Request/Response API CRUD Endpoints

dojo/api_v2/serializers.py

@@ -1,3 +1,4 @@
+import base64
 import collections
 import json
 import logging
@@ -45,6 +46,7 @@
     Answer,
     Answered_Survey,
     App_Analysis,
+    BurpRawRequestResponse,
     Check_List,
     ChoiceAnswer,
     ChoiceQuestion,
@@ -388,6 +390,46 @@ class BurpRawRequestResponseSerializer(serializers.Serializer):
     req_resp = RequestResponseSerializerField(required=True)
 
 
+class BurpRawRequestResponseMultiSerializer(serializers.ModelSerializer):
+    burpRequestBase64 = serializers.CharField()
+    burpResponseBase64 = serializers.CharField()
+
+    def to_representation(self, data):
+        return {
+            "id": data.id,
+            "finding": data.finding.id,
+            "burpRequestBase64": data.burpRequestBase64.decode("utf-8"),
+            "burpResponseBase64": data.burpResponseBase64.decode("utf-8"),
+        }
+
+    def validate(self, data):
+        b64request = data.get("burpRequestBase64", None)
+        b64response = data.get("burpResponseBase64", None)
+        finding = data.get("finding", None)
+        # Make sure all fields are present
+        if not b64request or not b64response or not finding:
+            msg = "burpRequestBase64, burpResponseBase64, and finding are required."
+            raise ValidationError(msg)
+        # Verify we have true base64 decoding
+        try:
+            base64.b64decode(b64request, validate=True)
+            base64.b64decode(b64response, validate=True)
+        except Exception as e:
+            msg = "Inputs need to be valid base64 encodings"
+            raise ValidationError(msg) from e
+        # Encode the data in utf-8 to remove any bad characters
+        data["burpRequestBase64"] = b64request.encode("utf-8")
+        data["burpResponseBase64"] = b64response.encode("utf-8")
+        # Run the model validation - an ValidationError will be raised if there is an issue
+        BurpRawRequestResponse(finding=finding, burpRequestBase64=b64request, burpResponseBase64=b64response).clean()
+
+        return data
+
+    class Meta:
+        model = BurpRawRequestResponse
+        fields = "__all__"
+
+
 class MetaSerializer(serializers.ModelSerializer):
     product = serializers.PrimaryKeyRelatedField(
         queryset=Product.objects.all(),

dojo/api_v2/views.py

@@ -2682,6 +2682,24 @@ def get_queryset(self):
         return Note_Type.objects.all().order_by("id")
 
 
+class BurpRawRequestResponseViewSet(
+    DojoModelViewSet,
+):
+    serializer_class = serializers.BurpRawRequestResponseMultiSerializer
+    queryset = BurpRawRequestResponse.objects.none()
+    filter_backends = (DjangoFilterBackend,)
+    filterset_fields = ["finding"]
+
+    def get_queryset(self):
+        results = BurpRawRequestResponse.objects.all()
+        empty_value = b""
+        results = results.exclude(
+            burpRequestBase64__exact=empty_value,
+            burpResponseBase64__exact=empty_value,
+        )
+        return results.order_by("id")
+
+
 # Authorization: superuser
 class NotesViewSet(
     mixins.UpdateModelMixin,

dojo/urls.py

@@ -14,6 +14,7 @@
 from dojo.api_v2.views import (
     AnnouncementViewSet,
     AppAnalysisViewSet,
+    BurpRawRequestResponseViewSet,
     ConfigurationPermissionViewSet,
     CredentialsMappingViewSet,
     CredentialsViewSet,
@@ -156,6 +157,7 @@
 v2_api.register(r"product_type_groups", ProductTypeGroupViewSet, basename="product_type_group")
 v2_api.register(r"regulations", RegulationsViewSet, basename="regulations")
 v2_api.register(r"reimport-scan", ReImportScanView, basename="reimportscan")
+v2_api.register(r"request_response_pairs", BurpRawRequestResponseViewSet, basename="request_response_pairs")
 v2_api.register(r"risk_acceptance", RiskAcceptanceViewSet, basename="risk_acceptance")
 v2_api.register(r"roles", RoleViewSet, basename="role")
 v2_api.register(r"sla_configurations", SLAConfigurationViewset, basename="sla_configurations")

unittests/test_apiv2_methods_and_endpoints.py

@@ -9,7 +9,6 @@
     Benchmark_Product_Summary,
     Benchmark_Requirement,
     Benchmark_Type,
-    BurpRawRequestResponse,
     Choice,
     Contact,
     FileAccessToken,
@@ -92,7 +91,6 @@ def setUp(self):
             Product_Line,
             Report_Type,
             CWE,
-            BurpRawRequestResponse,
             FileAccessToken,
             UserAnnouncement,
             BannerConf,

unittests/test_rest_framework.py

@@ -31,6 +31,7 @@
 from dojo.api_v2.views import (
     AnnouncementViewSet,
     AppAnalysisViewSet,
+    BurpRawRequestResponseViewSet,
     ConfigurationPermissionViewSet,
     CredentialsMappingViewSet,
     CredentialsViewSet,
@@ -3049,3 +3050,27 @@ def __init__(self, *args, **kwargs):
         self.test_type = TestType.STANDARD
         self.deleted_objects = 1
         BaseClass.RESTEndpointTest.__init__(self, *args, **kwargs)
+
+
+class BurpRawRequestResponseTest(BaseClass.BaseClassTest):
+    fixtures = ["dojo_testdata.json"]
+
+    def __init__(self, *args, **kwargs):
+        self.endpoint_model = BurpRawRequestResponse
+        self.endpoint_path = "request_response_pairs"
+        self.viewname = "request_response_pairs"
+        self.viewset = BurpRawRequestResponseViewSet
+        self.payload = {
+            "finding": 2,
+            "burpRequestBase64": "cmVxdWVzdAo=",
+            "burpResponseBase64": "cmVzcG9uc2UK",
+        }
+
+        self.update_fields = {
+            "finding": 2,
+            "burpRequestBase64": "cmVxdWVzdCAtIGVkaXRlZAo=",
+            "burpResponseBase64": "cmVzcG9uc2UgLSBlZGl0ZWQK",
+        }
+        self.test_type = TestType.STANDARD
+        self.deleted_objects = 1
+        BaseClass.RESTEndpointTest.__init__(self, *args, **kwargs)