search

DefectDojo / django-DefectDojo

DevSecOps, ASPM, Vulnerability Management. All on one platform.
https://defectdojo.com
BSD 3-Clause "New" or "Revised" License
3.61k stars 1.52k forks source link

Finding path and source code #9472

Open apxitekt0r opened 7 months ago

apxitekt0r commented 7 months ago

Hi everyone! Maybe I don't understand or don't know how but it will be great to unite the findings path of scan with the sour code uri method in impot scan in api.

Actually it works online with Engagements. But import-scan has a method for source code too in api. And for me, idea to rewrite the path in engagements or creating new engagement after scan looks like a bad way

For myself I can rewrite code but for others it will be nice to see this function in defectdojo.

manuel-sommer commented 7 months ago

@apxitekt0r, I don't really get what you want. Could you please write steps to reproduce the issue and what you would want to achieve? Maybe also a screenshot would help? Please be more precise, I can hardly follow your description.

apxitekt0r commented 7 months ago

@apxitekt0r, I don't really get what you want. Could you please write steps to reproduce the issue and what you would want to achieve? Maybe also a screenshot would help? Please be more precise, I can hardly follow your description.

I mean that.

Screenshot_20240204-023129~2.png

Screenshot_20240204-023208~2.png

Screenshot_20240204-023029.png

On screenshots you can see the repo source on engagements and import-scan (api function) but when you use source code uri in import-scan it doesn't work to create a link with -/blob/(tag/Brach) for imported test. It works only if you rewrite repo in engagements. I want to use function source code repo for test scan without rewrite repo in engagements.

manuel-sommer commented 7 months ago

Can you make a PR to fix this?

manuel-sommer commented 7 months ago

@quirinziessler fyi.

quirinziessler commented 7 months ago

The question is: Is this useful? In my eyes not. Engagements should reflect only one single repository. So I would rather suggest to remove the irritating repo uri input from the findings api then to passing it trough and overwrite the engagement setting. Why don't you just update/patch the engagement accordingly @apxitekt0r? Then if you click on a findings detail you will be redirected to the repo and finding location.

apxitekt0r commented 7 months ago

The question is: Is this useful? In my eyes not. Engagements should reflect only one single repository. So I would rather suggest to remove the irritating repo uri input from the findings api then to passing it trough and overwrite the engagement setting. Why don't you just update/patch the engagement accordingly @apxitekt0r? Then if you click on a findings detail you will be redirected to the repo and finding location.

In my vision if I rewrite a repo path for old findings, url source code of finding changes too. But sometimes I need to compare old and new tags, for example. And for this I need to create new engagement for every new scans. Also scans use branch/tag but I can't use it for url in finding path without rewrite engagement repo. And I can't to push tickets to Jira with tags from scans, just from engagements.

apxitekt0r commented 6 months ago

Is it possible to change code and work logic?

manuel-sommer commented 6 months ago

Sure, can you do a PR to improve the functionality?

apxitekt0r commented 6 months ago

I haven't rewrite code yet to try PR.

manuel-sommer commented 6 months ago

Maybe the PR will also be interesting for @quirinziessler

manuel-sommer commented 6 months ago

But I guess you should make up your mind if you do the PR to really advance / improve the already existing feature. Otherwise, it might not get merged. I haven't used this feature yet, so I can't really judge on this.