Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance OSV Parser to Include Mitigation Information with Fixed Package Versions #11681

Open
wants to merge 9 commits into
base: dev
Choose a base branch
from
Open

Enhance OSV Parser to Include Mitigation Information with Fixed Package Versions #11681

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e0b5968
Introducing a mechanism to extract and include mitigation information…
Jan 28, 2025
87b65eb
Merge branch 'DefectDojo:dev' into dev
4b75726169736859 Jan 29, 2025
35e3cc0
Removing empty lines at the end of the file
Jan 29, 2025
9f7a589
Update unittest test_osv_scanner_parser script
Jan 29, 2025
9c964e3
Update unittest test_osv_scanner_parser script
Jan 29, 2025
f4f48a4
Add new empty line to parser
Jan 30, 2025
22f5666
Merge branch 'DefectDojo:dev' into dev
4b75726169736859 Jan 30, 2025
0725654
Add empty line at end file
4b75726169736859 Jan 30, 2025
4dcf71a
Update parser.py
4b75726169736859 Jan 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion dojo/tools/osv_scanner/parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
vulnerabilitydetails = vulnerability.get("details", "")
vulnerabilitypackagepurl = ""
cwe = None
mitigation = None
# Make sure we have an affected section to work with
if (affected := vulnerability.get("affected")) is not None:
if len(affected) > 0:
Expand All @@ -46,16 +47,23 @@
# Extract the CWE
if (cwe := affected[0].get("database_specific", {}).get("cwes", None)) is not None:
cwe = cwe[0]["cweId"]
# Extract fixed version
ranges = affected[0].get("ranges", [])
for range_item in ranges:
for event in range_item.get("events", []):
if "fixed" in event:
mitigation = f"Upgrade to version: {event['fixed']}"
# Create some references
reference = ""
for ref in vulnerability.get("references"):
for ref in vulnerability.get("references", []):
reference += ref.get("url") + "\n"
# Define the description
description = vulnerabilitysummary + "\n"
description += "**source_type**: " + source_type + "\n"
description += "**package_ecosystem**: " + package_ecosystem + "\n"
description += "**vulnerabilitydetails**: " + vulnerabilitydetails + "\n"
description += "**vulnerabilitypackagepurl**: " + vulnerabilitypackagepurl + "\n"

sev = vulnerability.get("database_specific", {}).get("severity", "")
finding = Finding(
title=vulnerabilityid + "_" + package_name,
Expand All @@ -70,8 +78,11 @@
file_path=source_path,
references=reference,
)
if mitigation:
4b75726169736859 marked this conversation as resolved.
Show resolved Hide resolved
finding.mitigation = mitigation
4b75726169736859 marked this conversation as resolved.
Show resolved Hide resolved
if vulnerabilityid != "":
finding.unsaved_vulnerability_ids = []
finding.unsaved_vulnerability_ids.append(vulnerabilityid)
findings.append(finding)
return findings

Check failure on line 88 in dojo/tools/osv_scanner/parser.py

View workflow job for this annotation

GitHub Actions / ruff-linting

Ruff (W293) 

dojo/tools/osv_scanner/parser.py:88:1: W293 Blank line contains whitespace
1 change: 1 addition & 0 deletions unittests/tools/test_osv_scanner_parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,4 @@ def test_many_findings(self):
finding = findings[17]
self.assertEqual(finding.references, "https://nvd.nist.gov/vuln/detail/CVE-2021-45115\nhttps://docs.djangoproject.com/en/4.0/releases/security\nhttps://github.com/django/django\nhttps://groups.google.com/forum/#!forum/django-announce\nhttps://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV\nhttps://security.netapp.com/advisory/ntap-20220121-0005\nhttps://www.djangoproject.com/weblog/2022/jan/04/security-releases\n")
self.assertEqual(finding.title, "GHSA-53qw-q765-4fww_django")
self.assertEqual(finding.mitigation, "Upgrade to version: 2.2.26")
Loading