fortify / FortifyVulnerabilityExporter

Export Fortify vulnerability data to GitHub, GitLab, SonarQube and more
Other
24 stars 8 forks source link

Reconsider ability to process all releases for matching app(s) when using `fod.release.name`/`ssc.version.name` properties #71

Open rsenden opened 12 months ago

rsenden commented 12 months ago

See #70 for background information. Potentially, we should reconsider the ability to process multiple versions/releases if release/version name is omitted from fod.release.name/ssc.version.name properties. If users want to process all releases/versions for a given application (or multiple applications), they can use the fod.release.regex/ssc.version.regex properties instead to perform wildcard matching.

Related to this, when querying FoD for app/release name, FoD uses case-insensitive 'contains' matching instead of exact matching. For example, when querying FoD for 'App', FoD will return App, My app, APP2, ... This is usually not what users expect, and is inconsistent with SSC behavior (which uses exact matching). We should probably fix/enhance fortify-client-api to add (optional) support for performing client-side exact matching on the results returned by FoD.