search

SAP / credential-digger

A Github scanning tool that identifies hardcoded credentials while filtering the false positive data through machine learning models :lock:
Apache License 2.0
325 stars 49 forks source link

broken scans shown as completed in the UI #230

Open marcorosa opened 2 years ago

marcorosa commented 2 years ago

If a scan raises an error (either in the scanner, or models, or db), the discoveries are not inserted in the db, but the UI shows the scan as completed with 0 discoveries.

We should not show them as completed but as broken/error (and maybe with color-code red, not green neither yellow)

wassafshahzad commented 1 month ago

I would like to work on this

marcorosa commented 1 month ago

sure, thanks

wassafshahzad commented 1 month ago

@marcorosa I did some RnD on this issue and my findings are as follows. This error can occur in multiple cases but the case most severe in our scenario is, if the repo is inserted into the db and the discoveries are not. In that particular case, The get_repo api will succeed in getting the repos but their discoveries will be 0. In all other cases as long as the repo is not inserted in the db the get_repo apis return will fix the UI.

In our scenario, we need to save the state of the repository in the db or we can consider repos with default values for following attributes as failed and update the UI accordingly { "FP": 0, "TP": 0, "addressing": 0, "fixed": 0, "not_relevant": 0, "total": 0, }

wassafshahzad commented 1 month ago

@marcorosa Just need your go ahead before implementing