search

fortify / FortifyVulnerabilityExporter

Export Fortify vulnerability data to GitHub, GitLab, SonarQube and more
Other
24 stars 8 forks source link

Gitlab report not parsing properly #43

Closed telliad23 closed 2 years ago

telliad23 commented 2 years ago

Hi,

I am using the fortifydocker/fortify-ci-tools:latest which contains v1.5.5 FortifyVulnerabilityExporter.

Even though the CI logs seems fine and a gitlab artifact is successfully generated (gl-dast.json), I see the following issue in the security tab of the Gitlab pipeline. It seems like the json file is not parsed successfully. image

Here is the zip file containing the DAST artifact. Do let me know if you require more info. Thanks gl-dast-report.json.zip

rsenden commented 2 years ago

Hi, thanks for reporting this. According to the screenshot below, the sample file that you provided validates successfully against the GitLab DAST JSON schema, so I'm not sure why you are getting this error. Without further details on why the parsing is failing, I won't be able to investigate this further and/or provide a fix.

Can you please report this issue to GitLab, to have them investigate why parsing fails even though the artifact validates fine against the JSON schema? Based on their feedback, please let me know whether anything needs to be changed in FortifyBugTrackerUtility.

image

rsenden commented 2 years ago

After consultation with the GitLab team, various work-arounds have been implemented to allow GitLab reports to be ingested successfully.