FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Fix Crash in DefectDojo Hook for Scans without Parameters by Weltraumschaf · Pull Request #2275 · secureCodeBox/secureCodeBox · GitHub

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension .java  (6) All 1 file type selected
Deleted files Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -5,35 +5,42 @@

import io.securecodebox.persistence.config.PersistenceProviderConfig;
import io.securecodebox.persistence.defectdojo.config.Config;
import io.securecodebox.persistence.defectdojo.model.Finding;
import io.securecodebox.persistence.defectdojo.service.EndpointService;
import io.securecodebox.persistence.defectdojo.service.FindingService;
import io.securecodebox.persistence.mapping.DefectDojoFindingToSecureCodeBoxMapper;
import io.securecodebox.persistence.models.Scan;
import io.securecodebox.persistence.service.scanresult.ScanResultService;
import io.securecodebox.persistence.service.KubernetesService;
import io.securecodebox.persistence.service.S3Service;
import io.securecodebox.persistence.service.scanresult.ScanResultService;
import io.securecodebox.persistence.strategies.VersionedEngagementsStrategy;
import lombok.extern.slf4j.Slf4j;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.util.stream.Collectors;
import java.util.List;

@Slf4j
public class DefectDojoPersistenceProvider {
public static void main(String[] args) throws Exception {
log.info("Starting DefectDojo persistence provider");
private final S3Service s3Service = new S3Service();
private final KubernetesService kubernetesService = new KubernetesService();

var persistenceProviderConfig = new PersistenceProviderConfig(args);
public static void main(String[] args) {
try {
new DefectDojoPersistenceProvider().execute(args);
} catch (Exception e) {
log.error(e.getMessage(), e);
System.exit(1);
}
}

var s3Service = new S3Service();
var kubernetesService = new KubernetesService();
private void execute(String[] args) throws Exception {
log.info("Starting DefectDojo persistence provider");
kubernetesService.init();

var scan = new Scan(kubernetesService.getScanFromKubernetes());
scan.validate();

log.info("Downloading Scan Result");
var persistenceProviderConfig = new PersistenceProviderConfig(args);
var scanResultFile = ScanResultService.build(scan, s3Service).getScanResult(persistenceProviderConfig);

var config = Config.fromEnv();
Expand All @@ -44,22 +51,27 @@ public static void main(String[] args) throws Exception {
log.info("Identified total Number of findings in DefectDojo: {}", defectDojoFindings.size());

if (persistenceProviderConfig.isReadAndWrite()) {
var endpointService = new EndpointService(config);
var findingService = new FindingService(config);
var mapper = new DefectDojoFindingToSecureCodeBoxMapper(config, endpointService, findingService);
overwriteFindingWithDefectDojoFinding(config, defectDojoFindings, persistenceProviderConfig);
}

log.info("Overwriting secureCodeBox findings with the findings from DefectDojo.");
log.info("DefectDojo Persistence Completed");
}

var findings = defectDojoFindings.stream()
.map(mapper::fromDefectDojoFinding)
.toList();
private void overwriteFindingWithDefectDojoFinding(Config config, List<Finding> defectDojoFindings, PersistenceProviderConfig persistenceProviderConfig) throws Exception {
var endpointService = new EndpointService(config);
var findingService = new FindingService(config);
var mapper = new DefectDojoFindingToSecureCodeBoxMapper(config, endpointService, findingService);

log.debug("Mapped Findings: {}", findings);
log.info("Overwriting secureCodeBox findings with the findings from DefectDojo.");

s3Service.overwriteFindings(persistenceProviderConfig.getFindingUploadUrl(), findings);
kubernetesService.updateScanInKubernetes(findings);
}
var findings = defectDojoFindings.stream()
.map(mapper::fromDefectDojoFinding)
.toList();

log.info("DefectDojo Persistence Completed");
log.debug("Mapped Findings: {}", findings);

s3Service.overwriteFindings(persistenceProviderConfig.getFindingUploadUrl(), findings);
kubernetesService.updateScanInKubernetes(findings);
}

}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ public List<Finding> run(Scan scan, ScanFile scanResultFile) throws DefectDojoPe

log.debug("Uploading Scan Report to DefectDojo");

final var scanType = ScanNameMapping.bySecureCodeBoxScanType(scan.getSpec().getScanType()).scanType;
final var scanType = ScanNameMapping.bySecureCodeBoxScanType(scan.getSpec().getScanType()).defectDojoScanType;
final var searchObject = TestType.builder().name(scanType.getTestType()).build();
final TestType testType;
try {
Expand Down Expand Up @@ -303,7 +303,7 @@ private long createTest(Scan scan, long engagementId, long userId) throws URISyn

String version = scan.getEngagementVersion().orElse(null);

String scanType = ScanNameMapping.bySecureCodeBoxScanType(scan.getSpec().getScanType()).scanType.getTestType();
String scanType = ScanNameMapping.bySecureCodeBoxScanType(scan.getSpec().getScanType()).defectDojoScanType.getTestType();
TestType testType = testTypeService.searchUnique(TestType.builder().name(scanType).build()).orElseThrow(() -> new DefectDojoPersistenceException("Could not find test type '" + scanType + "' in DefectDojo API. DefectDojo might be running in an unsupported version."));
String testTitle = scan.getTestTitle().orElse(scan.getMetadata().getName());

Expand Down
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -10,52 +10,98 @@
import java.time.LocalDate;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.List;
import java.util.Objects;

public class DescriptionGenerator {
/**
* Helper to format a descriptive text for scans
*/
public final class DescriptionGenerator {

protected static final DateTimeFormatter TIME_FORMAT = DateTimeFormatter.ofPattern("dd.MM.yyyy HH:mm:ss");
private static final DateTimeFormatter TIME_FORMAT = DateTimeFormatter.ofPattern("dd.MM.yyyy HH:mm:ss");
private static final DateTimeFormatter DATE_FORMAT = DateTimeFormatter.ofPattern("yyyy-MM-dd");
Clock clock = Clock.systemDefaultZone();
private static final String DEFAULT_DEFECTDOJO_SCAN_NAME = ScanNameMapping.GENERIC.defectDojoScanType.getTestType();
private static final String LINE_BREAK = "\n";
private Clock clock = Clock.systemDefaultZone();

public String generate(V1Scan scan) {
var spec = Objects.requireNonNull(scan.getSpec());

return String.join(
System.getProperty("line.separator"),
MessageFormat.format("# {0}", getDefectDojoScanName(scan)),
MessageFormat.format("Started: {0}", getStartTime(scan)),
MessageFormat.format("Ended: {0}", currentTime()),
MessageFormat.format("ScanType: {0}", spec.getScanType()),
MessageFormat.format("Parameters: [{0}]", String.join(",", Objects.requireNonNull(spec.getParameters())))
);
}
final var spec = Objects.requireNonNull(scan.getSpec());
final var buffer = new StringBuilder()
.append(MessageFormat.format("# {0}", determineDefectDojoScanName(scan))).append(LINE_BREAK)
.append(MessageFormat.format("Started: {0}", determineStartTime(scan))).append(LINE_BREAK)
.append(MessageFormat.format("Ended: {0}", currentTime())).append(LINE_BREAK)
.append(MessageFormat.format("ScanType: {0}", spec.getScanType())).append(LINE_BREAK);

private String getStartTime(V1Scan scan) {
if (scan.getMetadata() == null || scan.getMetadata().getCreationTimestamp() == null) {
return null;
var parameters = spec.getParameters();

if (parameters == null) {
// Since this value may be null, we default to empty list to prevent NPE on fromatting it.
parameters = List.of();
}
return scan.getMetadata().getCreationTimestamp().format(TIME_FORMAT);

buffer.append(MessageFormat.format("Parameters: [{0}]", String.join(",", parameters)));
return buffer.toString();
}


/**
* Returns the current date as string based on the DATE_FORMAT.
* Returns the current date as string based on the DATE_FORMAT
*
* @return the current date as string based on the DATE_FORMAT.
* @return never {@code null}
*/
public String currentDate() {
return LocalDate.now(clock).format(DATE_FORMAT);
}

public String currentTime() {
private String currentTime() {
return LocalDateTime.now(clock).format(TIME_FORMAT);
}

public void setClock(Clock clock) {
/**
* Injection point for side effects
* <p>
* This is merely for testing purposes.
* </p>
*
* @param clock not {@code null}
*/
void setClock(Clock clock) {
this.clock = clock;
}

public String getDefectDojoScanName(V1Scan scan) {
return ScanNameMapping.bySecureCodeBoxScanType(scan.getSpec().getScanType()).scanType.getTestType();
/**
* Determines the DefectDojo scan name from given scan
*
* <p>If no particular type can't be determined (due to null value or unmapped types)
* {@link ScanNameMapping#GENERIC} will be returned as default</p>
*
* @param scan Must not be {@code null}
* @return never {@code null} nor empty
*/
String determineDefectDojoScanName(V1Scan scan) {
final var spec = Objects.requireNonNull(scan, "Given parameter 'scan; must not be null!")
.getSpec();

if (spec == null) {
return DEFAULT_DEFECTDOJO_SCAN_NAME;
}

if (spec.getScanType() == null) {
return DEFAULT_DEFECTDOJO_SCAN_NAME;
}

return ScanNameMapping.bySecureCodeBoxScanType(spec.getScanType())
.defectDojoScanType
.getTestType();
}

String determineStartTime(V1Scan scan) {
Objects.requireNonNull(scan, "Given parameter 'scan; must not be null!");

if (scan.getMetadata() == null || scan.getMetadata().getCreationTimestamp() == null) {
return "n/a";
}

return scan.getMetadata().getCreationTimestamp().format(TIME_FORMAT);
}
}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Original file line number Diff line number Diff line change
Expand Up @@ -24,24 +24,27 @@ public enum ScanNameMapping {

/**
* DefectDojo Scan Type
* Example: "Nmap Scan"
*
* @see ScanType
*/
public final ScanType scanType;
public final ScanType defectDojoScanType;

/**
* secureCodeBox ScanType
* Examples: "nmap", "zap-api-scan", "zap-baseline-scan"
* <p>
* Examples: {@literal "nmap"}, {@literal }"zap-api-scan"}, {@literal "zap-baseline-scan"}
* </p>
*/
public final String scbScanType;
public final String secureCodeBoxbScanType;

ScanNameMapping(String scbScanType, ScanType scanType) {
this.scbScanType = scbScanType;
this.scanType = scanType;
ScanNameMapping(String secureCodeBoxbScanType, ScanType defectDojoScanType) {
this.secureCodeBoxbScanType = secureCodeBoxbScanType;
this.defectDojoScanType = defectDojoScanType;
}

public static ScanNameMapping bySecureCodeBoxScanType(@NonNull String scanType) {
for (var mapping : ScanNameMapping.values()) {
if (scanType.equals(mapping.scbScanType)) {
if (scanType.equals(mapping.secureCodeBoxbScanType)) {
return mapping;
}
}
Expand Down

This file was deleted.

Loading

Back | FazBrowse Home | New Git URL