Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛 fix hcl_appscan, handle severity is None #10074 #10101

Merged
merged 2 commits into from
May 3, 2024

Conversation

manuel-sommer
Copy link
Contributor

see #10074

However, the scanfile was not very helpful as a lot of values were rotated (e.g. also severity and cwe) and I had to rotate those back to get something useful.
I figured out that some severity values were None and fixed it with the scan file.

Copy link

dryrunsecurity bot commented May 2, 2024

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Configured Codepaths Analyzer 0 findings
Sensitive Files Analyzer 0 findings
AppSec Analyzer 0 findings
Authn/Authz Analyzer 0 findings
Secrets Analyzer 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request focus on improving the quality and reliability of the HCL AppScan parser, which is an essential component for effectively integrating application security scanning into the development process. The key changes include:

  1. Addition of a new test case (test_issue_10074) to the TestHCLAppScanParser class, which verifies the parser's ability to handle scan results with a lower severity level (i.e., "Info"). This demonstrates the development team's commitment to expanding the test coverage and ensuring the parser's robustness.

  2. Updates to the dojo/tools/hcl_appscan/parser.py file to handle cases where the input.text is None and where the severity element in the XML is empty or missing. These changes aim to improve the parser's ability to handle edge cases and potential errors in the input data.

  3. Extraction of additional information from the XML, such as CWE, remediation, advisory, and various location-related details. This additional data can provide more context and details about the identified findings, which is crucial for effective security analysis and prioritization.

While the changes appear to be focused on improving the parser's functionality, it's important to ensure that the parsing process is robust and secure, as vulnerabilities in the parser could potentially lead to security issues in the overall application security monitoring and reporting process.

Files Changed:

  1. unittests/tools/test_hcl_appscan_parser.py: This file has been updated with a new test case (test_issue_10074) that verifies the parser's ability to handle scan results with a lower severity level.

  2. unittests/scans/hcl_appscan/issue_10074.xml: This file is a sample AppScan report that identifies various security issues, including SQL Injection, Integer Overflow, and Improper Assets Management. The report provides detailed information on each issue, including the severity, CVSS score, CWE, and the specific locations where the issues were found.

  3. dojo/tools/hcl_appscan/parser.py: The changes in this file focus on improving the handling of null text and null severity in the XML parsing process. Additionally, the code has been updated to extract more detailed information from the XML, such as CWE, remediation, advisory, and various location-related details.

Powered by DryRun Security

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

cneill
cneill previously approved these changes May 3, 2024
@cneill cneill dismissed their stale review May 3, 2024 21:40

Approved before tests finished running... will give it a moment to complete

@cneill cneill merged commit afc2a08 into DefectDojo:bugfix May 3, 2024
123 checks passed
@manuel-sommer manuel-sommer deleted the fix_hcl_appscan branch May 3, 2024 22:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants