FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Added references attribute to findings by Ilyesbdlala · Pull Request #1676 · secureCodeBox/secureCodeBox · GitHub

/ secureCodeBox Public

Added references attribute to findings - #1676

Merged
J12934 merged 15 commits into
mainfrom
feature/references-attribute
Apr 18, 2023
ConversationCommits (15)ChecksFiles changed
Merged

Added references attribute to findings#1676
J12934 merged 15 commits into
mainfrom
feature/references-attribute

Conversation

Ilyesbdlala commented Apr 5, 2023 •
edited
Loading

Copy link
Copy Markdown
Member

Description

closes #519
Adds references attribute to finding schema that follows the following format:

"references": [
      {
        "type": "URL",
        "value": "https://www.netspi.com/blog/technical/network-penetration-testing/analyzing-dns-txt-records-to-fingerprint-service-providers/",
      },
      {
        "type": "CWE",
        "value": "CWE-200",
      },
      {
        "type": "URL",
        "value": "https://cwe.mitre.org/data/definitions/cwe-200.html",
      },
    ],

This was done to the following scanners:

  • cmseek
  • trivy
  • wpscan
  • semgrep
  • zap
  • Nikto
  • Nuclei

These were chosen because they mention their CVE/CWE in their findings

Checklist

  • Test your changes as thoroughly as possible before you commit them. Preferably, automate your test by unit/integration tests.
  • Make sure that all your commits are signed-off and that you are added to the Contributors file.
  • Make sure that all CI finish successfully.
  • Optional (but appreciated): Make sure that all commits are Verified.

Ilyesbdlala added this to the v4.0.0 milestone Apr 5, 2023
Ilyesbdlala mentioned this pull request Apr 5, 2023
Closed
9 tasks
Ilyesbdlala force-pushed the feature/references-attribute branch from be313c7 to e746c7f Compare April 5, 2023 14:26

github-actions Bot commented Apr 5, 2023 •
edited
Loading

Copy link
Copy Markdown

MegaLinter status: ⚠️ WARNING

Descriptor Linter Files Fixed Errors Elapsed time
⚠️ JAVASCRIPT eslint 9 1 0.64s
✅ JSON eslint-plugin-jsonc 2 0 1.17s
⚠️ SPELL misspell 11 1 0.04s

See errors details in artifact MegaLinter reports on CI Job page
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Ilyesbdlala and others added 14 commits April 18, 2023 13:57
Added references as an attribute to finding-schema.json
d62b688 
This is an optional attriubte that would include CVE/CWE etc.. and their urls

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519 Added references attribute to cmseek findings
8cbec6b 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#581 Fixed cmseek references attribute to include all urls in findings
9dca289 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519 Added references attribute to trivy findings
5a52065 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519 Made CVE value attribute uppercase in cmseek for consistency
ed81ee6 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519: Added references attribute to semgrep findings
82c202e 
Signed-off-by: Rami Souai <rami.souai@iteratec.com>
#519 Added references attribute to wpscan findings
83e4584 
also added finding parsing for vulnerablites in plugins

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519 type in references is always uppercase
5ee786b 
Updated corresponding snapshots

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519 Added references attribute to zap findings
7d65ad9 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519: Added reference attribute in nikto findings
7c9510e 
Signed-off-by: Rami Souai <rami.souai@iteratec.com>
#519: Added reference attribute in nuclei findings
006fe5e 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
Fixes semgrep parsing: convert to String before substring()
7acba22 
Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
#519 Refactored parsing to improve perforamance and use of immutable…
60ed9ee 
… data structures

-   Replaced the for...of loop with Array.prototype.map().
-   Replaced the nested loops with Array.prototype.flatMap().
-   Replaced the forEach() loop with Array.prototype.flatMap().
-   Combined all findings into a single array using the spread syntax (...).

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
Refactored parsing for nuclei to allow for multiple cwe/cve ids
f89446b 
also made timestamp and references immutable

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
Ilyesbdlala force-pushed the feature/references-attribute branch from 5e8d3c3 to f89446b Compare April 18, 2023 11:57
fixed issue with nikto parser
156967a 
Removed the step to make refs null if empty, since it's already done ternary operator earlier

Signed-off-by: Ilyes Ben Dlala <ilyes.bendlala@iteratec.com>
J12934 merged commit a113f71 into main Apr 18, 2023
J12934 deleted the feature/references-attribute branch April 18, 2023 14:03
Ilyesbdlala mentioned this pull request Jun 3, 2023
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

J12934 J12934 approved these changes

Assignees

Ilyesbdlala

RamiSouai

Labels

findings

Projects

secureCodeBox
Archived in project

Milestone

v4.0.0

Development

Successfully merging this pull request may close these issues.

Improve Findings Format

3 participants

Back | FazBrowse Home | New Git URL