🐛 fix RHS deduplication

[manuel-sommer]

No description provided.

[dryrunsecurity]

DryRun Security Summary

The pull request adds support for the "Red Hat Satellite" parser to DefectDojo by updating the SAML2 attribute mapping and deduplication algorithm configurations in the settings file.

Expand for full summary

Summary:

The code change in this pull request adds support for a new parser called "Red Hat Satellite" to the DefectDojo application. The key changes include:

1. Adding the "Red Hat Satellite" parser to the saml2_attrib_map_format dictionary, which maps SAML2 attributes to DefectDojo user profile attributes.
2. Adding the "Red Hat Satellite" parser to the DEDUPLICATION_ALGORITHM_PER_PARSER dictionary, which specifies the deduplication algorithm to use for each parser. In this case, the "Red Hat Satellite" parser is set to use the DEDUPE_ALGO_HASH_CODE algorithm.

From an application security perspective, the addition of new parsers is generally a positive change, as it allows the DefectDojo application to ingest and process a wider range of vulnerability data sources. However, it's important to ensure that the parsers are properly tested and validated to avoid introducing any security vulnerabilities or data integrity issues.

Additionally, the use of the DEDUPE_ALGO_HASH_CODE algorithm for the "Red Hat Satellite" parser indicates that the deduplication process for this parser is based on a hash of certain fields in the vulnerability data, rather than a unique identifier from the tool itself. This approach can be effective, but it's important to carefully select the fields used in the hash calculation to ensure that it accurately identifies unique vulnerabilities.

Files Changed:

• dojo/settings/settings.dist.py: This file has been updated to add support for the "Red Hat Satellite" parser. The changes include adding the parser to the saml2_attrib_map_format dictionary and the DEDUPLICATION_ALGORITHM_PER_PARSER dictionary.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved