-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Fortify FPR enhancements 2025 #12027
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fortify FPR enhancements 2025 #12027
Conversation
The VDL file contains some preformatted html content in certain tags: Inside Defect Dojo this will look this this: I am not sure what Defect Dojo should do here. Should we try to get Defect Dojo to render this preformatted html? Should we try to convert it to markdown? Should we strip the tags? Should we parse the HTML and try to turn it into meaningfull text? For now I've just left it like this as this PR is already a considerable improvement. The code snippets are rendering correctly in Defect Dojo: |
DryRun Security SummaryThe pull request enhances Fortify vulnerability management by improving XML parsing security, implementing robust input validation, adding structured vulnerability extraction, and updating unit tests with more comprehensive security checks. Expand for full summary
Namespace Handling Improvement:
Logging Security Considerations:
Input Validation Enhancements:
Potential Information Exposure Mitigation:
Computational Security:
Vulnerability Findings in Test Data:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approved
Description
This PR:
Friority
)unique_id_from_tool
to be theInstanceID
field from the report. Not sure if this can be used for dedupe.A future PR could change the XML parser to use the same data model.
fixes #11901
fixes #11903
Test results
Unit tests are extended and still working
Documentation
No updates needed.