search

denimgroup / threadfix

ThreadFix is a software vulnerability management platform. This GitHub site is far out of date. Please go to www.threadfix.it for up-to-date information.
339 stars 127 forks source link

Unable to upload HPE WebInspect v16.10 scan or fpr files #1768

Open xolian opened 7 years ago

xolian commented 7 years ago

Unable to upload Webinspect scan version 16.10 or 16.20 from the web UI or from the RESTFul api. Both formats fpr and/or scan return errors of "Failed to determine the scan type". threadfixerror

`2016-10-04 14:32:02,775 [http-bio-8080-exec-1] DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository (HttpSessionSecurityContextRepository.java:171) - Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl@20a3103f: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@20a3103f: Principal: com.denimgroup.threadfix.service.ThreadFixUserDetails@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_CAN_GENERATE_REPORTS,ROLE_CAN_GENERATE_WAF_RULES,ROLE_CAN_MANAGE_API_KEYS,ROLE_CAN_MANAGE_APPLICATIONS,ROLE_CAN_MANAGE_CUSTOM_CWE_TEXT,ROLE_CAN_MANAGE_DEFECT_TRACKERS,ROLE_CAN_MANAGE_EMAIL_REPORTS,ROLE_CAN_MANAGE_GRC_TOOLS,ROLE_CAN_MANAGE_GROUPS,ROLE_CAN_MANAGE_POLICIES,ROLE_CAN_MANAGE_REMOTE_PROVIDERS,ROLE_CAN_MANAGE_SCAN_AGENTS,ROLE_CAN_MANAGE_SCAN_RESULT_FILTERS,ROLE_CAN_MANAGE_SYSTEM_SETTINGS,ROLE_CAN_MANAGE_TAGS,ROLE_CAN_MANAGE_TEAMS,ROLE_CAN_MANAGE_USERS,ROLE_CAN_MANAGE_VULN_FILTERS,ROLE_CAN_MANAGE_WAFS,ROLE_CAN_MODIFY_VULNERABILITIES,ROLE_CAN_SUBMIT_COMMENTS,ROLE_CAN_SUBMIT_DEFECTS,ROLE_CAN_UPLOAD_SCANS,ROLE_CAN_VIEW_ERROR_LOGS,ROLE_READ_ACCESS,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@ffffe21a: RemoteIpAddress: 10.7.150.47; SessionId: AB4FE2326C184AB45BB0CC9DD5584550; Granted Authorities: ROLE_CAN_GENERATE_REPORTS, ROLE_CAN_GENERATE_WAF_RULES, ROLE_CAN_MANAGE_API_KEYS, ROLE_CAN_MANAGE_APPLICATIONS, ROLE_CAN_MANAGE_CUSTOM_CWE_TEXT, ROLE_CAN_MANAGE_DEFECT_TRACKERS, ROLE_CAN_MANAGE_EMAIL_REPORTS, ROLE_CAN_MANAGE_GRC_TOOLS, ROLE_CAN_MANAGE_GROUPS, ROLE_CAN_MANAGE_POLICIES, ROLE_CAN_MANAGE_REMOTE_PROVIDERS, ROLE_CAN_MANAGE_SCAN_AGENTS, ROLE_CAN_MANAGE_SCAN_RESULT_FILTERS, ROLE_CAN_MANAGE_SYSTEM_SETTINGS, ROLE_CAN_MANAGE_TAGS, ROLE_CAN_MANAGE_TEAMS, ROLE_CAN_MANAGE_USERS, ROLE_CAN_MANAGE_VULN_FILTERS, ROLE_CAN_MANAGE_WAFS, ROLE_CAN_MODIFY_VULNERABILITIES, ROLE_CAN_SUBMIT_COMMENTS, ROLE_CAN_SUBMIT_DEFECTS, ROLE_CAN_UPLOAD_SCANS, ROLE_CAN_VIEW_ERROR_LOGS, ROLE_READ_ACCESS, ROLE_USER' 2016-10-04 14:32:02,877 [http-bio-8080-exec-1] INFO com.denimgroup.threadfix.webapp.controller.UploadScanController (UploadScanController.java:81) - Received REST request to upload a scan to application 1. 2016-10-04 14:32:02,934 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:55) - getScratchFile << tempFile 2016-10-04 14:32:02,935 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:76) - Got a valid scratch root from system properties. 2016-10-04 14:32:02,935 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:88) - getScratchFile >> /opt/tomcat/TFX_SCRATCH/tempFile 2016-10-04 14:32:02,936 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:55) - getScratchFile << tempFile 2016-10-04 14:32:02,937 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:76) - Got a valid scratch root from system properties. 2016-10-04 14:32:02,937 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:88) - getScratchFile >> /opt/tomcat/TFX_SCRATCH/tempFile 2016-10-04 14:32:02,937 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:55) - getScratchFile << tempFile 2016-10-04 14:32:02,938 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:76) - Got a valid scratch root from system properties. 2016-10-04 14:32:02,938 [http-bio-8080-exec-1] DEBUG com.denimgroup.threadfix.DiskUtils (DiskUtils.java:88) - getScratchFile >> /opt/tomcat/TFX_SCRATCH/tempFile

`

d-maldonado commented 7 years ago

xolian,

ThreadFix Community expects for WebInspect files to be imported in XML format. More info here.

That being said, In the latest version of ThreadFix Enterprise users can import WebInspect scans in the FPR format.

Daniel M

xolian commented 7 years ago

The xml format does not support Webinspect v16.10 or the latest (v16.20). The version supported v9.10 is circa 2014 release. Are there plans to release an up-to-date supported Webinspect version soon?