django-DefectDojo
django-DefectDojo copied to clipboard
Gitlab: Consolidation
This PR is the solution for https://github.com/DefectDojo/django-DefectDojo/issues/5863
Summary:
- Gitlab uses the unified format for all scans (the main part is described here). If multiple scan types use only one parser, it is easier for maintenance
- I used the best parts from the implementation of
GitLab API Fuzzing Report Scan
,GitLab Container Scan
,GitLab DAST Report
,GitLab Dependency Scanning Report
,GitLab SAST Report
,GitLab Secret Detection Report
, added some field by my self and introduced support forGitLab Cluster Image Scanning Report
andGitLab Coverage-Guided Fuzz Testing Report Scan
(btw, there is also support forInfrastructure as Code (IaC) Scanning
but it is just subcategory ofSAST
) - Move scan reports to new folders
- Add more scan examples for unittests (they are from my tests or from the official documentation)
- Fixed using of unique ID as Title of finding in
GitLab DAST Report
- Add support for
get_tests
- Add more tests
TODO:
- [ ] fix documentation
- [ ] fix existing tests
- [ ] add new tests
- [ ] add implementation for
vuln['details']
- [ ] add fields in to
settings.dist.py
This pull request has conflicts, please resolve those before we can evaluate the pull request.
@kiblik, we like this PR, but it is also a big change. Could we leave the original parsers temporarily while this is tested further? That way if there are issues, people still have the option to use the old importers.
Closing due to lack or response. Please feel free to re-engage when/if you are able.