Update CheckMarx One parser for imports where description is None

[hblankenship]

Modified the parser to accept the case where results may have a missing description. The description and title is then taken from the severity + queryName
[sc-8947]

[dryrunsecurity]

DryRun Security Summary

The provided code changes focus on improving the robustness and reliability of the Checkmarx One parser by addressing various security-related concerns, including adding a new test case to handle missing vulnerability descriptions, enhancing the handling of missing vulnerability descriptions in the parser, and improving the formatting of vulnerability category information in the parser output.

Expand for full summary

Summary:

The provided code changes focus on improving the robustness and reliability of the Checkmarx One parser by addressing various security-related concerns. The changes include adding a new test case to handle missing vulnerability descriptions, enhancing the handling of missing vulnerability descriptions in the parser, and improving the formatting of vulnerability category information in the parser output.

These changes are positive from an application security perspective, as they help to ensure that the parser can gracefully handle a variety of input formats and edge cases, improving the overall security and reliability of the application. By providing meaningful descriptions for findings even when the original description is missing and formatting the vulnerability category information in a more readable way, the parser can help the security team more effectively identify and address security issues in the codebase.

Additionally, the code changes include the addition of a new unit test case, which increases the overall test coverage of the Checkmarx One parser. This is a good security practice, as it helps to ensure the reliability and maintainability of the application.

Files Changed:

1. unittests/tools/test_checkmarx_one_parser.py: This file has been updated to include a new test case called test_checkmarx_one_no_description, which checks the behavior of the CheckmarxOneParser when the input JSON file does not contain a description for the findings. This helps to ensure that the parser can handle various input formats and edge cases.

2. dojo/tools/checkmarx_one/parser.py: The changes in this file focus on improving the handling of missing vulnerability descriptions in the Checkmarx One parser. The code now checks if the description field is None and constructs a new description using the vulnerability's severity and queryName fields. Additionally, a new get_markdown_categories function has been introduced to format the vulnerability categories and subcategories in Markdown format.

3. unittests/scans/checkmarx_one/checkmarx_one_format_two.json: This file appears to be a sample Checkmarx One scan report, which includes information about a security vulnerability classified as "Insufficiently Protected Credentials" with a severity level of "LOW". The code change highlights the importance of addressing security vulnerabilities identified by SAST tools and incorporating security testing into the software development lifecycle.

Code Analysis

We ran 9 analyzers against 3 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved