forked from fortify/FortifyVulnerabilityExporter
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: Update GitLab schema version to 15.0.0 (fixes fortify#51)
feat: Add Debricked support for GitLab SCA Import (implements fortify#52 for GitLab)
- Loading branch information
Showing
8 changed files
with
134 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
63 changes: 63 additions & 0 deletions
63
...lityExporter-plugin-to-json/src/main/resources/pluginConfig/json-gitlab-ssc-debricked.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| --- | ||
| spring.config.activate.on-loader-plugin: ssc | ||
|
|
||
| json.gitlab.debricked.filter.expr: vuln.engineType=='DEBRICKED' | ||
| json.gitlab.debricked.format: | ||
| fields: | ||
| schema: https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.0/dist/dependency-scanning-report-format.json | ||
| version: 15.0.0 | ||
| scan: | ||
| start_time: $[#formatDateTime("yyyy-MM-dd'T'HH:mm:ss", applicationVersion.currentDebrickedScan?.uploadDate?:'1970-01-01T00:00:00')] | ||
| end_time: $[#formatDateTime("yyyy-MM-dd'T'HH:mm:ss", applicationVersion.currentDebrickedScan?.uploadDate?:'1970-01-01T00:00:00')] | ||
| status: success | ||
| type: dependency_scanning | ||
| analyzer: | ||
| id: fortify-debricked | ||
| name: Fortify/Debricked | ||
| url: https://www.microfocus.com/en-us/products/application-security-testing/overview | ||
| version: Debricked Fortify Parser Plugin $[applicationVersion.currentDebrickedScan?.engineVersion?:'version unknown'] | ||
| vendor: | ||
| name: Fortify+Debricked | ||
| scanner: | ||
| id: fortify-debricked | ||
| name: Fortify/Debricked | ||
| url: https://www.microfocus.com/en-us/products/application-security-testing/overview | ||
| version: Debricked Fortify Parser Plugin $[applicationVersion.currentDebrickedScan?.engineVersion?:'version unknown'] | ||
| vendor: | ||
| name: Fortify+Debricked | ||
| dependency_files: $[{}] | ||
| vulnerabilities: $[vulnerabilityMappers.vulnerability.get()] | ||
| vulnerabilityMappers.vulnerability.fields: | ||
| id: $[vuln.issueInstanceId] | ||
| category: dependency_scanning | ||
| name: $[vuln.issueName] | ||
| message: $[vuln.issueName] | ||
| description: $[#abbreviate(#htmlToText(vuln.details?.brief), 15000)] | ||
| cve: $[vuln.details?.customAttributes?.externalId] | ||
| severity: $[vuln.friority] | ||
| confidence: $[(vuln.friority matches "(Critical|Medium)") ? "High":"Low" ] | ||
| scanner: | ||
| id: fortify-debricked | ||
| name: Fortify/Debricked | ||
| identifiers: | ||
| - name: "Instance id: $[vuln.issueInstanceId]" | ||
| type: issueInstanceId | ||
| value: $[vuln.issueInstanceId] | ||
| url: $[vuln.deepLink] | ||
| links: | ||
| - name: Additional issue details, including analysis trace, in Software Security Center | ||
| url: $[vuln.deepLink] | ||
| - name: CWE URL | ||
| url: $[vuln.details?.customAttributes?.externalUrl] | ||
| location: | ||
| file: $[vuln.fullFileName] | ||
| dependency: | ||
| package: | ||
| name: $[vuln.details?.customAttributes?.componentName] | ||
| version: $[vuln.details?.customAttributes?.componentVersion] | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # See FortifyVulnerabilityExporter documentation for SSC connection settings and application version selection | ||
|
|
||
| export: | ||
| from: ssc | ||
| to: json.gitlab.debricked | ||
|
|
||
| ssc: | ||
| version: | ||
| embed: | ||
| - subEntity: currentDebrickedScan | ||
| onError: LOG_INFO | ||
| vulnerability: | ||
| filterParam: ISSUE[11111111-1111-1111-1111-111111111151]:DEBRICKED # Have SSC return only Debricked issues | ||
| embed: # Also load details as required for GitLab output | ||
| - subEntity: details | ||
|
|
||
| export.dir: ${CI_PROJECT_DIR:${export.default.dir}} # Unless overridden, use CI_PROJECT_DIR if defined, otherwise default export dir | ||
| json.gitlab.debricked.output: | ||
| stdout: false # Disabled by default to avoid vulnerability data being exposed through log files | ||
| pretty: true # Useful for debugging, disable for optimal performance | ||
| file: ${export.dir}/gl-fortify-depscan.json # Output file | ||
|
|