Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Commit 6eb2665

Browse files
MartinLang1MartinLang1
committed
Merge remote-tracking branch 'origin/develop' into upgrade-to-camunda-7.9
2 parents ca1e852 + 81dd14f commit 6eb2665

File tree

24 files changed

+865
-150
lines changed

24 files changed

+865
-150
lines changed

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoPersistenceProvider.java‎

Lines changed: 36 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.slf4j.Logger;
2828
import org.slf4j.LoggerFactory;
2929
import org.springframework.beans.factory.annotation.Autowired;
30+
import org.springframework.beans.factory.annotation.Value;
3031
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
3132
import org.springframework.stereotype.Component;
3233

@@ -47,6 +48,9 @@
4748
public class DefectDojoPersistenceProvider implements PersistenceProvider {
4849
private static final Logger LOG = LoggerFactory.getLogger(DefectDojoPersistenceProvider.class);
4950

51+
@Value("${securecodebox.persistence.defectdojo.optional:false}")
52+
protected boolean isOptional;
53+
5054
@Autowired
5155
DefectDojoService defectDojoService;
5256

@@ -66,26 +70,38 @@ public void persist(SecurityTest securityTest) throws PersistenceException {
6670
LOG.debug("Starting defectdojo persistence provider");
6771
LOG.debug("RawFindings: {}", securityTest.getReport().getRawFindings());
6872

73+
try {
74+
persistInDefectDojo(securityTest);
75+
} catch (Exception e) {
76+
// ignore error if defect dojo provider is set to optional
77+
if(isOptional) {
78+
LOG.error("Failed to persist security test in defect dojo", e);
79+
return;
80+
} else throw e;
81+
}
82+
}
83+
84+
private void persistInDefectDojo(SecurityTest securityTest) throws PersistenceException {
6985
checkConnection();
7086
checkToolTypes();
7187

7288
EngagementResponse res = createEngagement(securityTest);
73-
String engagementUrl = res.getUrl();
74-
LOG.debug("Created engagement: '{}'", engagementUrl);
89+
long engagementId = res.getId();
90+
LOG.debug("Created engagement: '{}'", engagementId);
7591

7692
String username = securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name());
77-
String userUrl = defectDojoService.getUserUrl(username);
93+
long userUrl = defectDojoService.retrieveUserId(username);
7894

7995
List<String> results = getDefectDojoScanName(securityTest.getName()).equals("Generic Findings Import") ? getGenericResults(securityTest) : getRawResults(securityTest);
80-
for (String result : results) {
81-
defectDojoService.createFindings(
82-
result,
83-
engagementUrl,
84-
userUrl,
85-
currentDate(),
86-
getDefectDojoScanName(securityTest.getName())
87-
);
88-
}
96+
for (String result : results) {
97+
defectDojoService.createFindings(
98+
result,
99+
engagementId,
100+
userUrl,
101+
currentDate(),
102+
getDefectDojoScanName(securityTest.getName())
103+
);
104+
}
89105
}
90106

91107
static final String GIT_SERVER_NAME = "Git Server";
@@ -157,25 +173,25 @@ private List<String> getGenericResults(SecurityTest securityTest) {
157173

158174
private EngagementResponse createEngagement(SecurityTest securityTest) {
159175
EngagementPayload engagementPayload = new EngagementPayload();
160-
engagementPayload.setProduct(defectDojoService.getProductUrl(securityTest.getContext()));
176+
engagementPayload.setProduct(defectDojoService.retrieveProductId(securityTest.getContext()));
161177

162178
if(securityTest.getMetaData() == null){
163179
securityTest.setMetaData(new HashMap<>());
164180
}
165181

166182
engagementPayload.setName(securityTest.getMetaData().get(CommonMetaFields.SCB_ENGAGEMENT_TITLE.name()) != null ?
167183
securityTest.getMetaData().get(CommonMetaFields.SCB_ENGAGEMENT_TITLE.name()) : getDefectDojoScanName(securityTest.getName()));
168-
engagementPayload.setLead(defectDojoService.getUserUrl(securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name())));
184+
engagementPayload.setLead(defectDojoService.retrieveUserId(securityTest.getMetaData().get(DefectDojoMetaFields.DEFECT_DOJO_USER.name())));
169185
engagementPayload.setDescription(descriptionGenerator.generate(securityTest));
170186
engagementPayload.setBranch(securityTest.getMetaData().get(CommonMetaFields.SCB_BRANCH.name()));
171187
engagementPayload.setBuildID(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_ID.name()));
172188
engagementPayload.setCommitHash(securityTest.getMetaData().get(CommonMetaFields.SCB_COMMIT_HASH.name()));
173189
engagementPayload.setRepo(securityTest.getMetaData().get(CommonMetaFields.SCB_REPO.name()));
174190
engagementPayload.setTracker(securityTest.getMetaData().get(CommonMetaFields.SCB_TRACKER.name()));
175191

176-
engagementPayload.setBuildServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_SERVER.name()), BUILD_SERVER_NAME));
177-
engagementPayload.setScmServer(defectDojoService.getToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_SCM_SERVER.name()), GIT_SERVER_NAME));
178-
engagementPayload.setOrchestrationEngine(defectDojoService.getToolConfiguration("https://github.com/secureCodeBox", SECURITY_TEST_SERVER_NAME));
192+
engagementPayload.setBuildServer(defectDojoService.retrieveOrCreateToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_BUILD_SERVER.name()), BUILD_SERVER_NAME));
193+
engagementPayload.setScmServer(defectDojoService.retrieveOrCreateToolConfiguration(securityTest.getMetaData().get(CommonMetaFields.SCB_SCM_SERVER.name()), GIT_SERVER_NAME));
194+
engagementPayload.setOrchestrationEngine(defectDojoService.retrieveOrCreateToolConfiguration("https://github.com/secureCodeBox", SECURITY_TEST_SERVER_NAME));
179195

180196
engagementPayload.setTargetStart(currentDate());
181197
engagementPayload.setTargetEnd(currentDate());
@@ -196,6 +212,9 @@ protected static String getDefectDojoScanName(String securityTestName) {
196212
scannerDefectDojoMapping.put("nmap", "Nmap Scan");
197213
scannerDefectDojoMapping.put("zap", "ZAP Scan");
198214

215+
// Map amass-nmap raw results to be imported as Nmap Results
216+
scannerDefectDojoMapping.put("amass-nmap", "Nmap Scan");
217+
199218
// Nikto is a supported tool as well but currently not accessible for supported import.
200219
// Nikto thus will use Generic Findings Import.
201220

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java‎

Lines changed: 36 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ public void createToolType(String name, String description){
8282
restTemplate.exchange(defectDojoUrl + "/api/v2/tool_types/", HttpMethod.POST, toolPayload, ToolType.class);
8383
}
8484

85-
public String getUserUrl(String username){
85+
public Long retrieveUserId(String username){
8686
RestTemplate restTemplate = new RestTemplate();
8787

8888
if(username == null){
@@ -93,57 +93,66 @@ public String getUserUrl(String username){
9393
HttpEntity userRequest = new HttpEntity(getHeaders());
9494
ResponseEntity<DefectDojoResponse<DefectDojoUser>> userResponse = restTemplate.exchange(uri, HttpMethod.GET, userRequest, new ParameterizedTypeReference<DefectDojoResponse<DefectDojoUser>>(){});
9595
if(userResponse.getBody().getCount() == 1){
96-
return userResponse.getBody().getResults().get(0).getUrl();
96+
return userResponse.getBody().getResults().get(0).getId();
9797
}
9898
else {
9999
throw new DefectDojoUserNotFound(MessageFormat.format("Could not find user: \"{0}\" in DefectDojo", username));
100100
}
101101
}
102102

103-
public String getProductUrl(String product){
103+
public long retrieveProductId(String product){
104104
RestTemplate restTemplate = new RestTemplate();
105105

106106
String uri = defectDojoUrl + "/api/v2/products/?name=" + product;
107107
HttpEntity productRequest = new HttpEntity(getHeaders());
108108
ResponseEntity<DefectDojoResponse<DefectDojoProduct>> productResponse = restTemplate.exchange(uri, HttpMethod.GET, productRequest, new ParameterizedTypeReference<DefectDojoResponse<DefectDojoProduct>>(){});
109109
if(productResponse.getBody().getCount() == 1){
110-
return productResponse.getBody().getResults().get(0).getUrl();
110+
return productResponse.getBody().getResults().get(0).getId();
111111
}
112112
else {
113113
throw new DefectDojoProductNotFound(MessageFormat.format("Could not find product: \"{0}\" in DefectDojo", product));
114114
}
115115
}
116116

117-
public String getToolConfiguration(String toolUrl, String toolType){
118-
RestTemplate restTemplate = new RestTemplate();
119-
117+
public Long retrieveOrCreateToolConfiguration(String toolUrl, String toolType){
120118
if (toolUrl == null){
121119
return null;
122120
}
123121

124-
String uri = defectDojoUrl + "/api/v2/tool_configurations/?url=" + toolUrl;
125-
HttpEntity toolRequest = new HttpEntity(getHeaders());
126-
ResponseEntity<DefectDojoResponse<ToolConfig>> toolResponse = restTemplate.exchange(uri, HttpMethod.GET, toolRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolConfig>>(){});
122+
ResponseEntity<DefectDojoResponse<ToolConfig>> toolResponse = retrieveToolConfiguration(toolUrl);
127123
if(toolResponse.getBody().getCount() > 0){
128-
return toolResponse.getBody().getResults().get(0).getUrl();
124+
LOG.info("Tool configuration already exists. Returning existing configuration.");
125+
return toolResponse.getBody().getResults().get(0).getId();
129126
}
130127
else {
131-
HttpEntity toolTypeRequest = new HttpEntity(getHeaders());
132-
String toolTypeRequestUri = defectDojoUrl + "/api/v2/tool_types/?name=" + toolType;
133-
ResponseEntity<DefectDojoResponse<ToolType>> toolTypeResponse = restTemplate.exchange(toolTypeRequestUri, HttpMethod.GET, toolTypeRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolType>>(){});
134-
String toolTypeUri = toolTypeResponse.getBody().getResults().get(0).getUrl();
128+
LOG.info("Tool configuration does not exist yet. Creating new configuration.");
129+
createToolConfiguration(toolUrl, toolType);
130+
return retrieveToolConfiguration(toolUrl).getBody().getResults().get(0).getId();
131+
}
132+
}
133+
134+
private ResponseEntity<DefectDojoResponse<ToolConfig>> retrieveToolConfiguration(String toolUrl) {
135+
RestTemplate restTemplate = new RestTemplate();
136+
String uri = defectDojoUrl + "/api/v2/tool_configurations/?name=" + toolUrl;
137+
HttpEntity toolRequest = new HttpEntity(getHeaders());
138+
return restTemplate.exchange(uri, HttpMethod.GET, toolRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolConfig>>(){});
139+
}
135140

136-
ToolConfig toolConfig = new ToolConfig();
137-
toolConfig.setName(toolUrl);
138-
toolConfig.setToolType(toolTypeUri);
139-
toolConfig.setConfigUrl(toolUrl);
140-
toolConfig.setDescription(toolType);
141+
private void createToolConfiguration(String toolUrl, String toolType) {
142+
HttpEntity toolTypeRequest = new HttpEntity(getHeaders());
143+
String toolTypeRequestUri = defectDojoUrl + "/api/v2/tool_types/?name=" + toolType;
144+
RestTemplate restTemplate = new RestTemplate();
145+
ResponseEntity<DefectDojoResponse<ToolType>> toolTypeResponse = restTemplate.exchange(toolTypeRequestUri, HttpMethod.GET, toolTypeRequest, new ParameterizedTypeReference<DefectDojoResponse<ToolType>>(){});
146+
String toolTypeId = toolTypeResponse.getBody().getResults().get(0).getId();
141147

142-
HttpEntity<ToolConfig> toolPayload = new HttpEntity<>(toolConfig, getHeaders());
143-
restTemplate.exchange(defectDojoUrl + "/api/v2/tool_configurations/", HttpMethod.POST, toolPayload, ToolConfig.class);
144-
return getToolConfiguration(toolUrl, toolType);
148+
ToolConfig toolConfig = new ToolConfig();
149+
toolConfig.setName(toolUrl);
150+
toolConfig.setToolType(toolTypeId);
151+
toolConfig.setConfigUrl(toolUrl);
152+
toolConfig.setDescription(toolType);
145153

146-
}
154+
HttpEntity<ToolConfig> toolPayload = new HttpEntity<>(toolConfig, getHeaders());
155+
restTemplate.exchange(defectDojoUrl + "/api/v2/tool_configurations/", HttpMethod.POST, toolPayload, ToolConfig.class);
147156
}
148157

149158
public EngagementResponse createEngagement(EngagementPayload engagementPayload) {
@@ -161,15 +170,15 @@ public EngagementResponse createEngagement(EngagementPayload engagementPayload)
161170
}
162171
}
163172

164-
public ImportScanResponse createFindings(String rawResult, String engagementUrl, String lead, String currentDate,String defectDojoScanName) {
173+
public ImportScanResponse createFindings(String rawResult, long engagementId, long lead, String currentDate,String defectDojoScanName) {
165174
RestTemplate restTemplate = new RestTemplate();
166175
HttpHeaders headers = getHeaders();
167176
headers.setContentType(MediaType.MULTIPART_FORM_DATA);
168177
restTemplate.setMessageConverters(Arrays.asList(new FormHttpMessageConverter(), new ResourceHttpMessageConverter(), new MappingJackson2HttpMessageConverter()));
169178

170179
MultiValueMap<String, Object> mvn = new LinkedMultiValueMap<>();
171-
mvn.add("engagement", engagementUrl);
172-
mvn.add("lead", lead);
180+
mvn.add("engagement", Long.toString(engagementId));
181+
mvn.add("lead", Long.toString(lead));
173182
mvn.add("scan_date", currentDate);
174183
mvn.add("scan_type", defectDojoScanName);
175184

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/DefectDojoProduct.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
@Data
99
public class DefectDojoProduct {
1010
@JsonProperty
11-
String url;
11+
long id;
1212

1313
@JsonProperty
1414
String name;

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/DefectDojoUser.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
public class DefectDojoUser {
66
@JsonProperty
7-
String url;
7+
Long id;
88

99
@JsonProperty
1010
String username;
@@ -15,12 +15,12 @@ public class DefectDojoUser {
1515
@JsonProperty("last_name")
1616
String lastName;
1717

18-
public String getUrl() {
19-
return url;
18+
public Long getId() {
19+
return id;
2020
}
2121

22-
public void setUrl(String url) {
23-
this.url = url;
22+
public void setId(Long id) {
23+
this.id = id;
2424
}
2525

2626
public String getUsername() {

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/EngagementPayload.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public class EngagementPayload {
3131
protected String name;
3232

3333
@JsonProperty
34-
protected String product;
34+
protected long product;
3535

3636
@JsonProperty("target_start")
3737
protected String targetStart;
@@ -40,7 +40,7 @@ public class EngagementPayload {
4040
protected String targetEnd;
4141

4242
@JsonProperty
43-
protected String lead;
43+
protected Long lead;
4444

4545
@JsonProperty("engagement_type")
4646
protected String engagementType = "CI/CD";
@@ -67,13 +67,13 @@ public class EngagementPayload {
6767
protected String repo;
6868

6969
@JsonProperty("build_server")
70-
protected String buildServer;
70+
protected Long buildServer;
7171

7272
@JsonProperty("source_code_management_server")
73-
protected String scmServer;
73+
protected Long scmServer;
7474

7575
@JsonProperty("orchestration_engine")
76-
protected String orchestrationEngine;
76+
protected Long orchestrationEngine;
7777

7878
@JsonProperty
7979
protected String description;

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/EngagementResponse.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@
2222

2323
public class EngagementResponse {
2424
@JsonProperty
25-
protected String url;
25+
protected long id;
2626

27-
public String getUrl() {
28-
return url;
27+
public long getId() {
28+
return id;
2929
}
3030

31-
public void setUrl(String url) {
32-
this.url = url;
31+
public void setId(long id) {
32+
this.id = id;
3333
}
3434
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/ToolConfig.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
import com.fasterxml.jackson.annotation.JsonProperty;
44

55
public class ToolConfig {
6+
@JsonProperty
7+
long id;
8+
69
@JsonProperty
710
String url;
811

@@ -18,6 +21,14 @@ public class ToolConfig {
1821
@JsonProperty
1922
String description;
2023

24+
public long getId() {
25+
return id;
26+
}
27+
28+
public void setId(long id) {
29+
this.id = id;
30+
}
31+
2132
public String getDescription() {
2233
return description;
2334
}

‎scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/models/ToolType.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,20 @@
44

55
public class ToolType {
66
@JsonProperty
7-
String url;
7+
String id;
88

99
@JsonProperty
1010
String name;
1111

1212
@JsonProperty
1313
String description;
1414

15-
public String getUrl() {
16-
return url;
15+
public String getId() {
16+
return id;
1717
}
1818

19-
public void setUrl(String url) {
20-
this.url = url;
19+
public void setId(String id) {
20+
this.id = id;
2121
}
2222

2323
public String getName() {

0 commit comments

Comments
 (0)