diff --git a/docs/content/supported_tools/parsers/file/generic.md b/docs/content/supported_tools/parsers/file/generic.md index edef7d948dc..33374a11dc2 100644 --- a/docs/content/supported_tools/parsers/file/generic.md +++ b/docs/content/supported_tools/parsers/file/generic.md @@ -48,6 +48,7 @@ The list of supported fields in JSON format: - date: Date - cwe: Int - cve: String +- vulnerability_ids: List of Strings - epss_score: Float - epss_percentile: Float - cvssv3: String @@ -120,6 +121,7 @@ The list of supported fields in JSON format: "kev_date": "2024-05-01", "file_path": "src/first.cpp", "line": 13, + "vulnerability_ids": ["GHSA-5mrr-rgp6-x4gr", "OSV-2021-1234"], "endpoints": [ { "host": "exemple.com" diff --git a/dojo/tools/generic/json_parser.py b/dojo/tools/generic/json_parser.py index c177db5fc58..436bc6ad819 100644 --- a/dojo/tools/generic/json_parser.py +++ b/dojo/tools/generic/json_parser.py @@ -168,13 +168,15 @@ def _get_test_json(self, data): if finding.cve: finding.unsaved_vulnerability_ids = [finding.cve] if unsaved_vulnerability_ids: + if isinstance(unsaved_vulnerability_ids, str): + unsaved_vulnerability_ids = [unsaved_vulnerability_ids] if finding.unsaved_vulnerability_ids: - finding.unsaved_vulnerability_ids.append( + finding.unsaved_vulnerability_ids.extend( unsaved_vulnerability_ids, ) else: - finding.unsaved_vulnerability_ids = ( - unsaved_vulnerability_ids + finding.unsaved_vulnerability_ids = list( + unsaved_vulnerability_ids, ) test_internal.findings.append(finding) return test_internal diff --git a/unittests/scans/generic/generic_cve_and_vulnerability_ids.json b/unittests/scans/generic/generic_cve_and_vulnerability_ids.json new file mode 100644 index 00000000000..b17158ed98d --- /dev/null +++ b/unittests/scans/generic/generic_cve_and_vulnerability_ids.json @@ -0,0 +1,9 @@ +{ + "findings": [{ + "title": "Test CVE + Vuln IDs", + "severity": "High", + "description": "Test description", + "cve": "CVE-2020-36234", + "vulnerability_ids": ["GHSA-5mrr-rgp6-x4gr", "OSV-2021-1234"] + }] +} \ No newline at end of file diff --git a/unittests/tools/test_generic_parser.py b/unittests/tools/test_generic_parser.py index 441c669ff62..9eec9198047 100644 --- a/unittests/tools/test_generic_parser.py +++ b/unittests/tools/test_generic_parser.py @@ -716,3 +716,17 @@ def test_parse_csv_with_fix_version(self): finding = findings[1] self.assertEqual("Test finding without fix_version", finding.title) + + def test_parse_json_with_cve_and_vulnerability_ids(self): + with (get_unit_tests_scans_path("generic") / "generic_cve_and_vulnerability_ids.json").open(encoding="utf-8") as file: + parser = GenericParser() + findings = parser.get_findings(file, Test()) + self.validate_locations(findings) + self.assertEqual(1, len(findings)) + finding = findings[0] + self.assertEqual(3, len(finding.unsaved_vulnerability_ids)) + self.assertEqual("CVE-2020-36234", finding.unsaved_vulnerability_ids[0]) + self.assertEqual("GHSA-5mrr-rgp6-x4gr", finding.unsaved_vulnerability_ids[1]) + self.assertEqual("OSV-2021-1234", finding.unsaved_vulnerability_ids[2]) + for vid in finding.unsaved_vulnerability_ids: + self.assertIsInstance(vid, str)