🐛 fix Bearer CLI missing Scan Type #10652

[manuel-sommer]

#10652

[dryrunsecurity]

DryRun Security Summary

The changes in this pull request focus on improving the parsing and representation of the output from the Bearer CLI tool, a SAST scanner, by renaming the BearerParser class, enhancing the get_findings() method, implementing deduplication logic, and marking the Finding objects as static_finding=True and dynamic_finding=False, while also updating the unit tests for the BearerCLIParser class.

Expand for full summary

Summary:

The changes in this pull request are focused on improving the parsing and representation of the output from the Bearer CLI tool, which is a SAST (Static Application Security Testing) scanner. The key changes include:

1. Renaming the BearerParser class to BearerCLIParser to better reflect its purpose of parsing the output from the Bearer CLI tool.
2. Enhancing the get_findings() method to parse the Bearer CLI report in JSON format and create Finding objects with detailed information about the security issues, including the title, description, severity, CWE, references, file path, line number, and the source and sink objects for the vulnerability.
3. Implementing deduplication logic to ensure that duplicate findings are not added to the list of items.
4. Marking the Finding objects as static_finding=True and dynamic_finding=False, indicating that these are findings from a static analysis tool.

Additionally, the changes include updates to the unit tests for the BearerCLIParser class, which verify the parser's behavior when handling JSON files with one vulnerability and multiple vulnerabilities.

Overall, these changes are focused on improving the integration of the Bearer CLI tool's findings into a security management platform, which is an important step in the application security engineering process.

Files Changed:

1. dojo/tools/bearer_cli/parser.py: This file contains the implementation of the BearerCLIParser class, which is responsible for parsing the output of the Bearer CLI tool and creating Finding objects that can be imported into a security management platform like DefectDojo.
2. unittests/tools/test_bearer_cli_parser.py: This file contains the unit tests for the BearerCLIParser class, which verify the parser's behavior when handling JSON files with one vulnerability and multiple vulnerabilities.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved

[mtesauro]

Interesting that its already CLI for both the parser name and hashcode:

https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/tools/bearer_cli/parser.py#L11
and
https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/settings/settings.dist.py#L1269

Anyway, thanks for the PR 👍