Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Add CWE to PTART parser #12068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Mar 25, 2025

Conversation

adam-bertrand-bib
Copy link
Contributor

⚠️ Note on feature completeness ⚠️

We are narrowing the scope of acceptable enhancements to DefectDojo in preparation for v3. Learn more here:
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md

Description

This PR adds support for CWEs to the PTART Parser, and fixes several import bugs seen across use.

Test results

Unit tests are normally deployed for all changes

Documentation

No documentation updates are necessary

Checklist

This checklist is for your information.

  • Make sure to rebase your PR against the very latest dev.
  • Features/Changes should be submitted against the dev.
  • Bugfixes should be submitted against the bugfix branch.
  • Give a meaningful name to your PR, as it may end up being used in the release notes.
  • Your code is flake8 compliant.
  • Your code is python 3.11 compliant.
  • If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
  • Model changes must include the necessary migrations in the dojo/db_migrations folder.
  • Add applicable tests to the unit tests.
  • Add the proper label to categorize your PR.

Extra information

Please clear everything below when submitting your pull request, it's here purely for your information.

Moderators: Labels currently accepted for PRs:

  • Import Scans (for new scanners/importers)
  • enhancement
  • performance
  • feature
  • bugfix
  • maintenance (a.k.a chores)
  • dependencies
  • New Migration (when the PR introduces a DB migration)
  • settings_changes (when the PR introduces changes or new settings in settings.dist.py)

Contributors: Git Tips

Rebase on dev branch

If the dev branch has changed since you started working on it, please rebase your work after the current dev.

On your working branch mybranch:

git rebase dev mybranch

In case of conflict:

 git mergetool
 git rebase --continue

When everything's fine on your local branch, force push to your myOrigin remote:

git push myOrigin --force-with-lease

To cancel everything:

git rebase --abort

Squashing commits

git rebase -i origin/dev
  • Replace pick by fixup on the commits you want squashed out
  • Replace pick by reword on the first commit if you want to change the commit message
  • Save the file and quit your editor

Force push to your myOrigin remote:

git push myOrigin --force-with-lease

@adam-bertrand-bib adam-bertrand-bib changed the title Feature/add CWE to ptart parser Add CWE to ptart parser Mar 21, 2025
@adam-bertrand-bib adam-bertrand-bib changed the title Add CWE to ptart parser Add CWE to PTART parser Mar 21, 2025
Copy link

DryRun Security Summary

Improved DefectDojo PTART parser tools with enhanced CWE parsing, input validation, and security assessment data processing, while identifying potential security risks in test data and parsing mechanisms.

Expand for full summary

PR Summary:
Enhancements to PTART (Penetration Test and Risk Tracking) parser tools in DefectDojo, adding CWE parsing capabilities, improving input validation, and expanding unit test coverage for parsing security assessment data.

Security Findings:

  • Potential Sensitive Information Exposure in test JSON files:

    • Exposed URLs (test.example.com, ref.example.com)
    • Base64 encoded screenshots and attachments
    • Pentester username "hydragyrum"
    • Assessment date ranges and metadata
  • Vulnerability Classification Risks:

    • CWE-862 (Missing Authorization) identified in multiple test scenarios
    • CWE-79 (Cross-site Scripting) detected
    • CWE-778 (Insufficient Logging) highlighted
    • CWE-284 (Improper Access Control) noted
  • Endpoint Parsing Considerations:

    • Automatic HTTPS protocol prepending
    • Handling of invalid or incomplete URLs
    • Potential protocol-related parsing vulnerabilities
  • Input Validation Risks:

    • Long screenshot caption handling
    • CWE parsing with various input format validations
    • Potential parsing errors in metadata extraction

View PR in the DryRun Dashboard.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch merged commit 7d4009c into DefectDojo:dev Mar 25, 2025
78 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants