Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(engine_dast): new dast scanning engine. #140

Open
wants to merge 562 commits into
base: trunk
Choose a base branch
from
Open

feat(engine_dast): new dast scanning engine. #140

wants to merge 562 commits into from

Conversation

russbelln
Copy link
Collaborator

@russbelln russbelln commented May 7, 2024 •
edited
Loading

Description

  • Add new dast scanning engine
  • Add the Nuclei tool as driven adapter of the new engine

Checklist:

  • The pull request is complete according to the guide of contributing of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my feature, policy, or fix is effective and works
  • New and existing tests pass locally with my changes

@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security[bot]
github-advanced-security bot found potential problems May 17, 2024
View reviewed changes
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Fixed Show fixed Hide fixed
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Fixed Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Fixed Show fixed Hide fixed
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Fixed Show fixed Hide fixed
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Fixed Show fixed Hide fixed
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Fixed Show fixed Hide fixed
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ C)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

@russbelln russbelln changed the title Feature/engine dast nu feat(engine dast) Sep 5, 2024
@russbelln russbelln changed the title feat(engine dast) feat(engine dast): new dast scanning engine Sep 5, 2024
@russbelln russbelln changed the title feat(engine dast): new dast scanning engine feat(engine_dast): new dast scanning engine Sep 5, 2024
@russbelln russbelln changed the title feat(engine_dast): new dast scanning engine feat(engine_dast): new dast scanning engine. Sep 5, 2024
Gaviria9601
Gaviria9601 reviewed Sep 24, 2024
View reviewed changes
Copy link
Contributor

@Gaviria9601 Gaviria9601 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Review the comments
  • update example_remote_config_local engine_core with ENGINE_DAST config
  • remove .gitkeeps
  • Review the security issues sonarcloud
  • update version tools/devsecops_engine_tools/version.py
  • Please, finish the PR the checks

example_remote_config_local/engine_dast/ConfigTool.json Outdated Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/domain/model/config_tool.py Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/domain/model/config_tool.py Outdated Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/domain/model/config_tool.py Outdated Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/domain/model/config_tool.py Outdated Show resolved Hide resolved
.../devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_tool.py Outdated Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Outdated Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py Show resolved Hide resolved
...devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/oauth/generic_oauth.py Outdated Show resolved Hide resolved
tools/devsecops_engine_tools/engine_dast/src/infrastructure/helpers/url_validator.py Outdated Show resolved Hide resolved
octaviovg
octaviovg reviewed Sep 25, 2024
View reviewed changes
tools/requirements.txt Outdated Show resolved Hide resolved
octaviovg
octaviovg requested changes Sep 27, 2024
View reviewed changes
Copy link
Contributor

@octaviovg octaviovg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validate comments

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

ssantaa9 and others added 26 commits January 14, 2025 13:13
@ssantaa9
style(engine_core): 📝 apply black to defect dojo driven adapter
68325e7
@ssantaa9
Merge pull request #290 from bancolombia/feature/fix_create_exclusion
f3ee009 
fix(engine_core): fix create exclusion particular cases
upgrade version to 1.30.2 version [skip ci]
73b94f9
@app-toolkit-opensource-innersource @juancgalvis
fix(deps): update dependencies (#258)
281e10d 
* fix(deps): update dependencies

* fix(deprecated): Update deprecated method usages

---------

Co-authored-by: juancgalvis <[email protected]>
upgrade version to 1.7.0 version [skip ci]
77bbe8b
@jcamilomolinar
fix(gitleaks): pr comments and sonar issues
060b239
@jcamilomolinar
Merge branch 'trunk' of https://github.com/bancolombia/devsecops-engi…
af48336 
…ne-tools into feature/gitleaks
@jcamilomolinar
fix(gitleaks): reduce run tool complexity for sonar
7182388
@Gaviria9601
feat: 🚀 handle finding exclusion - white_list
dfac9fa
@Gaviria9601
fix conflicts
60ca9fe
@Gaviria9601
deploy dev
bb08b18
@jcamilomolinar
deploy dev
a1b2e77
@Gaviria9601
rollback version
a22e038
@Gaviria9601
fix bug date format - deploy dev
6bb8c8f
@Gaviria9601
fix error import scan - deploy dev
4fa6958
@Gaviria9601
ready to merge
4ceeb7f
@Gaviria9601
Merge pull request #291 from bancolombia/feature/white_list
e6d3f62 
feat(engine_core): 🚀 handle finding exclusion - white_list
upgrade version to 1.31.0 version [skip ci]
0b659cf
@jcamilomolinar
Merge branch 'trunk' of https://github.com/bancolombia/devsecops-engi…
b9236c9 
…ne-tools into feature/gitleaks
@jcamilomolinar
Merge pull request #284 from bancolombia/feature/gitleaks
ab9154d 
feat(engine_secret): new gitleaks driven adapter
upgrade version to 1.32.0 version [skip ci]
1193c6b
@cajlopezor
fix(engine_secret): download custom rules if enabled
d8ec5f9
@cajlopezor
Merge pull request #293 from bancolombia/fix/engine_secret
70d292c 
fix(engine_secret): download custom rules if enabled
upgrade version to 1.32.1 version [skip ci]
546186c
@jcamilomolinar
Merge branch 'feature/engine_dast_nu' of https://github.com/bancolomb…
b97fb4c 
…ia/devsecops-engine-tools into feature/engine_dast_nu
@jcamilomolinar
fix: handle failed test and conflicts
37db2fc
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
65.9% Coverage on New Code (required ≥ 70.0%)

See analysis details on SonarQube Cloud

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Gaviria9601 Gaviria9601 Gaviria9601 left review comments

@octaviovg octaviovg octaviovg requested changes

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@russbelln @Gaviria9601 @octaviovg @jcamilomolinar @ssantaa9 @sarbole @GeorgeLBS1 @dhfherna @cajlopezor @MikeHV14