Dependency Track parser: Store DT uuid into unique_id_from_tool instead of vuln_id_from_tool#14346
Dependency Track parser: Store DT uuid into unique_id_from_tool instead of vuln_id_from_tool#14346AndreVirtimo wants to merge 1 commit intoDefectDojo:devfrom
Conversation
change default deduplication algorithm to DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE
github-actions
bot
added
settings_changes
Maffooch
left a comment
Maffooch
left a comment
There was a problem hiding this comment.
This is a good change, but I think we should also maintain the value of vuln_id_from_tool to accommodate folks who have customized the dedupe settings in their local_settings.py files. If the vuln_id_from_tool field is suddenly empty, any existing DT findings would not be matched again
| vulnerability_description += "\nVulnerability Description: {description}".format(description=dependency_track_finding["vulnerability"]["description"]) | ||
| if "uuid" in dependency_track_finding["vulnerability"] and dependency_track_finding["vulnerability"]["uuid"] is not None: | ||
| vuln_id_from_tool = dependency_track_finding["vulnerability"]["uuid"] | ||
| unique_id_from_tool = dependency_track_finding["vulnerability"]["uuid"] |
There was a problem hiding this comment.
| unique_id_from_tool = dependency_track_finding["vulnerability"]["uuid"] | |
| unique_id_from_tool = dependency_track_finding["vulnerability"]["uuid"] | |
| vuln_id_from_tool = dependency_track_finding["vulnerability"]["uuid"] |
| component_version=component_version, | ||
| file_path=file_path, | ||
| vuln_id_from_tool=vuln_id_from_tool, | ||
| unique_id_from_tool=unique_id_from_tool, |
There was a problem hiding this comment.
| unique_id_from_tool=unique_id_from_tool, | |
| unique_id_from_tool=unique_id_from_tool, | |
| vuln_id_from_tool=vuln_id_from_tool, |
| self.assertIsNone(findings[1].unsaved_vulnerability_ids) | ||
| self.assertEqual(1, len(findings[2].unsaved_vulnerability_ids)) | ||
| self.assertEqual("CVE-2016-2097", findings[2].unsaved_vulnerability_ids[0]) | ||
| self.assertEqual("900991f6-335a-49cb-9bf6-87b545f960ce", findings[2].unique_id_from_tool) |
There was a problem hiding this comment.
| self.assertEqual("900991f6-335a-49cb-9bf6-87b545f960ce", findings[2].unique_id_from_tool) | |
| self.assertEqual("900991f6-335a-49cb-9bf6-87b545f960ce", findings[2].unique_id_from_tool) | |
| self.assertEqual("900991f6-335a-49cb-9bf6-87b545f960ce", findings[2].vuln_id_from_tool) |
| self.assertEqual(12, len(findings)) | ||
| self.assertTrue(all(item.file_path is not None for item in findings)) | ||
| self.assertTrue(all(item.vuln_id_from_tool is not None for item in findings)) | ||
| self.assertTrue(all(item.unique_id_from_tool is not None for item in findings)) |
There was a problem hiding this comment.
| self.assertTrue(all(item.unique_id_from_tool is not None for item in findings)) | |
| self.assertTrue(all(item.unique_id_from_tool is not None for item in findings)) | |
| self.assertTrue(all(item.vuln_id_from_tool is not None for item in findings)) |
| self.assertEqual(12, len(findings)) | ||
| self.assertTrue(all(item.file_path is not None for item in findings)) | ||
| self.assertTrue(all(item.vuln_id_from_tool is not None for item in findings)) | ||
| self.assertTrue(all(item.unique_id_from_tool is not None for item in findings)) |
There was a problem hiding this comment.
| self.assertTrue(all(item.unique_id_from_tool is not None for item in findings)) | |
| self.assertTrue(all(item.unique_id_from_tool is not None for item in findings)) | |
| self.assertTrue(all(item.vuln_id_from_tool is not None for item in findings)) |
I don't agree. There is not deduplication algorithm which uses vuln_id_from_tool. The field description for vuln_id_from_tool is "Non-unique technical id from the source tool associated with the vulnerability type." which does not fit to the uuid from DT. |
valentijnscholten
changed the title
Users can customize the deduplication behaviour via the settings in settings.dist.py. If users have chosen In general I don't like |
|
@AndreVirtimo Do you have aliases enabled in your DT instance? The example vulnerabilities you provided on Slack seem to be aliases of eachother. Usually DT exports this in the report that is being sent to Dojo and Dojo will import all aliases as vulnerability_ids. This way both vulnerabilities should result in the same hash_code and become duplicates and work OK in reimports. |
3 participants
Store DT uuid into unique_id_from_tool instead of vuln_id_from_tool
change default deduplication algorithm to DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE
Fixing #14345