New HCL AppScan on Cloud SAST parser #11375

xpert98 · 2024-12-04T17:08:19Z

⚠️ Note on feature completeness ⚠️

We are narrowing the scope of acceptable enhancements to DefectDojo in preparation for v3. Learn more here:
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md

Description

This is a new parser for HCL AppScan on Cloud SAST results.

Test results

Tests are included and pass.

Documentation

Documentation included.

Checklist

This checklist is for your information.

Extra information

dryrunsecurity · 2024-12-04T17:08:49Z

DryRun Security Summary

DefectDojo has added a new parser for HCL AppScan on Cloud SAST, updated application settings, and created a comprehensive test suite to enhance its security assessment capabilities.

Expand for full summary

Summary:

The provided code changes cover a range of updates to the DefectDojo application, including the addition of a new parser for the HCL AppScan on Cloud SAST (Static Application Security Testing) tool, updates to the application settings, and the introduction of a comprehensive test suite for the new parser.

From an application security perspective, the changes are generally positive and demonstrate a thoughtful approach to integrating new security tooling and ensuring the reliability of the security assessment process. Key highlights include:

The addition of the HCL AppScan on Cloud SAST parser, which allows DefectDojo to ingest and process findings from this popular SAST tool. The parser's handling of XML parsing, security finding extraction, and populating the Finding object is well-designed and thorough.
The updates to the application settings, which configure the deduplication algorithm for the new parser and ensure that findings are accurately identified and handled.
The comprehensive test suite for the HCL AppScan on Cloud SAST parser, which covers various scenarios and validates the parser's ability to correctly process scan reports with no findings, a single finding, and multiple findings.
The inclusion of sample scan reports, which demonstrate the parser's handling of real-world security issues, such as a privilege escalation vulnerability in a Dockerfile.

Overall, these changes demonstrate a strong focus on security and a commitment to providing a robust and reliable security assessment platform for the DefectDojo application.

Files Changed:

docs/content/en/connecting_your_tools/parsers/file/hcl_asoc_sast.md: This new file provides documentation for the HCL AppScan on Cloud SAST parser, including information about the supported export formats and a link to sample scan data.
dojo/tools/hcl_asoc_sast/__init__.py: This change adds an __author__ attribute to the file, which is a common practice in Python modules.
dojo/tools/hcl_asoc_sast/parser.py: This file contains the implementation of the HCL AppScan on Cloud SAST parser, which includes XML parsing, security finding extraction, and populating the Finding object.
unittests/scans/hcl_asoc_sast/no_issues.xml: This sample scan report indicates that no security issues were found in the "python-sample" application.
dojo/settings/settings.dist.py: This change updates the DefectDojo application settings to add support for the HCL AppScan on Cloud SAST parser and configure the deduplication algorithm.
unittests/tools/test_hcl_asoc_sast_parser.py: This file contains a comprehensive test suite for the HCL AppScan on Cloud SAST parser, covering various scenarios and validating the parser's functionality.
unittests/scans/hcl_asoc_sast/one_issue.xml: This sample scan report includes a single security issue related to a privilege escalation vulnerability in a Dockerfile.

Code Analysis

We ran 9 analyzers against 8 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

mtesauro · 2024-12-04T20:29:13Z

@xpert98 Love the contribution but have to ask: Why are those conditionals so deeply nested?

I was reviewing this PR and wondering how much "fun" it would be to handle a future change with that deep nesting. I'm almost afraid to run a cyclical complexity tool on this parser code TBH.

Can you help me understand your thinking on that?

xpert98 · 2024-12-04T21:12:45Z

@mtesauro I went that route because of the way the data is structured. Specifically for the mitigations and references, those are separate blocks outside of each result and that seemed like a convenient way to include the relevant "why it's a problem" and "how to fix it" into each issue to be rendered along with the typical issue details like file name and line number.

cneill · 2024-12-05T01:03:18Z

dojo/tools/hcl_asoc_sast/parser.py

+            msg = "This doesn't seem to be a valid HCL ASoC SAST xml file."
+            raise NamespaceErr(msg)
+        report = root.find("issue-group")
+        if report is not None:


Instead of putting the whole function after this point inside an if block when report is not None, just bail if report is None.

Suggested change

if report is not None:

if report is None:

return findings

I was keeping the overall style of the parser similar to the existing hcl_appscan (for DAST) parser for consistency. I can refactor if this is a dealbreaker.

dojo/tools/hcl_asoc_sast/parser.py

github-actions · 2024-12-09T19:48:51Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

Co-authored-by: Charles Neill <[email protected]>

mtesauro · 2024-12-10T17:59:51Z

@xpert98 Closing and re-opening to see if I can get ruff-linting unstuck

mtesauro · 2024-12-15T03:07:27Z

@mtesauro I went that route because of the way the data is structured. Specifically for the mitigations and references, those are separate blocks outside of each result and that seemed like a convenient way to include the relevant "why it's a problem" and "how to fix it" into each issue to be rendered along with the typical issue details like file name and line number.

HCL AppScan sure chose a "creative" structure for this output 🤮

mtesauro · 2024-12-15T03:08:54Z

I'm approving assuming the sha256sum gets fixed before it's merged.

@xpert98 You'll be happy to see PR #11299 😉

mtesauro

Approved

github-actions · 2024-12-19T15:38:48Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dojo/tools/hcl_asoc_sast/parser.py

Co-authored-by: Charles Neill <[email protected]>

dojo/tools/hcl_asoc_sast/parser.py

xpert98

Incorporating changes from @cneill

new HCL AppScan on Cloud SAST parser

1a2fa77

github-actions bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR docs unittests parser labels Dec 4, 2024

cneill reviewed Dec 5, 2024

View reviewed changes

github-actions bot added the conflicts-detected label Dec 9, 2024

xpert98 and others added 2 commits December 10, 2024 13:19

Update dojo/tools/hcl_asoc_sast/parser.py

164964c

Co-authored-by: Charles Neill <[email protected]>

Update dojo/tools/hcl_asoc_sast/parser.py

6791149

Co-authored-by: Charles Neill <[email protected]>

xpert98 force-pushed the hcl-asoc-sast-parser branch from 8c9bdf7 to 6791149 Compare December 10, 2024 13:22

refactoring for linter

7f273cd

mtesauro closed this Dec 10, 2024

mtesauro reopened this Dec 10, 2024

Maffooch approved these changes Dec 11, 2024

View reviewed changes

mtesauro approved these changes Dec 15, 2024

View reviewed changes

blakeaowens approved these changes Dec 18, 2024

View reviewed changes

Remove settings sha file

b918484

github-actions bot removed the conflicts-detected label Dec 19, 2024

Maffooch added 2 commits December 19, 2024 09:39

Merge branch 'dev' into pr/xpert98/11375

e831fb2

Fix indentions

a75285c

cneill requested changes Dec 19, 2024

View reviewed changes

dojo/tools/hcl_asoc_sast/parser.py Outdated Show resolved Hide resolved

dojo/tools/hcl_asoc_sast/parser.py Outdated Show resolved Hide resolved

dojo/tools/hcl_asoc_sast/parser.py Outdated Show resolved Hide resolved

Update dojo/tools/hcl_asoc_sast/parser.py

d678f47

Co-authored-by: Charles Neill <[email protected]>

xpert98 and others added 2 commits December 19, 2024 15:54

Update dojo/tools/hcl_asoc_sast/parser.py

ac0c66c

Co-authored-by: Charles Neill <[email protected]>

Update dojo/tools/hcl_asoc_sast/parser.py

4a9644d

Co-authored-by: Charles Neill <[email protected]>

cneill requested changes Dec 26, 2024

View reviewed changes

xpert98 commented Dec 27, 2024

View reviewed changes

cneill added 9 commits January 23, 2025 14:19

Update dojo/tools/hcl_asoc_sast/parser.py

40eed42

Update dojo/tools/hcl_asoc_sast/parser.py

74e7b41

Update dojo/tools/hcl_asoc_sast/parser.py

bb9fdde

Update dojo/tools/hcl_asoc_sast/parser.py

f47ea31

Update dojo/tools/hcl_asoc_sast/parser.py

663af20

Update dojo/tools/hcl_asoc_sast/parser.py

2e1ed11

Update dojo/tools/hcl_asoc_sast/parser.py

c88ea52

Update dojo/tools/hcl_asoc_sast/parser.py

05df245

Update dojo/tools/hcl_asoc_sast/parser.py

c769234

cneill approved these changes Jan 23, 2025

View reviewed changes

mtesauro merged commit feabd7b into DefectDojo:dev Jan 23, 2025
73 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New HCL AppScan on Cloud SAST parser #11375

New HCL AppScan on Cloud SAST parser #11375

xpert98 commented Dec 4, 2024

dryrunsecurity bot commented Dec 4, 2024 •

edited

Loading

mtesauro commented Dec 4, 2024

xpert98 commented Dec 4, 2024

cneill Dec 5, 2024

xpert98 Dec 5, 2024

github-actions bot commented Dec 9, 2024

mtesauro commented Dec 10, 2024

mtesauro commented Dec 15, 2024

mtesauro commented Dec 15, 2024

mtesauro left a comment

github-actions bot commented Dec 19, 2024

xpert98 left a comment

New HCL AppScan on Cloud SAST parser #11375

New HCL AppScan on Cloud SAST parser #11375

Conversation

xpert98 commented Dec 4, 2024

⚠️ Note on feature completeness ⚠️

dryrunsecurity bot commented Dec 4, 2024 • edited Loading

DryRun Security Summary

Code Analysis

mtesauro commented Dec 4, 2024

xpert98 commented Dec 4, 2024

cneill Dec 5, 2024

Choose a reason for hiding this comment

xpert98 Dec 5, 2024

Choose a reason for hiding this comment

github-actions bot commented Dec 9, 2024

mtesauro commented Dec 10, 2024

mtesauro commented Dec 15, 2024

mtesauro commented Dec 15, 2024

mtesauro left a comment

Choose a reason for hiding this comment

github-actions bot commented Dec 19, 2024

xpert98 left a comment

Choose a reason for hiding this comment

dryrunsecurity bot commented Dec 4, 2024 •

edited

Loading