tools/hcl_appscan/parser.py b/dojo/tools/hcl_appscan/parser.py index b40817fd38b..4a1a0c6ab1e 100755 --- a/dojo/tools/hcl_appscan/parser.py +++ b/dojo/tools/hcl_appscan/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import XML output of HCL AppScan." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): findings = [] tree = ET.parse(file) root = tree.getroot() diff --git a/dojo/tools/horusec/parser.py b/dojo/tools/horusec/parser.py index 8eeecc1dbc6..037b5384082 100644 --- a/dojo/tools/horusec/parser.py +++ b/dojo/tools/horusec/parser.py @@ -25,7 +25,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON output of Horusec cli." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) report_date = datetime.strptime( data.get("createdAt")[0:10], "%Y-%m-%d" diff --git a/dojo/tools/humble/parser.py b/dojo/tools/humble/parser.py index 689ce080187..c7586b35823 100644 --- a/dojo/tools/humble/parser.py +++ b/dojo/tools/humble/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON output of Humble scan." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): items = [] try: data = json.load(filename) diff --git a/dojo/tools/huskyci/parser.py b/dojo/tools/huskyci/parser.py index 455204bd524..fc8d122a876 100644 --- a/dojo/tools/huskyci/parser.py +++ b/dojo/tools/huskyci/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import HuskyCI Report vulnerabilities in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return diff --git a/dojo/tools/hydra/parser.py b/dojo/tools/hydra/parser.py index f24160ac7f6..71bd78856c9 100644 --- a/dojo/tools/hydra/parser.py +++ b/dojo/tools/hydra/parser.py @@ -34,7 +34,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Hydra Scan can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): report = self.__parse_json(json_output) metadata = HydraScanMetadata(report["generator"]) diff --git a/dojo/tools/ibm_app/parser.py b/dojo/tools/ibm_app/parser.py index 8e4147a2282..9d1aef80096 100644 --- a/dojo/tools/ibm_app/parser.py +++ b/dojo/tools/ibm_app/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "XML file from IBM App Scanner." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): ibm_scan_tree = ElementTree.parse(file) root = ibm_scan_tree.getroot() diff --git a/dojo/tools/immuniweb/parser.py b/dojo/tools/immuniweb/parser.py index 6265d1f6203..25067094765 100644 --- a/dojo/tools/immuniweb/parser.py +++ b/dojo/tools/immuniweb/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "XML Scan Result File from Imuniweb Scan." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): ImmuniScanTree = ElementTree.parse(file) root = ImmuniScanTree.getroot() # validate XML file diff --git a/dojo/tools/intsights/parser.py b/dojo/tools/intsights/parser.py index 2c97225fae2..2363478a2d8 100644 --- a/dojo/tools/intsights/parser.py +++ b/dojo/tools/intsights/parser.py @@ -183,7 +183,7 @@ def _build_finding_description(self, alert: dict) -> str: ) return description - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): duplicates = dict() if file.name.lower().endswith(".json"): diff --git a/dojo/tools/jfrog_xray_api_summary_artifact/parser.py b/dojo/tools/jfrog_xray_api_summary_artifact/parser.py index f62d3532297..bf5ee90984e 100644 --- a/dojo/tools/jfrog_xray_api_summary_artifact/parser.py +++ b/dojo/tools/jfrog_xray_api_summary_artifact/parser.py @@ -24,7 +24,7 @@ def get_description_for_scan_types(self, scan_type): return "Import Xray findings in JSON format from the JFrog Xray API Summary/Artifact JSON response" # This function return a list of findings - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/jfrog_xray_on_demand_binary_scan/parser.py b/dojo/tools/jfrog_xray_on_demand_binary_scan/parser.py index b6901c289c1..0b744fccd0b 100644 --- a/dojo/tools/jfrog_xray_on_demand_binary_scan/parser.py +++ b/dojo/tools/jfrog_xray_on_demand_binary_scan/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Xray findings in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree) diff --git a/dojo/tools/jfrog_xray_unified/parser.py b/dojo/tools/jfrog_xray_unified/parser.py index 23e739101cd..fdc6b154d15 100644 --- a/dojo/tools/jfrog_xray_unified/parser.py +++ b/dojo/tools/jfrog_xray_unified/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Xray Unified (i.e. Xray version 3+) findings in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/jfrogxray/parser.py b/dojo/tools/jfrogxray/parser.py index 9f45abd6bed..8f57fe7f062 100644 --- a/dojo/tools/jfrogxray/parser.py +++ b/dojo/tools/jfrogxray/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Xray findings in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/kics/parser.py b/dojo/tools/kics/parser.py index 365a508cb96..c499c29807f 100644 --- a/dojo/tools/kics/parser.py +++ b/dojo/tools/kics/parser.py @@ -25,7 +25,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for KICS scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} for query in data["queries"]: diff --git a/dojo/tools/kiuwan/parser.py b/dojo/tools/kiuwan/parser.py index e1b7d540ec2..4f71239d94e 100644 --- a/dojo/tools/kiuwan/parser.py +++ b/dojo/tools/kiuwan/parser.py @@ -35,7 +35,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Kiuwan Scan in CSV format. Export as CSV Results on Kiuwan." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/kubebench/parser.py b/dojo/tools/kubebench/parser.py index a54bcaf480e..3d1a89a3c75 100644 --- a/dojo/tools/kubebench/parser.py +++ b/dojo/tools/kubebench/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON reports of Kubernetes CIS benchmark scans." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) if "Controls" in tree: return self.get_chapters(tree["Controls"], test) diff --git a/dojo/tools/kubehunter/parser.py b/dojo/tools/kubehunter/parser.py index 95cc6cddb5c..27834cb9869 100644 --- a/dojo/tools/kubehunter/parser.py +++ b/dojo/tools/kubehunter/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "KubeHunter JSON vulnerability report format.." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = json.load(file) dupes = dict() diff --git a/dojo/tools/meterian/parser.py b/dojo/tools/meterian/parser.py index e47cb469011..da66e6aeb84 100644 --- a/dojo/tools/meterian/parser.py +++ b/dojo/tools/meterian/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Meterian JSON report output file can be imported." - def get_findings(self, report, test): + def get_findings(self, report, test, parser_custom_setting=None): findings = [] report_json = json.load(report) diff --git a/dojo/tools/microfocus_webinspect/parser.py b/dojo/tools/microfocus_webinspect/parser.py index 114e11d59c4..739a7b49a37 100644 --- a/dojo/tools/microfocus_webinspect/parser.py +++ b/dojo/tools/microfocus_webinspect/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import XML report" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = parse(file) # get root of tree. root = tree.getroot() diff --git a/dojo/tools/mobsf/parser.py b/dojo/tools/mobsf/parser.py index 09ce4ab9b7c..d2fafbb5a65 100644 --- a/dojo/tools/mobsf/parser.py +++ b/dojo/tools/mobsf/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Export a JSON file using the API, api/v1/report_json." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, 'utf-8')) diff --git a/dojo/tools/mobsfscan/parser.py b/dojo/tools/mobsfscan/parser.py index 58514eaea80..0ba7484386a 100644 --- a/dojo/tools/mobsfscan/parser.py +++ b/dojo/tools/mobsfscan/parser.py @@ -24,7 +24,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON report for mobsfscan report file." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) if len(data.get("results")) == 0: return [] diff --git a/dojo/tools/mozilla_observatory/parser.py b/dojo/tools/mozilla_observatory/parser.py index 72e6a6d6236..e9d4d4fb0d5 100644 --- a/dojo/tools/mozilla_observatory/parser.py +++ b/dojo/tools/mozilla_observatory/parser.py @@ -22,7 +22,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON report." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = json.load(file) # format from the CLI if "tests" in data: diff --git a/dojo/tools/ms_defender/parser.py b/dojo/tools/ms_defender/parser.py index 3bcdf56e074..2414015f2c9 100644 --- a/dojo/tools/ms_defender/parser.py +++ b/dojo/tools/ms_defender/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return ("MSDefender findings can be retrieved using the REST API") - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if str(file.name).endswith('.json'): vulnerabilityfile = json.load(file) vulnerabilitydata = vulnerabilityfile['value'] diff --git a/dojo/tools/netsparker/parser.py b/dojo/tools/netsparker/parser.py index 9b4b2d31135..e77a4614144 100644 --- a/dojo/tools/netsparker/parser.py +++ b/dojo/tools/netsparker/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Netsparker JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, "utf-8-sig")) diff --git a/dojo/tools/neuvector/parser.py b/dojo/tools/neuvector/parser.py index 17be7635686..5bc6fc813c1 100644 --- a/dojo/tools/neuvector/parser.py +++ b/dojo/tools/neuvector/parser.py @@ -139,7 +139,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON output of /v1/scan/{entity}/{id} endpoint." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/neuvector_compliance/parser.py b/dojo/tools/neuvector_compliance/parser.py index 74e5e515fd1..bfb340f30b0 100644 --- a/dojo/tools/neuvector_compliance/parser.py +++ b/dojo/tools/neuvector_compliance/parser.py @@ -145,7 +145,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Imports compliance scans returned by REST API." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/nexpose/parser.py b/dojo/tools/nexpose/parser.py index fc7a4344405..579777c2609 100644 --- a/dojo/tools/nexpose/parser.py +++ b/dojo/tools/nexpose/parser.py @@ -26,7 +26,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Use the full XML export template from Nexpose." - def get_findings(self, xml_output, test): + def get_findings(self, xml_output, test, parser_custom_setting=None): tree = ElementTree.parse(xml_output) vuln_definitions = self.get_vuln_definitions(tree) return self.get_items(tree, vuln_definitions, test) diff --git a/dojo/tools/nikto/parser.py b/dojo/tools/nikto/parser.py index b5c9cafe4b9..51081c5a27d 100644 --- a/dojo/tools/nikto/parser.py +++ b/dojo/tools/nikto/parser.py @@ -33,7 +33,7 @@ def get_description_for_scan_types(self, scan_type): 'XML output (old and new nxvmlversion="1.2" type) or JSON output' ) - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename.name.lower().endswith(".xml"): return self.process_xml(filename, test) elif filename.name.lower().endswith(".json"): diff --git a/dojo/tools/nmap/parser.py b/dojo/tools/nmap/parser.py index 171795126c9..1cc9cae8140 100755 --- a/dojo/tools/nmap/parser.py +++ b/dojo/tools/nmap/parser.py @@ -15,7 +15,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "XML output (use -oX)" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = parse(file) root = tree.getroot() dupes = dict() diff --git a/dojo/tools/npm_audit/parser.py b/dojo/tools/npm_audit/parser.py index 968d00e0c9a..b2b30c8159a 100644 --- a/dojo/tools/npm_audit/parser.py +++ b/dojo/tools/npm_audit/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "NPM Audit Scan json output up to v6 can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = self.parse_json(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/nsp/parser.py b/dojo/tools/nsp/parser.py index 40a7dcb66ab..0fcde0222f1 100644 --- a/dojo/tools/nsp/parser.py +++ b/dojo/tools/nsp/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Node Security Platform (NSP) output file can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = self.parse_json(json_output) if tree: return self.get_items(tree, test) diff --git a/dojo/tools/nuclei/parser.py b/dojo/tools/nuclei/parser.py index 76ed959eac6..5ec1063eb40 100644 --- a/dojo/tools/nuclei/parser.py +++ b/dojo/tools/nuclei/parser.py @@ -25,7 +25,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for nuclei scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): filecontent = filename.read() if isinstance(filecontent, bytes): filecontent = filecontent.decode("utf-8") diff --git a/dojo/tools/openscap/parser.py b/dojo/tools/openscap/parser.py index 9f3ba66132d..e26bea0df63 100644 --- a/dojo/tools/openscap/parser.py +++ b/dojo/tools/openscap/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Openscap Vulnerability Scan in XML formats." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = parse(file) # get root of tree. root = tree.getroot() diff --git a/dojo/tools/openvas_csv/parser.py b/dojo/tools/openvas_csv/parser.py index 04d6166b231..554fb59b525 100644 --- a/dojo/tools/openvas_csv/parser.py +++ b/dojo/tools/openvas_csv/parser.py @@ -248,7 +248,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import OpenVAS Scan in CSV format. Export as CSV Results on OpenVAS." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): column_names = dict() dupes = dict() chain = self.create_chain() diff --git a/dojo/tools/openvas_xml/parser.py b/dojo/tools/openvas_xml/parser.py index 65449e8c812..63e74332262 100755 --- a/dojo/tools/openvas_xml/parser.py +++ b/dojo/tools/openvas_xml/parser.py @@ -26,7 +26,7 @@ def convert_cvss_score(self, raw_value): else: return "Critical" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): findings = [] tree = ET.parse(file) root = tree.getroot() diff --git a/dojo/tools/ort/parser.py b/dojo/tools/ort/parser.py index d2811d3e170..2f8b542a266 100644 --- a/dojo/tools/ort/parser.py +++ b/dojo/tools/ort/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Outpost24 endpoint vulnerability scan in XML format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return list() diff --git a/dojo/tools/ossindex_devaudit/parser.py b/dojo/tools/ossindex_devaudit/parser.py index 8d04bac2d48..f33acfb20fa 100644 --- a/dojo/tools/ossindex_devaudit/parser.py +++ b/dojo/tools/ossindex_devaudit/parser.py @@ -1,118 +1,118 @@ -import json -from json import JSONDecodeError - -from dojo.models import Finding - - -class OssIndexDevauditParser(object): - """OssIndex Devaudit Results Parser - Parses files created by the Sonatype OssIndex Devaudit tool - https://github.com/sonatype-nexus-community/DevAudit - """ - - def get_scan_types(self): - return ["OssIndex Devaudit SCA Scan Importer"] - - def get_label_for_scan_types(self, scan_type): - return scan_type # no custom label for now - - def get_description_for_scan_types(self, scan_type): - return "Import OssIndex Devaudit SCA Scan in json format." - - def get_findings(self, json_file, test): - tree = self.parse_json(json_file) - - if tree: - return list([data for data in self.get_items(tree, test)]) - else: - return list() - - def parse_json(self, json_file): - if json_file is None: - return None - try: - tree = json.load(json_file) - except JSONDecodeError: - raise ValueError("Invalid format") - - return tree - - def get_items(self, tree, test): - items = {} - - results = {key: value for (key, value) in tree.items()} - for package in results.get("Packages", []): - package_data = package["Package"] - if len(package.get("Vulnerabilities", [])) > 0: - for vulnerability in package.get("Vulnerabilities", []): - item = get_item( - dependency_name=package_data["name"], - dependency_version=package_data["version"], - dependency_source=package_data["pm"], - vulnerability=vulnerability, - test=test, - ) - unique_key = vulnerability["id"] - items[unique_key] = item - - return items.values() - - -def get_item( - dependency_name, dependency_version, dependency_source, vulnerability, test -): - cwe_data = vulnerability.get("cwe", "CWE-1035") - if cwe_data is None or cwe_data.startswith("CWE") is False: - cwe_data = "CWE-1035" - try: - cwe = int(cwe_data.split("-")[1]) - except ValueError: - raise ValueError( - "Attempting to convert the CWE value to an integer failed" - ) - - finding = Finding( - title=dependency_source - + ":" - + dependency_name - + " - " - + "(" - + dependency_version - + ", " - + cwe_data - + ")", - test=test, - severity=get_severity(vulnerability.get("cvssScore", "")), - description=vulnerability["title"], - cwe=cwe, - cvssv3=vulnerability["cvssVector"].replace("CVSS:3.0", ""), - mitigation="Upgrade the component to the latest non-vulnerable version, or remove the package if it is not in use.", - references=vulnerability.get("reference", ""), - false_p=False, - duplicate=False, - out_of_scope=False, - mitigated=None, - static_finding=False, - dynamic_finding=False, - impact="No impact provided by scan", - ) - - return finding - - -def get_severity(cvss_score): - result = "Info" - - if cvss_score != "": - ratings = [ - ("Critical", 9.0, 10.0), - ("High", 7.0, 8.9), - ("Medium", 4.0, 6.9), - ("Low", 0.1, 3.9), - ] - - for severity, low, high in ratings: - if low <= float(cvss_score) <= high: - result = severity - - return result +import json +from json import JSONDecodeError + +from dojo.models import Finding + + +class OssIndexDevauditParser(object): + """OssIndex Devaudit Results Parser + Parses files created by the Sonatype OssIndex Devaudit tool + https://github.com/sonatype-nexus-community/DevAudit + """ + + def get_scan_types(self): + return ["OssIndex Devaudit SCA Scan Importer"] + + def get_label_for_scan_types(self, scan_type): + return scan_type # no custom label for now + + def get_description_for_scan_types(self, scan_type): + return "Import OssIndex Devaudit SCA Scan in json format." + + def get_findings(self, json_file, test, parser_custom_setting=None): + tree = self.parse_json(json_file) + + if tree: + return list([data for data in self.get_items(tree, test)]) + else: + return list() + + def parse_json(self, json_file): + if json_file is None: + return None + try: + tree = json.load(json_file) + except JSONDecodeError: + raise ValueError("Invalid format") + + return tree + + def get_items(self, tree, test): + items = {} + + results = {key: value for (key, value) in tree.items()} + for package in results.get("Packages", []): + package_data = package["Package"] + if len(package.get("Vulnerabilities", [])) > 0: + for vulnerability in package.get("Vulnerabilities", []): + item = get_item( + dependency_name=package_data["name"], + dependency_version=package_data["version"], + dependency_source=package_data["pm"], + vulnerability=vulnerability, + test=test, + ) + unique_key = vulnerability["id"] + items[unique_key] = item + + return items.values() + + +def get_item( + dependency_name, dependency_version, dependency_source, vulnerability, test +): + cwe_data = vulnerability.get("cwe", "CWE-1035") + if cwe_data is None or cwe_data.startswith("CWE") is False: + cwe_data = "CWE-1035" + try: + cwe = int(cwe_data.split("-")[1]) + except ValueError: + raise ValueError( + "Attempting to convert the CWE value to an integer failed" + ) + + finding = Finding( + title=dependency_source + + ":" + + dependency_name + + " - " + + "(" + + dependency_version + + ", " + + cwe_data + + ")", + test=test, + severity=get_severity(vulnerability.get("cvssScore", "")), + description=vulnerability["title"], + cwe=cwe, + cvssv3=vulnerability["cvssVector"].replace("CVSS:3.0", ""), + mitigation="Upgrade the component to the latest non-vulnerable version, or remove the package if it is not in use.", + references=vulnerability.get("reference", ""), + false_p=False, + duplicate=False, + out_of_scope=False, + mitigated=None, + static_finding=False, + dynamic_finding=False, + impact="No impact provided by scan", + ) + + return finding + + +def get_severity(cvss_score): + result = "Info" + + if cvss_score != "": + ratings = [ + ("Critical", 9.0, 10.0), + ("High", 7.0, 8.9), + ("Medium", 4.0, 6.9), + ("Low", 0.1, 3.9), + ] + + for severity, low, high in ratings: + if low <= float(cvss_score) <= high: + result = severity + + return result diff --git a/dojo/tools/outpost24/parser.py b/dojo/tools/outpost24/parser.py index 8fd244cc425..bd280cf9ce2 100644 --- a/dojo/tools/outpost24/parser.py +++ b/dojo/tools/outpost24/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Outpost24 endpoint vulnerability scan in XML format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = ElementTree.parse(file) items = list() for detail in tree.iterfind(".//detaillist/detail"): diff --git a/dojo/tools/php_security_audit_v2/parser.py b/dojo/tools/php_security_audit_v2/parser.py index f1ee8022c1a..5a2290e73c5 100644 --- a/dojo/tools/php_security_audit_v2/parser.py +++ b/dojo/tools/php_security_audit_v2/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import PHP Security Audit v2 Scan in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, "utf-8")) diff --git a/dojo/tools/php_symfony_security_check/parser.py b/dojo/tools/php_symfony_security_check/parser.py index c5fb5118804..21f063271d8 100644 --- a/dojo/tools/php_symfony_security_check/parser.py +++ b/dojo/tools/php_symfony_security_check/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import results from the PHP Symfony Security Checker by Sensioslabs." - def get_findings(self, json_file, test): + def get_findings(self, json_file, test, parser_custom_setting=None): tree = self.parse_json(json_file) return self.get_items(tree, test) diff --git a/dojo/tools/pip_audit/parser.py b/dojo/tools/pip_audit/parser.py index 726667987fb..cd39dba97f0 100644 --- a/dojo/tools/pip_audit/parser.py +++ b/dojo/tools/pip_audit/parser.py @@ -16,7 +16,7 @@ def get_description_for_scan_types(self, scan_type): def requires_file(self, scan_type): return True - def get_findings(self, scan_file, test): + def get_findings(self, scan_file, test, parser_custom_setting=None): data = json.load(scan_file) findings = list() diff --git a/dojo/tools/pmd/parser.py b/dojo/tools/pmd/parser.py index d3f8c5eda2e..1fb6e5e79b0 100644 --- a/dojo/tools/pmd/parser.py +++ b/dojo/tools/pmd/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "CSV Report" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): dupes = dict() content = filename.read() diff --git a/dojo/tools/popeye/parser.py b/dojo/tools/popeye/parser.py index 67e176a9110..e42c02fcbb5 100644 --- a/dojo/tools/popeye/parser.py +++ b/dojo/tools/popeye/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Popeye report file can be imported in JSON format (option --json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = json.load(file) dupes = dict() diff --git a/dojo/tools/pwn_sast/parser.py b/dojo/tools/pwn_sast/parser.py index 0b5a942eb41..9a48c453c1f 100644 --- a/dojo/tools/pwn_sast/parser.py +++ b/dojo/tools/pwn_sast/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import pwn_sast Driver findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): results = json.load(filename) if results is not None: diff --git a/dojo/tools/qualys/parser.py b/dojo/tools/qualys/parser.py index 567233b0f61..eabcd1c9823 100644 --- a/dojo/tools/qualys/parser.py +++ b/dojo/tools/qualys/parser.py @@ -285,7 +285,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Qualys WebGUI output files can be imported in XML format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file.name.lower().endswith(".csv"): return csv_parser.parse_csv(file) else: diff --git a/dojo/tools/qualys_infrascan_webgui/parser.py b/dojo/tools/qualys_infrascan_webgui/parser.py index e60084619a7..b6d7bdbac45 100644 --- a/dojo/tools/qualys_infrascan_webgui/parser.py +++ b/dojo/tools/qualys_infrascan_webgui/parser.py @@ -136,7 +136,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Qualys WebGUI output files can be imported in XML format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): data = ElementTree.parse(file).getroot() # fetch scan date e.g.: 2020-01-30T09:45:41Z diff --git a/dojo/tools/retirejs/parser.py b/dojo/tools/retirejs/parser.py index 2482d517dc2..1903fbf84bc 100644 --- a/dojo/tools/retirejs/parser.py +++ b/dojo/tools/retirejs/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Retire.js JavaScript scan (--js) output file can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/risk_recon/parser.py b/dojo/tools/risk_recon/parser.py index 8c70496d691..d288a43e6bc 100644 --- a/dojo/tools/risk_recon/parser.py +++ b/dojo/tools/risk_recon/parser.py @@ -15,7 +15,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Risk Recon ApI will be accessed to gather finding information. Report format here." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename: tree = filename.read() try: diff --git a/dojo/tools/rubocop/parser.py b/dojo/tools/rubocop/parser.py index db18a4619b3..1437d6a00f8 100644 --- a/dojo/tools/rubocop/parser.py +++ b/dojo/tools/rubocop/parser.py @@ -33,7 +33,7 @@ def get_description_for_scan_types(self, scan_type): def requires_file(self, scan_type): return True - def get_findings(self, scan_file, test): + def get_findings(self, scan_file, test, parser_custom_setting=None): """Load a file as JSON file and create findings""" data = json.load(scan_file) findings = list() diff --git a/dojo/tools/rusty_hog/parser.py b/dojo/tools/rusty_hog/parser.py index da0baa6c83e..c060fbb8e55 100644 --- a/dojo/tools/rusty_hog/parser.py +++ b/dojo/tools/rusty_hog/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Rusty Hog Scan - JSON Report" - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/sarif/parser.py b/dojo/tools/sarif/parser.py index 14d81849570..c067846d825 100644 --- a/dojo/tools/sarif/parser.py +++ b/dojo/tools/sarif/parser.py @@ -28,7 +28,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "SARIF report file can be imported in SARIF format." - def get_findings(self, filehandle, test): + def get_findings(self, filehandle, test, parser_custom_setting=None): """For simple interface of parser contract we just aggregate everything""" tree = json.load(filehandle) items = list() diff --git a/dojo/tools/scantist/parser.py b/dojo/tools/scantist/parser.py index d4b1e6c0766..edd8d9cc846 100644 --- a/dojo/tools/scantist/parser.py +++ b/dojo/tools/scantist/parser.py @@ -27,7 +27,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Scantist Dependency Scanning Report vulnerabilities in JSON format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = json.load(file) return self.get_items(tree, test) diff --git a/dojo/tools/scout_suite/parser.py b/dojo/tools/scout_suite/parser.py index 038efd52514..344a0d73732 100644 --- a/dojo/tools/scout_suite/parser.py +++ b/dojo/tools/scout_suite/parser.py @@ -84,7 +84,7 @@ def get_tests(self, scan_type, handle): tests.append(test) return tests - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/semgrep/parser.py b/dojo/tools/semgrep/parser.py index 1a39e42d9d0..c9b809af330 100644 --- a/dojo/tools/semgrep/parser.py +++ b/dojo/tools/semgrep/parser.py @@ -13,7 +13,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import Semgrep output (--json)" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = dict() diff --git a/dojo/tools/skf/parser.py b/dojo/tools/skf/parser.py index 82000756930..5ffd49c909c 100644 --- a/dojo/tools/skf/parser.py +++ b/dojo/tools/skf/parser.py @@ -91,7 +91,7 @@ def read_column_names(self, column_names, row): column_names[index] = column index += 1 - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/snyk/parser.py b/dojo/tools/snyk/parser.py index b5ee592cabe..cd68b3dd7e2 100755 --- a/dojo/tools/snyk/parser.py +++ b/dojo/tools/snyk/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Snyk output file (snyk test --json > snyk.json) can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): reportTree = self.parse_json(json_output) if isinstance(reportTree, list): diff --git a/dojo/tools/solar_appscreener/parser.py b/dojo/tools/solar_appscreener/parser.py index 093d476fd2a..d02010eead0 100644 --- a/dojo/tools/solar_appscreener/parser.py +++ b/dojo/tools/solar_appscreener/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Solar Appscreener report file can be imported in CSV format from Detailed_Results.csv." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return () diff --git a/dojo/tools/sonarqube/parser.py b/dojo/tools/sonarqube/parser.py index b8026fc453f..f951cef72cc 100644 --- a/dojo/tools/sonarqube/parser.py +++ b/dojo/tools/sonarqube/parser.py @@ -27,7 +27,7 @@ def get_description_for_scan_types(self, scan_type): else: return "Import all findings from sonarqube html report. SonarQube output file can be imported in HTML format. Generate with https://github.com/soprasteria/sonar-report version >= 1.1.0" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): parser = etree.HTMLParser() tree = etree.parse(filename, parser) if self.mode not in [None, "detailed"]: diff --git a/dojo/tools/sonatype/parser.py b/dojo/tools/sonatype/parser.py index 0e3934f9131..4362b10f0ee 100644 --- a/dojo/tools/sonatype/parser.py +++ b/dojo/tools/sonatype/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Can be imported in JSON format" - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): tree = json.load(json_output) return self.get_items(tree, test) diff --git a/dojo/tools/spotbugs/parser.py b/dojo/tools/spotbugs/parser.py index a9a0d23f031..10f9d7abbc2 100644 --- a/dojo/tools/spotbugs/parser.py +++ b/dojo/tools/spotbugs/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "XML report of textui cli." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): mitigation_patterns = dict() reference_patterns = dict() dupes = dict() diff --git a/dojo/tools/ssh_audit/parser.py b/dojo/tools/ssh_audit/parser.py index 3bcac5e5eed..12e31583251 100644 --- a/dojo/tools/ssh_audit/parser.py +++ b/dojo/tools/ssh_audit/parser.py @@ -31,7 +31,7 @@ def convert_cvss_score(self, raw_value): else: return "Critical" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): items = [] try: data = json.load(filename) diff --git a/dojo/tools/ssl_labs/parser.py b/dojo/tools/ssl_labs/parser.py index 5c99ef03e31..ddf89361768 100644 --- a/dojo/tools/ssl_labs/parser.py +++ b/dojo/tools/ssl_labs/parser.py @@ -16,7 +16,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON Output of ssllabs-scan cli." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): tree = filename.read() try: data = json.loads(str(tree, "utf-8")) diff --git a/dojo/tools/sslscan/parser.py b/dojo/tools/sslscan/parser.py index f5166c407da..1142995cd70 100644 --- a/dojo/tools/sslscan/parser.py +++ b/dojo/tools/sslscan/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import XML output of sslscan report." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = ET.parse(file) # get root of tree. root = tree.getroot() diff --git a/dojo/tools/sslyze/parser.py b/dojo/tools/sslyze/parser.py index 4f557d887ac..9852aa78cf7 100644 --- a/dojo/tools/sslyze/parser.py +++ b/dojo/tools/sslyze/parser.py @@ -16,7 +16,7 @@ def get_description_for_scan_types(self, scan_type): return "Import JSON report of SSLyze version 3 and higher." return "Import XML report of SSLyze version 2 scan." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/sslyze/parser_json.py b/dojo/tools/sslyze/parser_json.py index 112695fb079..83f5771e75a 100644 --- a/dojo/tools/sslyze/parser_json.py +++ b/dojo/tools/sslyze/parser_json.py @@ -69,7 +69,7 @@ class SSLyzeJSONParser(object): - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return diff --git a/dojo/tools/sslyze/parser_xml.py b/dojo/tools/sslyze/parser_xml.py index bb6dc004578..c08613459bb 100644 --- a/dojo/tools/sslyze/parser_xml.py +++ b/dojo/tools/sslyze/parser_xml.py @@ -1,168 +1,168 @@ -import hashlib -from xml.dom import NamespaceErr - -from defusedxml import ElementTree as ET - -from dojo.models import Endpoint, Finding - -__author__ = "dr3dd589" - -# FIXME discuss this list as maintenance subject -WEAK_CIPHER_LIST = [ - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", - "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", - "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", - "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", - "TLS_DHE_RSA_WITH_SEED_CBC_SHA", - "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", - "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", - "TLS_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_RSA_WITH_AES_128_CBC_SHA", - "TLS_RSA_WITH_AES_128_CBC_SHA256", - "TLS_RSA_WITH_AES_128_CCM", - "TLS_RSA_WITH_AES_128_CCM_8", - "TLS_RSA_WITH_AES_128_GCM_SHA256", - "TLS_RSA_WITH_AES_256_CBC_SHA", - "TLS_RSA_WITH_AES_256_CBC_SHA256", - "TLS_RSA_WITH_AES_256_CCM", - "TLS_RSA_WITH_AES_256_CCM_8", - "TLS_RSA_WITH_AES_256_GCM_SHA384", - "TLS_RSA_WITH_ARIA_128_GCM_SHA256", - "TLS_RSA_WITH_ARIA_256_GCM_SHA384", - "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", - "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", - "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", - "TLS_RSA_WITH_IDEA_CBC_SHA", - "TLS_RSA_WITH_SEED_CBC_SHA", -] - -PROTOCOLS = ["sslv2", "sslv3", "tlsv1", "tlsv1_1", "tlsv1_2", "tlsv1_3"] - - -class SSLyzeXMLParser(object): - def get_findings(self, file, test): - tree = ET.parse(file) - # get root of tree. - root = tree.getroot() - if "document" not in root.tag: - raise NamespaceErr( - "This doesn't seem to be a valid sslyze xml file." - ) - - results = root.find("results") - dupes = dict() - for target in results: - host = target.attrib["host"] - port = target.attrib["port"] - protocol = target.attrib["tlsWrappedProtocol"] - for element in target: - title = "" - severity = "" - description = "" - severity = "Info" - weak_cipher = {} - if element.tag == "heartbleed": - heartbleed_element = element.find("openSslHeartbleed") - if "isVulnerable" in heartbleed_element.attrib: - if heartbleed_element.attrib["isVulnerable"] == "True": - title = element.attrib["title"] + " | " + host - description = ( - "**heartbleed** : Vulnerable" - + "\n\n" - + "**title** : " - + element.attrib["title"] - ) - if element.tag == "openssl_ccs": - openssl_ccs_element = element.find("openSslCcsInjection") - if "isVulnerable" in openssl_ccs_element.attrib: - if ( - openssl_ccs_element.attrib["isVulnerable"] - == "True" - ): - title = element.attrib["title"] + " | " + host - description = ( - "**openssl_ccs** : Vulnerable" - + "\n\n" - + "**title** : " - + element.attrib["title"] - ) - if element.tag == "reneg": - reneg_element = element.find("sessionRenegotiation") - if "isSecure" in reneg_element.attrib: - if reneg_element.attrib["isSecure"] == "False": - title = element.attrib["title"] + " | " + host - description = ( - "**Session Renegotiation** : Vulnerable" - + "\n\n" - + "**title** : " - + element.attrib["title"] - ) - if ( - element.tag in PROTOCOLS - and element.attrib["isProtocolSupported"] == "True" - ): - weak_cipher[element.tag] = [] - for ciphers in element: - if ( - ciphers.tag == "preferredCipherSuite" - or ciphers.tag == "acceptedCipherSuites" - ): - for cipher in ciphers: - if cipher.attrib["name"] in WEAK_CIPHER_LIST: - if ( - not cipher.attrib["name"] - in weak_cipher[element.tag] - ): - weak_cipher[element.tag].append( - cipher.attrib["name"] - ) - if len(weak_cipher[element.tag]) > 0: - title = ( - element.tag + " | " + "Weak Ciphers" + " | " + host - ) - description = ( - "**Protocol** : " - + element.tag - + "\n\n" - + "**Weak Ciphers** : " - + ",\n\n".join(weak_cipher[element.tag]) - ) - if title and description is not None: - dupe_key = hashlib.md5( - str(description + title).encode("utf-8") - ).hexdigest() - if dupe_key in dupes: - finding = dupes[dupe_key] - if finding.references: - finding.references = finding.references - dupes[dupe_key] = finding - else: - dupes[dupe_key] = True - - finding = Finding( - title=title, - test=test, - description=description, - severity=severity, - dynamic_finding=True, - ) - finding.unsaved_endpoints = list() - dupes[dupe_key] = finding - - if host is not None: - finding.unsaved_endpoints.append( - Endpoint( - host=host, port=port, protocol=protocol - ) - ) - return dupes.values() +import hashlib +from xml.dom import NamespaceErr + +from defusedxml import ElementTree as ET + +from dojo.models import Endpoint, Finding + +__author__ = "dr3dd589" + +# FIXME discuss this list as maintenance subject +WEAK_CIPHER_LIST = [ + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", + "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", + "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", + "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", + "TLS_DHE_RSA_WITH_SEED_CBC_SHA", + "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", + "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", + "TLS_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_RSA_WITH_AES_128_CBC_SHA", + "TLS_RSA_WITH_AES_128_CBC_SHA256", + "TLS_RSA_WITH_AES_128_CCM", + "TLS_RSA_WITH_AES_128_CCM_8", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + "TLS_RSA_WITH_AES_256_CBC_SHA", + "TLS_RSA_WITH_AES_256_CBC_SHA256", + "TLS_RSA_WITH_AES_256_CCM", + "TLS_RSA_WITH_AES_256_CCM_8", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_ARIA_128_GCM_SHA256", + "TLS_RSA_WITH_ARIA_256_GCM_SHA384", + "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", + "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", + "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", + "TLS_RSA_WITH_IDEA_CBC_SHA", + "TLS_RSA_WITH_SEED_CBC_SHA", +] + +PROTOCOLS = ["sslv2", "sslv3", "tlsv1", "tlsv1_1", "tlsv1_2", "tlsv1_3"] + + +class SSLyzeXMLParser(object): + def get_findings(self, file, test, parser_custom_setting=None): + tree = ET.parse(file) + # get root of tree. + root = tree.getroot() + if "document" not in root.tag: + raise NamespaceErr( + "This doesn't seem to be a valid sslyze xml file." + ) + + results = root.find("results") + dupes = dict() + for target in results: + host = target.attrib["host"] + port = target.attrib["port"] + protocol = target.attrib["tlsWrappedProtocol"] + for element in target: + title = "" + severity = "" + description = "" + severity = "Info" + weak_cipher = {} + if element.tag == "heartbleed": + heartbleed_element = element.find("openSslHeartbleed") + if "isVulnerable" in heartbleed_element.attrib: + if heartbleed_element.attrib["isVulnerable"] == "True": + title = element.attrib["title"] + " | " + host + description = ( + "**heartbleed** : Vulnerable" + + "\n\n" + + "**title** : " + + element.attrib["title"] + ) + if element.tag == "openssl_ccs": + openssl_ccs_element = element.find("openSslCcsInjection") + if "isVulnerable" in openssl_ccs_element.attrib: + if ( + openssl_ccs_element.attrib["isVulnerable"] + == "True" + ): + title = element.attrib["title"] + " | " + host + description = ( + "**openssl_ccs** : Vulnerable" + + "\n\n" + + "**title** : " + + element.attrib["title"] + ) + if element.tag == "reneg": + reneg_element = element.find("sessionRenegotiation") + if "isSecure" in reneg_element.attrib: + if reneg_element.attrib["isSecure"] == "False": + title = element.attrib["title"] + " | " + host + description = ( + "**Session Renegotiation** : Vulnerable" + + "\n\n" + + "**title** : " + + element.attrib["title"] + ) + if ( + element.tag in PROTOCOLS + and element.attrib["isProtocolSupported"] == "True" + ): + weak_cipher[element.tag] = [] + for ciphers in element: + if ( + ciphers.tag == "preferredCipherSuite" + or ciphers.tag == "acceptedCipherSuites" + ): + for cipher in ciphers: + if cipher.attrib["name"] in WEAK_CIPHER_LIST: + if ( + not cipher.attrib["name"] + in weak_cipher[element.tag] + ): + weak_cipher[element.tag].append( + cipher.attrib["name"] + ) + if len(weak_cipher[element.tag]) > 0: + title = ( + element.tag + " | " + "Weak Ciphers" + " | " + host + ) + description = ( + "**Protocol** : " + + element.tag + + "\n\n" + + "**Weak Ciphers** : " + + ",\n\n".join(weak_cipher[element.tag]) + ) + if title and description is not None: + dupe_key = hashlib.md5( + str(description + title).encode("utf-8") + ).hexdigest() + if dupe_key in dupes: + finding = dupes[dupe_key] + if finding.references: + finding.references = finding.references + dupes[dupe_key] = finding + else: + dupes[dupe_key] = True + + finding = Finding( + title=title, + test=test, + description=description, + severity=severity, + dynamic_finding=True, + ) + finding.unsaved_endpoints = list() + dupes[dupe_key] = finding + + if host is not None: + finding.unsaved_endpoints.append( + Endpoint( + host=host, port=port, protocol=protocol + ) + ) + return dupes.values() diff --git a/dojo/tools/stackhawk/parser.py b/dojo/tools/stackhawk/parser.py index a8bb4aa09b1..4d417ed592e 100644 --- a/dojo/tools/stackhawk/parser.py +++ b/dojo/tools/stackhawk/parser.py @@ -28,7 +28,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "StackHawk webhook event can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): completed_scan = self.__parse_json(json_output) metadata = StackHawkScanMetadata(completed_scan) diff --git a/dojo/tools/sysdig_reports/parser.py b/dojo/tools/sysdig_reports/parser.py index 2010ffb48e0..3628e284fbf 100644 --- a/dojo/tools/sysdig_reports/parser.py +++ b/dojo/tools/sysdig_reports/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import of Sysdig Pipeline, Registry and Runtime Vulnerability Report Scans in CSV format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return () diff --git a/dojo/tools/talisman/parser.py b/dojo/tools/talisman/parser.py index 8b07e52d889..489901451a3 100644 --- a/dojo/tools/talisman/parser.py +++ b/dojo/tools/talisman/parser.py @@ -27,7 +27,7 @@ def get_description_for_scan_types(self, scan_type): """ return "Import Talisman Scan findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): """ Converts a Talisman JSON report to DefectDojo findings """ diff --git a/dojo/tools/tenable/csv_format.py b/dojo/tools/tenable/csv_format.py index a2e2b72d086..c67e896a722 100644 --- a/dojo/tools/tenable/csv_format.py +++ b/dojo/tools/tenable/csv_format.py @@ -63,7 +63,7 @@ def _format_cpe(self, val): cpe_match = re.findall(r"cpe:/[^\n\ ]+", val) return cpe_match if cpe_match else None - def get_findings(self, filename: str, test: Test): + def get_findings(self, filename: str, test: Test, parser_custom_setting=None): # Read the CSV content = filename.read() if isinstance(content, bytes): diff --git a/dojo/tools/tenable/parser.py b/dojo/tools/tenable/parser.py index 0b54e9ea2d9..8cd57c2a1eb 100644 --- a/dojo/tools/tenable/parser.py +++ b/dojo/tools/tenable/parser.py @@ -14,7 +14,7 @@ def get_description_for_scan_types(self, scan_type): "Reports can be imported as CSV or .nessus (XML) report formats." ) - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename.name.lower().endswith( ".xml" ) or filename.name.lower().endswith(".nessus"): diff --git a/dojo/tools/tenable/xml_format.py b/dojo/tools/tenable/xml_format.py index aa8b17c9b19..f0ebd307265 100644 --- a/dojo/tools/tenable/xml_format.py +++ b/dojo/tools/tenable/xml_format.py @@ -40,7 +40,7 @@ def safely_get_element_text(self, element): return element_text or None return None - def get_findings(self, filename: str, test: Test) -> list: + def get_findings(self, filename: str, test: Test, parser_custom_setting=None) -> list: # Read the XML nscan = ElementTree.parse(filename) root = nscan.getroot() diff --git a/dojo/tools/terrascan/parser.py b/dojo/tools/terrascan/parser.py index 15e9e068137..260b14f9541 100644 --- a/dojo/tools/terrascan/parser.py +++ b/dojo/tools/terrascan/parser.py @@ -24,7 +24,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for Terrascan scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} if "results" not in data and "violations" not in data.get("results"): diff --git a/dojo/tools/testssl/parser.py b/dojo/tools/testssl/parser.py index 0a03239c447..6a0901d80c3 100644 --- a/dojo/tools/testssl/parser.py +++ b/dojo/tools/testssl/parser.py @@ -15,7 +15,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import CSV output of testssl scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/tfsec/parser.py b/dojo/tools/tfsec/parser.py index fd6751cc534..c89a424183a 100644 --- a/dojo/tools/tfsec/parser.py +++ b/dojo/tools/tfsec/parser.py @@ -28,7 +28,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON output for TFSec scan report." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} if "results" not in data: diff --git a/dojo/tools/threagile/parser.py b/dojo/tools/threagile/parser.py index 88e8f838c2c..9a324e62a90 100644 --- a/dojo/tools/threagile/parser.py +++ b/dojo/tools/threagile/parser.py @@ -65,7 +65,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Threagile Risks Report in JSON format (risks.json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file is None: return None diff --git a/dojo/tools/trivy/parser.py b/dojo/tools/trivy/parser.py index f07a4b34bee..1ae2c241d09 100644 --- a/dojo/tools/trivy/parser.py +++ b/dojo/tools/trivy/parser.py @@ -70,7 +70,7 @@ def convert_cvss_score(self, raw_value): else: return "Critical" - def get_findings(self, scan_file, test): + def get_findings(self, scan_file, test, parser_custom_setting=None): scan_data = scan_file.read() try: diff --git a/dojo/tools/trivy_operator/parser.py b/dojo/tools/trivy_operator/parser.py index 4e1cadda7a0..d52aa648ce1 100644 --- a/dojo/tools/trivy_operator/parser.py +++ b/dojo/tools/trivy_operator/parser.py @@ -37,7 +37,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import trivy-operator JSON scan report." - def get_findings(self, scan_file, test): + def get_findings(self, scan_file, test, parser_custom_setting=None): scan_data = scan_file.read() try: diff --git a/dojo/tools/trufflehog/parser.py b/dojo/tools/trufflehog/parser.py index 77235356c6a..ce1f9fea283 100644 --- a/dojo/tools/trufflehog/parser.py +++ b/dojo/tools/trufflehog/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON Output of Trufflehog. Supports version 2 and 3 of https://github.com/trufflesecurity/trufflehog" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = filename.read() dict_strs = data.splitlines() if len(dict_strs) == 0: diff --git a/dojo/tools/trufflehog3/parser.py b/dojo/tools/trufflehog3/parser.py index f723da3ff6d..dae6884bbfd 100644 --- a/dojo/tools/trufflehog3/parser.py +++ b/dojo/tools/trufflehog3/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON Output of Trufflehog3, a fork of TruffleHog located at https://github.com/feeltheajf/truffleHog3" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = dict() diff --git a/dojo/tools/trustwave/parser.py b/dojo/tools/trustwave/parser.py index ae6cd859ca0..7c640e424d9 100644 --- a/dojo/tools/trustwave/parser.py +++ b/dojo/tools/trustwave/parser.py @@ -15,7 +15,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "CSV output of Trustwave vulnerability scan." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): content = filename.read() if isinstance(content, bytes): content = content.decode("utf-8") diff --git a/dojo/tools/trustwave_fusion_api/parser.py b/dojo/tools/trustwave_fusion_api/parser.py index 14701d2c9a2..8f67bf72890 100644 --- a/dojo/tools/trustwave_fusion_api/parser.py +++ b/dojo/tools/trustwave_fusion_api/parser.py @@ -21,7 +21,7 @@ def get_description_for_scan_types(self, scan_type): "Trustwave Fusion API report file can be imported in JSON format" ) - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = json.load(file) items = {} diff --git a/dojo/tools/twistlock/parser.py b/dojo/tools/twistlock/parser.py index 2c8a3e335d0..2b6cf3174bc 100644 --- a/dojo/tools/twistlock/parser.py +++ b/dojo/tools/twistlock/parser.py @@ -215,7 +215,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "JSON output of twistcli image scan or CSV." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/utils.py b/dojo/tools/utils.py index 8a26b44302d..4b6e6a5e163 100644 --- a/dojo/tools/utils.py +++ b/dojo/tools/utils.py @@ -14,7 +14,7 @@ def get_npm_cwe(item_node): """ cwe_node = item_node.get('cwe') if cwe_node: - if type(cwe_node) == list: + if type(cwe_node) is list: return int(cwe_node[0][4:]) elif cwe_node.startswith('CWE-'): cwe_string = cwe_node[4:] diff --git a/dojo/tools/vcg/parser.py b/dojo/tools/vcg/parser.py index da44d8b2065..b3338dd82e7 100644 --- a/dojo/tools/vcg/parser.py +++ b/dojo/tools/vcg/parser.py @@ -211,7 +211,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "VCG output can be imported in CSV or Xml formats." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/veracode/json_parser.py b/dojo/tools/veracode/json_parser.py index 4df65518e62..ce8ed671f30 100644 --- a/dojo/tools/veracode/json_parser.py +++ b/dojo/tools/veracode/json_parser.py @@ -50,7 +50,7 @@ class VeracodeJSONParser(object): 4: ("High", "High-risk licenses are typically strong copyleft licenses that require you to preserve the copyright and license notices, and require distributors to make the source code of the component and any modifications under the same terms."), } - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): findings = [] if json_output: json_data = json.load(json_output) diff --git a/dojo/tools/veracode/parser.py b/dojo/tools/veracode/parser.py index 008234f21b4..bfff7acd2ab 100644 --- a/dojo/tools/veracode/parser.py +++ b/dojo/tools/veracode/parser.py @@ -14,7 +14,7 @@ def get_description_for_scan_types(self, scan_type): "Reports can be imported as JSON or XML report formats." ) - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename.name.lower().endswith(".xml"): return VeracodeXMLParser().get_findings(filename, test) elif filename.name.lower().endswith(".json"): diff --git a/dojo/tools/veracode/xml_parser.py b/dojo/tools/veracode/xml_parser.py index c8f71b79a4f..9a42be031d2 100644 --- a/dojo/tools/veracode/xml_parser.py +++ b/dojo/tools/veracode/xml_parser.py @@ -25,7 +25,7 @@ class VeracodeXMLParser(object): 5: "Critical", } - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): root = ElementTree.parse(filename).getroot() app_id = root.attrib["app_id"] diff --git a/dojo/tools/veracode_sca/parser.py b/dojo/tools/veracode_sca/parser.py index 91aa433c37c..1dc90271150 100644 --- a/dojo/tools/veracode_sca/parser.py +++ b/dojo/tools/veracode_sca/parser.py @@ -29,7 +29,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Veracode SourceClear CSV or JSON report format" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file is None: return () diff --git a/dojo/tools/wapiti/parser.py b/dojo/tools/wapiti/parser.py index 85925de9905..5f9e5e3a473 100644 --- a/dojo/tools/wapiti/parser.py +++ b/dojo/tools/wapiti/parser.py @@ -25,7 +25,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import XML report" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = parse(file) # get root of tree. root = tree.getroot() diff --git a/dojo/tools/wazuh/parser.py b/dojo/tools/wazuh/parser.py index b1ea19d836b..b6544af27c6 100644 --- a/dojo/tools/wazuh/parser.py +++ b/dojo/tools/wazuh/parser.py @@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Wazuh" - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) # Detect duplications dupes = dict() diff --git a/dojo/tools/wfuzz/parser.py b/dojo/tools/wfuzz/parser.py index 271b7d208c0..ad474bb8e94 100644 --- a/dojo/tools/wfuzz/parser.py +++ b/dojo/tools/wfuzz/parser.py @@ -28,7 +28,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import WFuzz findings in JSON format." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): data = json.load(filename) dupes = {} diff --git a/dojo/tools/whispers/parser.py b/dojo/tools/whispers/parser.py index 42b79ee7c70..b17ad02e11a 100644 --- a/dojo/tools/whispers/parser.py +++ b/dojo/tools/whispers/parser.py @@ -40,7 +40,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Whispers report file can be imported in JSON format (option --json)." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = json.load(file) findings = [] for vuln in tree: diff --git a/dojo/tools/whitehat_sentinel/parser.py b/dojo/tools/whitehat_sentinel/parser.py index 82596b33b8f..eeaaa52f49e 100644 --- a/dojo/tools/whitehat_sentinel/parser.py +++ b/dojo/tools/whitehat_sentinel/parser.py @@ -24,7 +24,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "WhiteHat Sentinel output from api/vuln/query_site can be imported in JSON format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): findings_collection = json.load(file) if not findings_collection.keys(): diff --git a/dojo/tools/whitesource/parser.py b/dojo/tools/whitesource/parser.py index 45d8b6780d8..744eb12b7e2 100644 --- a/dojo/tools/whitesource/parser.py +++ b/dojo/tools/whitesource/parser.py @@ -19,7 +19,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import JSON report" - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): if file is None: return list() diff --git a/dojo/tools/wpscan/parser.py b/dojo/tools/wpscan/parser.py index 1792de7700b..4752666556e 100644 --- a/dojo/tools/wpscan/parser.py +++ b/dojo/tools/wpscan/parser.py @@ -83,7 +83,7 @@ def get_vulnerabilities( else: dupes[dupe_key] = finding - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = json.load(file) report_date = None diff --git a/dojo/tools/xanitizer/parser.py b/dojo/tools/xanitizer/parser.py index 791aec06efc..e52408f484f 100644 --- a/dojo/tools/xanitizer/parser.py +++ b/dojo/tools/xanitizer/parser.py @@ -17,7 +17,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Import XML findings list report, preferably with parameter 'generateDetailsInFindingsListReport=true'." - def get_findings(self, filename, test): + def get_findings(self, filename, test, parser_custom_setting=None): if filename is None: return list() diff --git a/dojo/tools/yarn_audit/parser.py b/dojo/tools/yarn_audit/parser.py index 325049dd514..8f667af50fe 100644 --- a/dojo/tools/yarn_audit/parser.py +++ b/dojo/tools/yarn_audit/parser.py @@ -14,7 +14,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "Yarn Audit Scan output file can be imported in JSON format." - def get_findings(self, json_output, test): + def get_findings(self, json_output, test, parser_custom_setting=None): if json_output is None: return list() tree = (json.loads(line) for line in json_output) diff --git a/dojo/tools/zap/parser.py b/dojo/tools/zap/parser.py index f7411daea21..48b1d22bea3 100755 --- a/dojo/tools/zap/parser.py +++ b/dojo/tools/zap/parser.py @@ -25,7 +25,7 @@ def get_label_for_scan_types(self, scan_type): def get_description_for_scan_types(self, scan_type): return "ZAP XML report format." - def get_findings(self, file, test): + def get_findings(self, file, test, parser_custom_setting=None): tree = ET.parse(file) items = list() for node in tree.findall("site"):