From e365c49c949f846fb0116d0973fe54b07cb91bd7 Mon Sep 17 00:00:00 2001
From: manuelsommer <47991713+manuel-sommer@users.noreply.github.com>
Date: Mon, 11 Nov 2024 19:19:55 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fix=20Defender=20broken=20Endpoi?=
 =?UTF-8?q?nt=20#11217=20(#11212)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* :bug: fix MSDefender computerDNSName to match modelregex

* :bug: fix DefendercomputerDNSName is mostly a userinfo

* ruff

* fix according to review

* add unittest
---
 dojo/tools/ms_defender/parser.py            |   2 +-
 unittests/scans/ms_defender/issue_11217.zip | Bin 0 -> 1563 bytes
 unittests/tools/test_ms_defender_parser.py  |  12 ++++++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 unittests/scans/ms_defender/issue_11217.zip

diff --git a/dojo/tools/ms_defender/parser.py b/dojo/tools/ms_defender/parser.py
index ad909168c26..cfa9db5c0cf 100644
--- a/dojo/tools/ms_defender/parser.py
+++ b/dojo/tools/ms_defender/parser.py
@@ -131,7 +131,7 @@ def process_zip(self, vulnerability, machine):
         self.findings.append(finding)
         finding.unsaved_endpoints = []
         if machine["computerDnsName"] is not None:
-            finding.unsaved_endpoints.append(Endpoint(host=str(machine["computerDnsName"])))
+            finding.unsaved_endpoints.append(Endpoint(host=str(machine["computerDnsName"]).replace(" ", "").replace("(", "_").replace(")", "_")))
         if machine["lastIpAddress"] is not None:
             finding.unsaved_endpoints.append(Endpoint(host=str(machine["lastIpAddress"])))
         if machine["lastExternalIpAddress"] is not None:
diff --git a/unittests/scans/ms_defender/issue_11217.zip b/unittests/scans/ms_defender/issue_11217.zip
new file mode 100644
index 0000000000000000000000000000000000000000..862542647b1e85cb63f03244b8a683424e187ae0
GIT binary patch
literal 1563
zcmWIWW@h1H0D)60XNQ9sP=b>|h9NgGIU_SKwOBtigp+}Jc56@S93U>O;AUWCxu}1n
zfTg1C5KjQm2oazr4u;Y>>5=c$r~0}uF)*~TGBAiC8v!#*FRM5|4{Tl?hi*CuqnTGb
z<$nGx1A*iBe`+tv;a_`YibJ^7uPp|vIx|Z$*3?FXhF<@{w5(6|r@K@8xBcfi8?7ej
zE=VYvzx(&SpL2YVZ=U|&Q{X~@9QV4ywSTkE$7ju5`8v;B)4(&N>Dsh1#l?5OYi4P@
zED!FOK4tNz^V=MY64=(hcm8_)v)R}6rh!4nbiy=NY6PrfIeO?G_mZO4MGID2xv?(S
z5cg1v>9#t&<jb=*L-s{kY9>X#jlI6dGI(Zj<?Updafq#AbKguwkEouASyM{?G%nEk
z-fXh%)tQVb$?NhIbyt60zM*cGRI2>413!i5GJaIj+B^B))%=4uR+e9Sek5AKJu=g(
zG~0VcNL63NvQO2A6D7Wgcy7BNuXkd>LEh##i3qiWhnBX?GQ7|^A@gMIb?+&@pKZNd
zZ*y&)7j$IBlnKX=)x0m2*(_pqQpssa>AEX(!{<9cOUt!B(zx@Dqtpi9OZi-X<NiN#
z4*qu{;M%62-Ym<e7xUf<5n2>+Std5T$+Gw3zIh)1ua$Ak;69PwvEL(cQ`QbW_Hg;z
zJ-co9KVBdbTcC3Fv75rGxMv$Dl*-+k(D>R%L;0ihvlF)%Rw*gOx5|Fn_K`*5@u~^i
zgeT<jANP-#Vp~y>6Ea^xU1RZ|weIDATDzOff1RGs>f!YB(9tO;jTE<vUb)fbajQfs
zId@f1|B-^-vs1qO>JO>@UC(;)?wSQf_mrP*Exe|8!>(cXKZ^hfw#5b#?FSzy{kX&b
ztJyhbf7<cV-0btOCiA?B*xUT?=K8yPPh8IYduYw#@|a&6gV+6I0;Nevvc86vtObB+
zvaB>GFSRH!DKjUtBomgpHv?1lWqhf-0GPTNS4_?oXJlXy0H$y?EG8AD7UUO|#OEgF
zRmOvCDMqCB5@1RPVf54<c+&5%fxzC+q7#p@uJqK%4&`iQkr6n(aXOdcW1m|mlicGT
zIbE$!&nfa?G-U60e}A^xc-C7-r-OMR2X)W4OcFDjc2;=Xwr$3rZJx_6dtk(TD07QE
zQ^!K%{!Ib*0-U8KEX|+J4Rz1?q<j7IF~*fT$um`MD+;%`27DLI2$3sUDqyo$E+Bk?
zP1wums@*&M&+F@@zwBvx)z>|1eU*a0@6ym!hEtZ`^eme-_hSBsUbaQ;?JqViH%i+Q
zvnG&lO}(1r_bEFZcUIN(`(83V%kg@P)|?Icdw8ukTgd(H)qnJ-(eU1L|3zjiQWE&I
z`#jmIIHq%aFcx_cW!A8JM!b5p`qYy1>Qlb<&t5gD-ir5n`?6#2vZ{OpQ_A84ycwC~
zm~oX%63{YAfZ?qphzToOfaMe`q?|$vWr%UON-2nOz-VPy(&&tA9L!v3ECS8OQeGiD
z6*ILVJM}s+)nKMQpsAp=hsVX3DG%Ajip-d%;!1}=yRf9e0B=?{P%yFpVJ<KjX0U*G
E05URMJOBUy

literal 0
HcmV?d00001

diff --git a/unittests/tools/test_ms_defender_parser.py b/unittests/tools/test_ms_defender_parser.py
index a83049bf2e6..586bc401c58 100644
--- a/unittests/tools/test_ms_defender_parser.py
+++ b/unittests/tools/test_ms_defender_parser.py
@@ -68,3 +68,15 @@ def test_parser_defender_multiple_files_zip(self):
         for endpoint in finding.unsaved_endpoints:
             endpoint.clean()
         self.assertEqual("1.1.1.1", finding.unsaved_endpoints[0].host)
+
+    def test_parser_defender_issue_11217(self):
+        testfile = open("unittests/scans/ms_defender/issue_11217.zip", encoding="utf-8")
+        parser = MSDefenderParser()
+        findings = parser.get_findings(testfile, Test())
+        testfile.close()
+        self.assertEqual(1, len(findings))
+        finding = findings[0]
+        self.assertEqual("Medium", finding.severity)
+        for endpoint in finding.unsaved_endpoints:
+            endpoint.clean()
+        self.assertEqual("Max_Mustermann_iPadAir_17zoll__2ndgeneration_", finding.unsaved_endpoints[0].host)