Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ implement progpilot SAST parser #10044 #10052

Merged
merged 13 commits into from
May 3, 2024

Conversation

manuel-sommer
Copy link
Contributor

see issue #10044

Copy link

dryrunsecurity bot commented Apr 29, 2024

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Configured Codepaths Analyzer 0 findings
Sensitive Files Analyzer 0 findings
AppSec Analyzer 0 findings
Authn/Authz Analyzer 0 findings
Secrets Analyzer 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

This pull request includes changes related to the integration of the Progpilot Static Application Security Testing (SAST) tool into the DefectDojo application. The changes involve adding documentation for the Progpilot parser, making a minor change to the __init__.py file, and modifying several test files to handle the parsing of Progpilot security scan results.

From an application security perspective, the key points to highlight are:

  1. Progpilot Integration: The addition of the Progpilot parser allows DefectDojo to import and process the output of the Progpilot SAST tool. This integration is a positive step towards improving the application's security testing capabilities.

  2. Vulnerability Identification: The test files contain sample Progpilot scan results that identify potential security vulnerabilities, such as SQL injection and cross-site scripting (XSS) issues. These findings should be reviewed and addressed to improve the overall security of the application.

  3. Parsing Robustness: The unit tests for the ProgpilotParser class demonstrate the ability to handle various input formats, ensuring the parser can reliably process the output of the Progpilot tool. This is an important aspect of maintaining the security testing infrastructure.

  4. Dependency on External Tools: While the integration with Progpilot is a valuable addition, it's crucial to ensure that the Progpilot tool itself is maintained and secure, as any vulnerabilities in the tool could potentially impact the security of the DefectDojo application.

Files Changed:

  • docs/content/en/integrations/parsers/file/progpilot.md: This file adds documentation for the new Progpilot parser, providing information about the parser's functionality and the sample scan data.
  • dojo/tools/progpilot/__init__.py: The changes in this file simply add an __author__ attribute, which is a common practice to indicate the author of a Python module.
  • unittests/scans/progpilot/progpilot.json: This file contains sample Progpilot scan results that identify a SQL injection vulnerability and a security misconfiguration issue in the Order.php file.
  • dojo/tools/progpilot/parser.py: The changes in this file are related to the implementation of the ProgpilotParser class, which is responsible for parsing the Progpilot security scan results and generating Finding objects.
  • unittests/scans/progpilot/progpilot[2-4].json: These files contain additional sample Progpilot scan results, including findings related to SQL injection and cross-site scripting (XSS) vulnerabilities.
  • unittests/tools/test_progpilot_parser.py: This file includes unit tests for the ProgpilotParser class, ensuring the parser can correctly handle various input formats and extract the relevant security findings.

Powered by DryRun Security

@github-actions github-actions bot added the docs label Apr 29, 2024
@manuel-sommer manuel-sommer marked this pull request as ready for review April 29, 2024 06:31
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

Copy link
Contributor

@cneill cneill left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a small typo, otherwise looks good

unittests/tools/test_progpilot_parser.py Outdated Show resolved Hide resolved
unittests/tools/test_progpilot_parser.py Outdated Show resolved Hide resolved
unittests/tools/test_progpilot_parser.py Outdated Show resolved Hide resolved
unittests/tools/test_progpilot_parser.py Outdated Show resolved Hide resolved
@manuel-sommer
Copy link
Contributor Author

Done @cneill. You can merge.

Copy link
Contributor

github-actions bot commented May 3, 2024

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@manuel-sommer manuel-sommer force-pushed the implement_progpilot branch from fdf2d37 to c6c8b5b Compare May 3, 2024 22:25
Copy link
Contributor

github-actions bot commented May 3, 2024

Conflicts have been resolved. A maintainer will review the pull request shortly.

manuel-sommer and others added 12 commits May 4, 2024 00:25
Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
@manuel-sommer manuel-sommer force-pushed the implement_progpilot branch from c6c8b5b to 0016801 Compare May 3, 2024 22:25
@mtesauro mtesauro merged commit 6fd7eda into DefectDojo:dev May 3, 2024
123 checks passed
@manuel-sommer manuel-sommer deleted the implement_progpilot branch May 3, 2024 23:11
dogboat pushed a commit to dogboat/django-DefectDojo that referenced this pull request May 6, 2024
* ✨ implement progpilot SAST parser DefectDojo#10044

* add docs

* finish progpilot

* use more available Finding fields

* ruff linter

* advance unittests

* fix ruff

* Update unittests/tools/test_progpilot_parser.py

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

* Update unittests/tools/test_progpilot_parser.py

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

* Update unittests/tools/test_progpilot_parser.py

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

* Update unittests/tools/test_progpilot_parser.py

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>

* ruff

* ruff

---------

Co-authored-by: Charles Neill <1749665+cneill@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants