fortify-ps / FortifyBugTrackerUtility

Automated submission of FoD and SSC vulnerabilities to external systems
MIT License
25 stars 14 forks source link

Added custom header to allow access to integration fields #75

Closed kadraman closed 6 months ago

kadraman commented 7 months ago

I found out that the native FoD Octane/ValueEdge BugTracker integration doesn’t work – will be fixed in 24.4!!! Reason for this is it sets two custom fields Octane R&D added “category” and “item_origin” (which are set to “Security” and “Fortify” on bug creation) – API users don’t have access to these fields without setting a custom HTTP Header. This commit includes the setting of this custom header as well as updates to FoDToOctane.xml to make use of the fields.

rsenden commented 6 months ago

Hi Kevin, thanks for the PR. Before merging, just a quick question about the fields you've added to the Octane configuration file, especially since the comments mention that these fields might not be available on all Octane instances. Should we enable these fields by default, or comment them out by default so users can easily uncomment if they do have these fields.

Ideally, users should review the configuration before trying to run the integration, so in that sense it shouldn't matter, but many users will likely use the default configuration file when testing the utility for the first time. If they then encounter errors due to their Octane instance not having those fields (I don't remember whether the utility removes any unsupported fields), they may just give up rather than adjusting the configuration file.