Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Veracode parser: remove lxml dependency #3967

Merged
merged 3 commits into from
Mar 27, 2021
Merged

Veracode parser: remove lxml dependency #3967

merged 3 commits into from
Mar 27, 2021

Conversation

damiencarol
Copy link
Contributor

@damiencarol damiencarol commented Mar 2, 2021 •
edited

Work:

  • remove lxml dependency and switch to defusedxml
  • fix wrong values for component_name and component_version
  • fix description of vulnerable components when first_found_date is missing (crash)
  • fix/modify mitigated status
  • implements CVE (both for SCA and flaws)
  • fixes CWE hard-coded values

Also:

@damiencarol damiencarol mentioned this pull request Mar 2, 2021
Closed
@damiencarol damiencarol requested review from a team March 2, 2021 17:47
@damiencarol damiencarol added this to the 1.14.0 milestone Mar 2, 2021
@madchap
Copy link
Collaborator

madchap commented Mar 3, 2021

I see one last checkbox to be ticked. Is it ready for review or you still want to bring some changes here?

@damiencarol
Copy link
Contributor Author

@madchap I waiting for a report with mitigation to fix this part.

@damiencarol
Copy link
Contributor Author

waiting more data to test the mitigated part

@damiencarol damiencarol marked this pull request as draft March 6, 2021 08:41
@damiencarol damiencarol mentioned this pull request Mar 13, 2021
Closed
@damiencarol damiencarol linked an issue Mar 13, 2021 that may be closed by this pull request
Time data parsing in Veracode SAST XML report import fails #4043
Closed
@damiencarol damiencarol marked this pull request as ready for review March 17, 2021 17:47
@damiencarol
Copy link
Contributor Author

@madchap ready to go!

@damiencarol damiencarol self-assigned this Mar 17, 2021
@madchap madchap merged commit 0c52143 into DefectDojo:dev Mar 27, 2021
@damiencarol damiencarol deleted the fix_difusedxml_veracode branch March 27, 2021 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@valentijnscholten valentijnscholten valentijnscholten approved these changes

@madchap madchap madchap approved these changes

Assignees

@damiencarol damiencarol

Labels
maintenance
Projects
None yet
Milestone
1.14.0
Development

Successfully merging this pull request may close these issues.

Time data parsing in Veracode SAST XML report import fails
3 participants
@damiencarol @madchap @valentijnscholten