Skip to content

(feat) gosec parser: parse cwe_id and swap references if possible#14581

Open
maxi-bee wants to merge 4 commits intoDefectDojo:devfrom
maxi-bee:patch-2
Open

(feat) gosec parser: parse cwe_id and swap references if possible#14581
maxi-bee wants to merge 4 commits intoDefectDojo:devfrom
maxi-bee:patch-2

Conversation

@maxi-bee
Copy link
Contributor

⚠️ Pre-Approval check ⚠️

We don't want to waste your time, so if you're unsure whether your hypothetical enhancement meets the criteria for approval, please file an issue to get pre-approval before beginning work on a PR.
Learn more here: https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md#submission-pre-approval

Description

Adds to the gosec parser to further add information about the vulnerability found. This tool relied on a URL + RULE_ID to build the reference test, but this is broken, most links coming from it are not maintained and do not help developers. Because of this https://github.com/securego/gosec/releases/tag/v2.25.0 and some previous releases are now adding such CWE information

Test results

Added tests for testing this new data (Claude tested)

Documentation

Please update any documentation when needed in the documentation folder)

No need to update the above, but it should be expected that a new hash is created given that we are changing the CWE field

Checklist

This checklist is for your information.

  • Make sure to rebase your PR against the very latest dev.
  • Features/Changes should be submitted against the dev.
  • Bugfixes should be submitted against the bugfix branch.
  • Give a meaningful name to your PR, as it may end up being used in the release notes.
  • Your code is Ruff compliant (see ruff.toml).
  • Your code is python 3.13 compliant.
  • If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
  • Model changes must include the necessary migrations in the dojo/db_migrations folder.
  • Add applicable tests to the unit tests.
  • Add the proper label to categorize your PR.

Extra information

Please clear everything below when submitting your pull request, it's here purely for your information.

Moderators: Labels currently accepted for PRs:

  • Import Scans (for new scanners/importers)
  • enhancement
  • performance
  • feature
  • bugfix
  • maintenance (a.k.a chores)
  • dependencies
  • New Migration (when the PR introduces a DB migration)
  • settings_changes (when the PR introduces changes or new settings in settings.dist.py)

Contributors: Git Tips

Rebase on dev branch

If the dev branch has changed since you started working on it, please rebase your work after the current dev.

On your working branch mybranch:

git rebase dev mybranch

In case of conflict:

 git mergetool
 git rebase --continue

When everything's fine on your local branch, force push to your myOrigin remote:

git push myOrigin --force-with-lease

To cancel everything:

git rebase --abort

Squashing commits

git rebase -i origin/dev
  • Replace pick by fixup on the commits you want squashed out
  • Replace pick by reword on the first commit if you want to change the commit message
  • Save the file and quit your editor

Force push to your myOrigin remote:

git push myOrigin --force-with-lease

- changes the parser to take on CWE data when available
- falls back to hardcoded url + rule_id when the above isn't present (latest gosec versions)
@maxi-bee
Copy link
Contributor Author

@valentijnscholten @Maffooch FYI

Copy link
Member

@valentijnscholten valentijnscholten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR and updated unit tests! One small comment posted above.

@valentijnscholten valentijnscholten changed the title updates gosec parser and unittest data and script (feat) gosec parser: parse cwe field Mar 23, 2026
@valentijnscholten valentijnscholten changed the title (feat) gosec parser: parse cwe field (feat) gosec parser: parse cwe and rule_id field Mar 23, 2026
- Added a protection on the cwe_id assignment via the integer convertion from string
@maxi-bee maxi-bee changed the title (feat) gosec parser: parse cwe and rule_id field (feat) gosec parser: parse cwe_id and swap references if possible Mar 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants