mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.

https://mercedes-benz.github.io/sechub/

MIT License

263 stars 63 forks source link

Integrate PDS into SecHub #424

Closed de-jcup closed 3 years ago

de-jcup commented 3 years ago

Situation

At the moment a product delegation server is not correct accessed by SecHub server.

Wanted

All configured (per profile+config) PDS instances

must be executed in job
must have parameters inside as defined in config
must be used for webscan, infrascan, codescan as being defined in config (we need the possiblity to define type at executor configuration and evaluate this!)

Additional

We have dedicated product identifiers for PDS representing the scan type: e.g. PDS_CODESCAN, PDS_WEBSCAN etc. so it is clear which kind of scan it is.
PDS executor(s) will be executable multiple times (for ONE config). Other executors will be executable onle once, even when having profiles containing multiple configurations for same executor (we will do a "first wins" approach + log warning)
Support credentails plain and also with "env:" approach were environment entries are used.

^{Albert Tregnaghi albert.tregnaghi@daimler.com, Daimler TSS GmbH, imprint}

de-jcup commented 3 years ago

Normally we do our integration tests with mocked adapters only. For PDS integration tests in Scenario5 there should be a real communication and no mock operation.

To have possiblity to test this, we change the existing mock adapter to be used by a DelegatingMockablePDSAdapterV1 which uses normally the real one , but when job parameter do contain key/value pair is set to "mocked=true" use mocked variant

de-jcup commented 3 years ago

With last commit PDS and SecHub do now work "hand in hand" - at least for the PDS Integration test server and SecHub integration test server.

We still need #386 and PDS instances providing sarif results to have a common interchange format. Any other format must be also implemented in Sereco which is still a little bit cumbersome, so the aim for the future should be to always use SARIF when #386 has been done.

What's currently still missing/todo inside this issue?

The pds integration bash script called by PDS should evaluate given data and give feedback: So we will write just some additional integration tests and improve the PDS bash script and test the parameter interchange as well.

There will be more to implement in PDS (e.g. #434 and much more like auto cancelation by sechub wenn sechub job has been canceled etc.) but this will be done in dedicated issues.

de-jcup commented 3 years ago

There is a little bug inside Developer admin ui: TestAPI calls do use super admin credentials from tests - shall use given ones.