Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

💄 remove unnecessary content from sonarqube findings #10133

Merged
merged 2 commits into from
May 8, 2024

Conversation

manuel-sommer
Copy link
Contributor

self descriptive

@github-actions github-actions bot added the parser label May 7, 2024
Copy link

dryrunsecurity bot commented May 7, 2024

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Configured Codepaths Analyzer 0 findings
Sensitive Files Analyzer 0 findings
AppSec Analyzer 0 findings
Authn/Authz Analyzer 0 findings
Secrets Analyzer 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request focus on the integration between the SonarQube static code analysis tool and the Dojo application security platform. The sonarqube_restapi_json.py file is responsible for parsing the JSON response from the SonarQube API and creating Finding objects that represent various types of issues, including bugs, vulnerabilities, and code smells.

From a security perspective, the key aspects of this code change are:

  1. Vulnerability Parsing: The code extracts important information about vulnerabilities, such as the CWE ID, CVSS score, and associated CVE/GHSA identifiers, and populates the corresponding fields in the Finding object. This is crucial for understanding and tracking security vulnerabilities.

  2. Vulnerability IDs: The code parses the SonarQube response for any references to CVE or GHSA identifiers and adds them to the unsaved_vulnerability_ids field of the Finding object. This ensures that the identified vulnerabilities can be easily mapped to external vulnerability databases.

  3. Code Smell Tracking: The code also handles the parsing of "code smell" issues, which can indicate potential quality or maintainability issues in the codebase. Tracking these code smells can help identify areas of the application that may be more prone to security issues in the future.

  4. Hotspot Tracking: The code processes "hotspot" issues, which are potential security vulnerabilities that require manual review by a security expert. Tracking these hotspots is important for ensuring that all potential security issues are identified and addressed.

  5. Severity Translation: The code includes a severitytranslator function that maps the SonarQube severity levels to the Dojo severity levels, ensuring that the severity of the identified issues is properly reflected in the Dojo platform.

  6. Component Information: The returncomponent function retrieves additional information about the affected components from the SonarQube response and includes it in the Finding object's description, providing valuable context for understanding the impact of the identified issues.

Files Changed:

  • dojo/tools/sonarqube/sonarqube_restapi_json.py: This file is responsible for the integration between the SonarQube static code analysis tool and the Dojo application security platform. The changes in this file focus on improving the parsing and handling of various types of issues, including vulnerabilities, code smells, and hotspots, to enhance the security and maintainability of the Dojo platform.

Powered by DryRun Security

@Maffooch Maffooch merged commit 36b6d23 into DefectDojo:bugfix May 8, 2024
123 checks passed
@manuel-sommer manuel-sommer deleted the lipstick_sonarqube branch May 8, 2024 23:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants