Skip to content

Commit 8a24ee6

Browse files
Jino-TJino Tesauro
Jino-T
and
Jino Tesauro
authored
Update 12 parsers to have better metadata (#11900)
* Added docstring for the burp parser * Moved docstring to top of file and made changes to pass liner * Fixed format for ruff linter * Final changes for ruff linter: * Added aqua v1 and v2 parser * Ruff: Fix I001, E302, W291, E265 * Added docstring for bandit and checkmarx * Ruff: Fix W293 * Added Docstrings for Cargo_Audit, Brakeman, and Zap * Ruff: Fix W291 in Cargo_Audit/parser.py * Added docstrings for gitleaks, qualys, semgrep, snyk --------- Co-authored-by: Jino Tesauro <jinotesauro@pop-os.localdomain>
1 parent 58e39f4 commit 8a24ee6

11 files changed

Lines changed: 581 additions & 16 deletions

File tree

‎dojo/tools/aqua/parser.py‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,94 @@
44

55

66
class AquaParser:
7+
8+
def get_fields(self) -> list[str]:
9+
"""
10+
Return the list of fields used in the Aqua Parser.
11+
12+
Fields:
13+
- title: Made by combining cve, resource_name, and resource_version.
14+
- severity: Severity converted from Aqua format into Defect Dojo format.
15+
- severity_justification: Set to justification returned by Aqua scanner.
16+
- cvssv3: Defined based on the output of the Aqua Scanner.
17+
- description: Set to description returned from Aqua Scanner. If no description is present set to "no description".
18+
- mitigation: Set to fix_version returned from Aqua Scanner.
19+
- references: Set to url returned from Aqua Scanner.
20+
- component_name: Set to name returned from Aqua Scanner.
21+
- component_version: Set to version returned from Aqua Scanner.
22+
- impact: Set to same value as severity.
23+
- epss_score: Set to epss_score returned from scanner if it exists.
24+
- epss_percentile: Set to epss_percentile returned from scanner if it exists.
25+
"""
26+
return [
27+
"title",
28+
"severity",
29+
"severity_justification",
30+
"cvssv3",
31+
"description",
32+
"mitigation",
33+
"references",
34+
"component_name",
35+
"component_version",
36+
"impact",
37+
"epss_score",
38+
"epss_percentile",
39+
]
40+
41+
def get_dedupe_fields(self) -> list[str]:
42+
"""
43+
Return the list of fields used for deduplication in the Aqua Parser.
44+
45+
Fields:
46+
- severity: Severity converted from Aqua format into Defect Dojo format.
47+
- component_name: Set to name returned from Aqua Scanner.
48+
- component_version: Set to version returned from Aqua Scanner.
49+
50+
#NOTE: vulnerability_ids is not provided by parser
51+
"""
52+
return [
53+
"severity",
54+
"component_name",
55+
"component_version",
56+
]
57+
58+
# Jino This get_fields was written for the Aque Parser v2 (based off of "get_iten_v2")
59+
# What do we do with the seperate versions of this parser?
60+
# def get_fields(self) -> list[str]:
61+
# """
62+
# Return the list of fields used in the Aqua Parser V2
63+
#
64+
# Fields:
65+
# - title: Created by combining the finding's cve and file_path
66+
# - description: Text describing finding
67+
# - url: Url associated with the finding
68+
# - severity: Severity rating converted from Aqua's integer format into DefectDojo's format.
69+
# #Jino: On line 106 it calls severity_of instead of aqua_severity_of. get_item v1 uses aqua_severity_of#
70+
# - impact: Impact rating of finding. Same as the finding severity.
71+
# - mitigation: If solution is true, mitigation equals true. If fix_version is true, mitigation equals 'Upgrade to True'.If neither are true mitigation equals 'No known mitigation'.
72+
# """
73+
# return [
74+
# "title",
75+
# "description",
76+
# "url",
77+
# "severity",
78+
# "impact",
79+
# "mitigation",
80+
# ]
81+
# Dedupe for v2 based on default dedupe values
82+
# def get_dedupe_fields(self) -> list[str]:
83+
# """
84+
# Return the list of fields used for deduplication in the Aqua Parser V2.
85+
#
86+
# Fields:
87+
# - title: Created by combining the finding's cve and file_path
88+
# - description: Text describing finding
89+
# """
90+
# #NOTE: vulnerability_ids is not provided by parser
91+
# return [
92+
# "title",
93+
# "description",
94+
# ]
795
def get_scan_types(self):
896
return ["Aqua Scan"]
997

‎dojo/tools/bandit/parser.py‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,49 @@
66

77

88
class BanditParser:
9+
10+
def get_fields(self) -> list[str]:
11+
"""
12+
Return the list of fields used in the Bandit Parser.
13+
14+
Fields:
15+
- title: Set to the issue_text outputted by th Bandit Scanner.
16+
- description: Custom description made from: test_name, test_id, filename, line_number, issue_confidence, and code segments.
17+
- severity: Set to issue_severity from Bandit Scanner.
18+
- file_path: Set to filename from Bandit Scanner.
19+
- line: Set to line from Bandit Scanner.
20+
- date: Set to date from Bandit Scanner.
21+
- vuln_id_from_tool: Made from joining test_name and test_id.
22+
- nb_occurences: Initially set to 1 then updated.
23+
- scanner_condifence: Set to confidence value if one is returned from the Bandit Scanner.
24+
"""
25+
return [
26+
"title",
27+
"description",
28+
"severity",
29+
"file_path",
30+
"line",
31+
"date",
32+
"vuln_id_from_tool",
33+
"nb_occurences",
34+
"scanner_confidence",
35+
]
36+
37+
def get_dedupe_fields(self) -> list[str]:
38+
"""
39+
Return the list of fields used for deduplication in the Bandit Parser.
40+
41+
Fields:
42+
- file_path: Set to filename from Bandit Scanner.
43+
- line: Set to line from Bandit Scanner.
44+
- vuln_id_from_tool: Made from joining test_name and test_id.
45+
"""
46+
return [
47+
"file_path",
48+
"line",
49+
"vuln_id_from_tool",
50+
]
51+
952
def get_scan_types(self):
1053
return ["Bandit Scan"]
1154

‎dojo/tools/brakeman/parser.py‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,46 @@
88

99

1010
class BrakemanParser:
11+
def get_fields(self) -> list[str]:
12+
"""
13+
Return the list of fields used in the Brakeman Parser.
14+
15+
Fields:
16+
- title: Made by joining warning_type and message provided by Brakeman Scanner.
17+
- description: Made by joining filename, line number, issue confidence, code, user input, and render path provided by Brakeman Scanner.
18+
- severity: Set to Medium regardless of context.
19+
- file_path: Set to file from Brakeman Scanner.
20+
- line: Set to line from Brakeman Scanner.
21+
- date: Set to end_date from Brakeman Scanner.
22+
"""
23+
return [
24+
"title",
25+
"description",
26+
"severity",
27+
"file_path",
28+
"line",
29+
"date",
30+
]
31+
32+
def get_dedupe_fields(self) -> list[str]:
33+
"""
34+
Return the list of fields used for deduplication in the Brakeman Parser.
35+
36+
Fields:
37+
- title: Made by joining warning_type and message provided by Brakeman Scanner.
38+
- line: Set to line from Brakeman Scanner.
39+
- file_path: Set to file from Brakeman Scanner.
40+
- description: Made by joining filename, line number, issue confidence, code, user input, and render path provided by Brakeman Scanner.
41+
42+
NOTE: uses legacy dedupe: ['title', 'cwe', 'line', 'file_path', 'description']
43+
"""
44+
return [
45+
"title",
46+
"line",
47+
"file_path",
48+
"description",
49+
]
50+
1151
def get_scan_types(self):
1252
return ["Brakeman Scan"]
1353

‎dojo/tools/burp/parser.py‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,54 @@ class BurpParser:
1919
TODO Test burp output version. Handle what happens if the parser doesn't support it.
2020
"""
2121

22+
def get_fields(self) -> list[str]:
23+
"""
24+
Return the list of fields used in the Burp Parser
25+
26+
Fields:
27+
- title: Made using Burp scanner output's name.
28+
- url: URL outputted by Burp Scanner.
29+
- severity: Severity outputted by Burp Scanner.
30+
- param: Burp parameters combined to form param.
31+
- scanner_confidence: Converted from Burp format (Certain, Firm, or Tentative) into Defect Dojo integer format.
32+
- description: Made by combining URL, url_host, path, and detail.
33+
- mitigation: Made using Remediation that was ouputted by Burp scanner
34+
- impact: Set to background returned by Burp Scanner.
35+
- unique_id_from_tool: Set to serial_number returned by Burp Scanner.
36+
- vuln_id_from_tool: Taken from output of Burp Scanner.
37+
- cwe: Set to cwe outputted from Burp Scanner. Multiple cwes is not supported by parser.
38+
"""
39+
return [
40+
"title",
41+
"url",
42+
"severity",
43+
"param",
44+
"scanner_confidence",
45+
"description",
46+
"mitigation",
47+
"impact",
48+
"unique_id_from_tool",
49+
"vuln_id_from_tool",
50+
"cwe",
51+
]
52+
53+
def get_dedupe_fields(self) -> list[str]:
54+
"""
55+
Return the list of dedupe fields used in the Burp Parser
56+
57+
Fields:
58+
- title: Made using Burp scanner output's name.
59+
- cwe: Set to cwe outputted from Burp Scanner. Multiple cwes is not supported by parser.
60+
- description: Made by combining URL, url_host, path, and detail.
61+
62+
NOTE: uses legacy dedupe: ['title', 'cwe', 'line', 'file_path', 'description']
63+
"""
64+
return [
65+
"title",
66+
"cwe",
67+
"description",
68+
]
69+
2270
def get_scan_types(self):
2371
return ["Burp Scan"]
2472

‎dojo/tools/cargo_audit/parser.py‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,58 @@ class CargoAuditParser:
88

99
"""A class that can be used to parse the cargo audit JSON report file"""
1010

11+
def get_fields(self) -> list[str]:
12+
"""
13+
Return the list of fields used in the Cargo Audit Parser.
14+
15+
Fields:
16+
- title: Set to the title from Cargo Audit Scanner
17+
- severity: Set to "High" regardless of context.
18+
- tags: Set to the tags from Cargo Audit Scanner if they are provided.
19+
- description: Set to the description from Cargo Audit Scanner and joined with URL provided.
20+
- component_name: Set to name of package provided by the Cargo Audit Scanner.
21+
- component_version: Set to version of package provided by the Cargo Audit Scanner.
22+
- vuln_id_from_tool: Set to id provided by the Cargo Audit Scanner.
23+
- publish_date: Set to date provided by the Cargo Audit Scanner.
24+
- nb_occurences: Set to 1 by the parser.
25+
- mitigation: Set to package_name and versions if information is available.
26+
27+
NOTE: This parser supports tags
28+
"""
29+
return [
30+
"title",
31+
"severity",
32+
"tags",
33+
"description",
34+
"component_name",
35+
"component_version",
36+
"vuln_id_from_tool",
37+
"publish_date",
38+
"nb_occurences",
39+
"mitigation",
40+
]
41+
42+
def get_dedupe_fields(self) -> list[str]:
43+
"""
44+
Return the list of fields used for deduplication in the Cargo Audit Parser.
45+
46+
Fields:
47+
- vulnerability_ids:
48+
- severity: Set to "High" regardless of context.
49+
- component_name: Set to name of package provided by the Cargo Audit Scanner.
50+
- component_version: Set to version of package provided by the Cargo Audit Scanner.
51+
- vuln_id_from_tool: Set to id provided by the Cargo Audit Scanner.
52+
53+
NOTE: Dedupe fields in settings.dist.py list vulnerability_ids and vuln_id_from_tool
54+
"""
55+
return [
56+
"vulnerability_ids",
57+
"severity",
58+
"component_name",
59+
"component_version",
60+
"vuln_id_from_tool",
61+
]
62+
1163
def get_scan_types(self):
1264
return ["CargoAudit Scan"]
1365

‎dojo/tools/checkmarx/parser.py‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,69 @@
1212

1313

1414
class CheckmarxParser:
15+
16+
def get_fields(self) -> list[str]:
17+
"""
18+
Return the list of fields used in the Checkmarx Parser.
19+
20+
Fields:
21+
- title: Constructed from output of Checkmarx Scanner.
22+
- cwe: Set to cwe outputted by Checkmarx Parser.
23+
- active: Set to boolean value based on state returned by Checkmarx Parser.
24+
- verified: Set to boolean value based on state returned by Checkmarx Parser.
25+
- false_p: Set to boolean value based on "falsePositive" returned by Checkmarx Parser.
26+
- description: Made from combining linenumber, column, source object, and number.
27+
- severity: Set to severity outputted by Checkmarx Scanner.
28+
- file_path: Set to filename outputted by Checkmarx Scanner.
29+
- date: Set to date outputted by Checkmarx Scanner.
30+
- nb_occurences: Inittially set to 1 and then updated accordingly.
31+
- line: Set to line outputted by Checkmarx Scanner.
32+
- unique_id_from_tool: [If mode set to detailed] Set to the unique pathId outputted by Checkmarx Parser.
33+
- sast_source_object: [If mode set to detailed] Set to sourceObject outputted by Checkmarx Parser.
34+
- sast_sink_object: [If mode set to detailed] Set to sinkObject outputted by Checkmarx Parser.
35+
- sast_source_line: [If mode set to detailed] Set to sourceLineNumber outputted by Checkmarx Parser.
36+
- sast_source_file_path: [If mode set to detailed] Set to sourceFilename outputted by Checkmarx Parser.
37+
- vuln_id_from_tool: Set to id from Checkmarx Scanner.
38+
- component_name: Set to value within the "name" returned from the Checkmarx Scanner.
39+
- component_version: Set to value within the "name" returned from the Checkmarx Scanner.
40+
"""
41+
return [
42+
"title"
43+
"cwe",
44+
"active",
45+
"verified",
46+
"false_p",
47+
"description",
48+
"severity",
49+
"file_path",
50+
"date",
51+
"nb_occurences",
52+
"line",
53+
"unique_id_from_tool",
54+
"sast_source_object",
55+
"sast_sink_object",
56+
"sast_source_line",
57+
"sast_source_file_path",
58+
"vuln_id_from_tool",
59+
"component_name",
60+
"component_version",
61+
]
62+
63+
def get_dedupe_fields(self) -> list[str]:
64+
"""
65+
Return the list of fields used for deduplication in the Checkmarx Parser.
66+
67+
Fields:
68+
- cwe: Set to cwe outputted by Checkmarx Parser.
69+
- severity: Set to severity outputted by Checkmarx Scanner.
70+
- file_path: Set to filename outputted by Checkmarx Scanner.
71+
"""
72+
return [
73+
"cwe",
74+
"severity",
75+
"file_path",
76+
]
77+
1578
def get_scan_types(self):
1679
return ["Checkmarx Scan", "Checkmarx Scan detailed"]
1780

0 commit comments

Comments
 (0)