Bug Fix: improve Kiuwan SCA parser to support multi component findings #12753
Conversation
|
No security concerns detected in this pull request. All finding details can be found in the DryRun Security Dashboard. |
|
TODO: Ideally you extend the test suite in I will soon check how to update & run unit tests, any info/docs on it appreciated :) |
|
Thanks for looking into this, information on running unit tests: https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/DOCKER.md#run-the-tests-with-docker-compose |
dojo/tools/kiuwan_sca/parser.py
Outdated
| # We want one unique finding in DD for each component affected: | ||
| for component in components: | ||
| finding = Finding(test=test) | ||
| finding.unique_id_from_tool = f"{row['cve']}|{component.get('artifact')}|{component.get('version')}" |
There was a problem hiding this comment.
Constructing the unique_id_from_tool is not something that is generally done. The intention is that the field is created from the tool.
This parser in particular uses the DEDUPE_ALGO_HASH_CODE, so I think the unique_id_from_tool should be omitted. This could be an issue for folks that updated the default hash code fields to use unique_id_from_tool, so we should also include something in the release notes to indicate the change
Here is the current dedupe settings:
django-DefectDojo/dojo/settings/settings.dist.py
Line 1336 in d17c6db
There was a problem hiding this comment.
Actually Kiuwan provides a unique id, this was just a test on our side. I will run one more test later this week and maybe change this back. This PR should be about the components issue only.
There was a problem hiding this comment.
Pushed changes back to old logic
This PR enhances the Kiuwan SCA Parser by modifying the logic to create one finding per component, instead of taking only the first component from the components array.
The buggy code:
Motivation
In the current implementation, for a given CVE from a Kiuwan SCA scan, only the first component listed is used to create a finding. However, many CVEs in Kiuwan are related to multiple components. This leads to loss of detail and incomplete representation of risks in DefectDojo.
Test results
This checklist is for your information.
bugfixbranch.