diff --git a/dojo/tools/yarn_audit/parser.py b/dojo/tools/yarn_audit/parser.py index a4feda6c46..b1670a0a7b 100644 --- a/dojo/tools/yarn_audit/parser.py +++ b/dojo/tools/yarn_audit/parser.py @@ -85,7 +85,6 @@ def get_items_auditci(self, tree, test): # https://github.com/DefectDojo/django test=test, severity=self.severitytranslator(severity=tree.get("advisories").get(element).get("severity")), description=description, - cve=tree.get("advisories").get(element).get("cves")[0], mitigation=tree.get("advisories").get(element).get("recommendation"), references=url + "\n" + references, component_name=tree.get("advisories").get(element).get("module_name"), @@ -98,6 +97,10 @@ def get_items_auditci(self, tree, test): # https://github.com/DefectDojo/django static_finding=True, dynamic_finding=False, ) + if tree.get("advisories").get(element).get("cves") != []: + dojo_finding.unsaved_vulnerability_ids = list() + for cve in tree.get("advisories").get(element).get("cves"): + dojo_finding.unsaved_vulnerability_ids.append(cve) if tree.get("advisories").get(element).get("cwe") != []: dojo_finding.cwe = tree.get("advisories").get(element).get("cwe")[0].strip("CWE-") items.append(dojo_finding) diff --git a/unittests/tools/test_yarn_audit_parser.py b/unittests/tools/test_yarn_audit_parser.py index b3237210c0..b97b7daacf 100644 --- a/unittests/tools/test_yarn_audit_parser.py +++ b/unittests/tools/test_yarn_audit_parser.py @@ -59,6 +59,8 @@ def test_yarn_audit_parser_with_multiple_cwes_per_finding_list(self): self.assertEqual(2, len(findings)) self.assertEqual(findings[0].cwe, 918) self.assertEqual(findings[1].cwe, 1035) + self.assertEqual(findings[1].cve, None) + self.assertEqual(findings[1].unsaved_vulnerability_ids[0], "CVE-2021-3807") def test_yarn_audit_parser_empty_with_error(self): with self.assertRaises(ValueError) as context: @@ -76,3 +78,5 @@ def test_yarn_audit_parser_issue_6495(self): findings = parser.get_findings(testfile, self.get_test()) self.assertEqual(3, len(findings)) self.assertEqual(findings[0].cwe, "1321") + self.assertEqual(findings[1].unsaved_vulnerability_ids[0], "CVE-2022-25851") + self.assertEqual(findings[1].cve, None)