Concept: False positive handling

[de-jcup]

We will create an asciidoc file for the concept sechub-doc/src/docs/asciidoc/documents/shared/concepts/false-postitive-handling/false-postitive-handling.adoc

At the moment false positive handling must be done inside the security products

But what happens when somebody switches products or does use two products for same purpose ? => You got false positives again.

Code scan

Mark false positives in code by developers

One thing how this could be handled very smooth by developers could be a single line comment option before the false positive // NOSECHUB:${identifier} E.g. Having a medium finding like:

"description": "\n<br>Location:java/com/daimler/sechub/docgen/AsciidocGenerator.java - line:28, column:35\\n<br>For details... "name": "Absolute Path Traversal",

A developer could add a comment before ala // NOSECHUB:Absolute Path Traversal

SecHub would let use scan results from products, but filter the corresponding findings, by mapping with the found NOSECHUB lines.

This has the benefit, that when developers refactor their code and the method comes up at another position or even at another file the false/positive handling would be still working!

Web scan

1. REST service with filter option for URL + Vulnerability
2. later: Web UI - using 1.

Infra scan

TBD

[de-jcup]

Concept of Analyzer Application

• Own application (e.g. kubernetes POD)
• Fetches source zip file from storage stream (+ maybe unzipping) to local file for application (e.g. container file system)
• inspect sources
• delete zip file after

[de-jcup]

Additional fields in report

• count of marked false positives

[de-jcup]

Idea: using of #204 product delegation server for the REST api, calling mechanism etc.

sechub-analyzer-cli is the cli part which will introspect zip file content and return json result created issue for cli analyzer https://github.com/Daimler/sechub/issues/206

[de-jcup]

We will create an asciidoc file for the concept sechub-doc/src/docs/asciidoc/documents/shared/concepts/false-postitive-handling/false-postitive-handling.adoc

[de-jcup]

Last commit, generated diagram look like this:

[de-jcup]

API centric concept parts can be now read at https://github.com/Daimler/sechub/blob/feature-23-concept-false-positive-handling/sechub-doc/src/docs/asciidoc/documents/shared/concepts/false-positive-handling/false-positive-handling.adoc

JSON example: https://github.com/Daimler/sechub/blob/feature-23-concept-false-positive-handling/sechub-doc/src/docs/asciidoc/documents/shared/concepts/false-positive-handling/false-positive-REST-API-content-example1.json