Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Import History: Adding a few tests #10235

Merged
merged 2 commits into from
May 28, 2024
Merged

Import History: Adding a few tests #10235

merged 2 commits into from
May 28, 2024

Conversation

Maffooch
Copy link
Contributor

Adding tests for #10226

Copy link

dryrunsecurity bot commented May 21, 2024

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Configured Codepaths Analyzer 0 findings
Sensitive Files Analyzer 0 findings
AppSec Analyzer 0 findings
Authn/Authz Analyzer 0 findings
Secrets Analyzer 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request focus on updating and improving the handling of security-related
data, specifically the import and reimport of various security scan reports. The key changes include:

  1. Addition of new JSON files (test_import_report1.json and test_import_report2.json) that
    contain security findings from security scans, including information about the findings' titles,
    descriptions, severities, and mitigation statuses.
  2. Updates to the test_import_reimport.py file, which handles the import and reimport of security
    scan reports from various sources, such as ZAP, Acunetix, Anchore, Veracode, SonarQube, and
    GitLab Dependency Scanning.
  3. Inclusion of comprehensive test cases to verify the import and reimport functionality, ensuring
    that findings are correctly matched, updated, and tracked, and that the application's security
    posture is accurately represented.

From an application security perspective, these changes are crucial for maintaining the security
of the application. The ability to regularly import and reimport security scan reports allows the
security team to stay up-to-date with the latest security issues and track the mitigation of
findings over time. The comprehensive test coverage helps ensure the reliability and accuracy
of the security data and the associated processes.

Files Changed:

  1. unittests/scans/generic/test_import_report1.json:

    • This file is a new JSON file that contains a list of security findings, including information
      about the title, description, severity, and mitigation status of each finding.
    • The file includes multiple findings with the same title, which could indicate a potential
      issue with the report generation or data processing logic.
    • The file shows that some findings are marked as mitigated, while others are not, suggesting
      that the application or process that generates this report is tracking the mitigation status
      of the findings.
  2. unittests/scans/generic/test_import_report2.json:

    • This file is also a new JSON file that contains information about a security scan report.
    • The report includes a list of "findings" with the same title, description, and severity,
      which could indicate a lack of uniqueness or specificity in the findings.
    • The report also includes findings with inconsistent active, verified, and mitigation
      statuses, which could suggest potential issues with the reporting process.
  3. unittests/test_import_reimport.py:

    • This file contains the code that handles the import and reimport of various security scan
      reports, including ZAP, Acunetix, Anchore, Veracode, SonarQube, and GitLab Dependency
      Scanning.
    • The code includes comprehensive test cases to verify the import and reimport functionality,
      ensuring that findings are correctly matched, updated, and tracked, and that the
      application's security posture is accurately represented.

Powered by DryRun Security

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@blakeaowens blakeaowens merged commit e37781e into bugfix May 28, 2024
126 checks passed
@Maffooch Maffooch deleted the import-history-tests branch July 9, 2024 21:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants