django-DefectDojo icon indicating copy to clipboard operation
django-DefectDojo copied to clipboard

Gitlab: Consolidation

Open kiblik opened this issue 3 years ago • 1 comments

This PR is the solution for https://github.com/DefectDojo/django-DefectDojo/issues/5863

Summary:

  • Gitlab uses the unified format for all scans (the main part is described here). If multiple scan types use only one parser, it is easier for maintenance
  • I used the best parts from the implementation of GitLab API Fuzzing Report Scan, GitLab Container Scan, GitLab DAST Report, GitLab Dependency Scanning Report, GitLab SAST Report, GitLab Secret Detection Report, added some field by my self and introduced support for GitLab Cluster Image Scanning Report and GitLab Coverage-Guided Fuzz Testing Report Scan (btw, there is also support for Infrastructure as Code (IaC) Scanning but it is just subcategory of SAST)
  • Move scan reports to new folders
  • Add more scan examples for unittests (they are from my tests or from the official documentation)
  • Fixed using of unique ID as Title of finding in GitLab DAST Report
  • Add support for get_tests
  • Add more tests

TODO:

  • [ ] fix documentation
  • [ ] fix existing tests
  • [ ] add new tests
  • [ ] add implementation for vuln['details']
  • [ ] add fields in to settings.dist.py

kiblik avatar Feb 18 '22 00:02 kiblik

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions[bot] avatar May 02 '22 18:05 github-actions[bot]

@kiblik, we like this PR, but it is also a big change. Could we leave the original parsers temporarily while this is tested further? That way if there are issues, people still have the option to use the old importers.

devGregA avatar Sep 30 '22 18:09 devGregA

Closing due to lack or response. Please feel free to re-engage when/if you are able.

devGregA avatar Nov 04 '22 18:11 devGregA