Skip to content

Commit

Permalink
defect dojo verified status is now setup from configuration
Browse files Browse the repository at this point in the history 
Co-Authored-By: Mathieu Scolas <[email protected]>
Co-Authored-By: unknown <[email protected]>
  • Loading branch information
@worming004 @Malaydewangan09
3 people committed Dec 2, 2024
1 parent b022732 commit 80a5770
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 10 deletions.
10 changes: 5 additions & 5 deletions src/main/java/org/dependencytrack/integrations/defectdojo/DefectDojoClient.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ public DefectDojoClient(final DefectDojoUploader uploader, final URL baseURL) {
this.baseURL = baseURL;
}

public void uploadDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson) {
public void uploadDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson, final Boolean verifyFindings) {
LOGGER.debug("Uploading Dependency-Track findings to DefectDojo");
HttpPost request = new HttpPost(baseURL + "/api/v2/import-scan/");
InputStreamBody inputStreamBody = new InputStreamBody(findingsJson, ContentType.APPLICATION_OCTET_STREAM, "findings.json");
Expand All @@ -66,7 +66,7 @@ public void uploadDependencyTrackFindings(final String token, final String engag
.addPart("file", inputStreamBody)
.addPart("engagement", new StringBody(engagementId, ContentType.MULTIPART_FORM_DATA))
.addPart("scan_type", new StringBody("Dependency Track Finding Packaging Format (FPF) Export", ContentType.MULTIPART_FORM_DATA))
.addPart("verified", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
.addPart("verified", new StringBody(Boolean.toString(verifyFindings), ContentType.MULTIPART_FORM_DATA))
.addPart("active", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
.addPart("minimum_severity", new StringBody("Info", ContentType.MULTIPART_FORM_DATA))
.addPart("close_old_findings", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
Expand Down Expand Up @@ -163,7 +163,7 @@ public ArrayList<String> jsonToList(final JSONArray jsonArray) {
* A Reimport will reuse (overwrite) the existing test, instead of create a new test.
* The Successfully reimport will also increase the reimport counter by 1.
*/
public void reimportDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson, final String testId, final Boolean doNotReactivate) {
public void reimportDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson, final String testId, final Boolean doNotReactivate, final Boolean verifyFindings) {
LOGGER.debug("Re-reimport Dependency-Track findings to DefectDojo per Engagement");
HttpPost request = new HttpPost(baseURL + "/api/v2/reimport-scan/");
request.addHeader("accept", "application/json");
Expand All @@ -173,7 +173,7 @@ public void reimportDependencyTrackFindings(final String token, final String eng
.addPart("file", inputStreamBody)
.addPart("engagement", new StringBody(engagementId, ContentType.MULTIPART_FORM_DATA))
.addPart("scan_type", new StringBody("Dependency Track Finding Packaging Format (FPF) Export", ContentType.MULTIPART_FORM_DATA))
.addPart("verified", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
.addPart("verified", new StringBody(Boolean.toString(verifyFindings), ContentType.MULTIPART_FORM_DATA))
.addPart("active", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
.addPart("minimum_severity", new StringBody("Info", ContentType.MULTIPART_FORM_DATA))
.addPart("close_old_findings", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
Expand All @@ -193,4 +193,4 @@ public void reimportDependencyTrackFindings(final String token, final String eng
uploader.handleException(LOGGER, ex);
}
}
}
}
21 changes: 16 additions & 5 deletions src/main/java/org/dependencytrack/integrations/defectdojo/DefectDojoUploader.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ public class DefectDojoUploader extends AbstractIntegrationPoint implements Proj
private static final String ENGAGEMENTID_PROPERTY = "defectdojo.engagementId";
private static final String REIMPORT_PROPERTY = "defectdojo.reimport";
private static final String DO_NOT_REACTIVATE_PROPERTY = "defectdojo.doNotReactivate";

private static final String VERIFIED_PROPERTY = "defectdojo.verified";

public boolean isReimportConfigured(final Project project) {
final ProjectProperty reimport = qm.getProjectProperty(project, DEFECTDOJO_ENABLED.getGroupName(), REIMPORT_PROPERTY);
Expand All @@ -65,6 +65,16 @@ public boolean isDoNotReactivateConfigured(final Project project) {
}
}

public boolean isVerifiedConfigured(final Project project) {
final ProjectProperty verified = qm.getProjectProperty(project, DEFECTDOJO_ENABLED.getGroupName(), VERIFIED_PROPERTY);
if (verified != null) {
return Boolean.parseBoolean(verified.getPropertyValue());
} else {
// Defaults to true for backward compatibility with old behavior where "verified" was always true
return true;
}
}

@Override
public String name() {
return "DefectDojo";
Expand Down Expand Up @@ -99,23 +109,24 @@ public void upload(final Project project, final InputStream payload) {
final ConfigProperty apiKey = qm.getConfigProperty(DEFECTDOJO_API_KEY.getGroupName(), DEFECTDOJO_API_KEY.getPropertyName());
final boolean globalReimportEnabled = qm.isEnabled(DEFECTDOJO_REIMPORT_ENABLED);
final ProjectProperty engagementId = qm.getProjectProperty(project, DEFECTDOJO_ENABLED.getGroupName(), ENGAGEMENTID_PROPERTY);
final boolean verifyFindings = isVerifiedConfigured(project);
try {
final DefectDojoClient client = new DefectDojoClient(this, new URL(defectDojoUrl.getPropertyValue()));
if (isReimportConfigured(project) || globalReimportEnabled) {
final ArrayList<String> testsIds = client.getDojoTestIds(apiKey.getPropertyValue(), engagementId.getPropertyValue());
final String testId = client.getDojoTestId(engagementId.getPropertyValue(), testsIds);
LOGGER.debug("Found existing test Id: " + testId);
if (testId.equals("")) {
client.uploadDependencyTrackFindings(apiKey.getPropertyValue(), engagementId.getPropertyValue(), payload);
client.uploadDependencyTrackFindings(apiKey.getPropertyValue(), engagementId.getPropertyValue(), payload, verifyFindings);
} else {
client.reimportDependencyTrackFindings(apiKey.getPropertyValue(), engagementId.getPropertyValue(), payload, testId, isDoNotReactivateConfigured(project));
client.reimportDependencyTrackFindings(apiKey.getPropertyValue(), engagementId.getPropertyValue(), payload, testId, isDoNotReactivateConfigured(project), verifyFindings);
}
} else {
client.uploadDependencyTrackFindings(apiKey.getPropertyValue(), engagementId.getPropertyValue(), payload);
client.uploadDependencyTrackFindings(apiKey.getPropertyValue(), engagementId.getPropertyValue(), payload, verifyFindings);
}
} catch (Exception e) {
LOGGER.error("An error occurred attempting to upload findings to DefectDojo", e);
handleException(LOGGER, e);
}
}
}
}

0 comments on commit 80a5770

Please sign in to comment.