mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.
https://mercedes-benz.github.io/sechub/
MIT License
259 stars 61 forks source link

Fetch false positive configuration of project #240

Closed de-jcup closed 4 years ago

de-jcup commented 4 years ago

Usecase: As a user I want to see my existing false positive entries for my project

Restriction: user has access to project

After #234 is done, we need also a possiblity to see current false-positive configuration of project


Albert Tregnaghi albert.tregnaghi@daimler.com, Daimler TSS GmbH, imprint

de-jcup commented 4 years ago

An example output:

{
    "falsePositives": [
        {
            "jobData": {
                "jobUUID": "11e923c0-fa89-49bb-88bb-e3a0e1a4ff96",
                "findingId": 1
            },
            "author": "scenario3_user1",
            "metaData": {
                "scanType": "codeScan",
                "name": "Absolute Path Traversal",
                "severity": "MEDIUM",
                "code": {
                    "start": {
                        "location": "java/com/daimler/sechub/docgen/AsciidocGenerator.java",
                        "relevantPart": "args",
                        "sourceCode": "\tpublic static void main(String[] args) throws Exception {"
                    },
                    "end": {
                        "location": "java/com/daimler/sechub/docgen/AsciidocGenerator.java",
                        "relevantPart": "File",
                        "sourceCode": "\t\tFile documentsGenFolder = new File(path);"
                    }
                },
                "cweId": 36
            },
            "created": "2020-06-12 09:17:16"
        }
    ]
}