Mend SCA imports contain locations which are similar to filePaths for SAST scans

[testaccount90009]

This code will use the 'locations' for SCA scan outputs to do the same thing that's done for SAST 'filePaths'. Since a Finding report will either be from SAST or SCA, it is unlikely that a collision will happen, since those findings are inherently different from Mend. Since the filepaths is already being joined for the SAST implementation, if it is indeed SCA results instead, the same thing will happen except now with the appropriate locations of the library and vulnerability.

Note: this is not from Mend Platform or the CLI Agent output, but rather the Mend SCA portal. There is a new Platform API that combines both SAST and SCA vulnerabilities, so a new parser at some point for that would be good, and then it's possible to rename this to 'Legacy' for the Mend parser, since the 'Platform' should be the new.

Test results

I've added a scrubbed sample file and unit test.

Documentation

I can update the respective documentation with regards to these changes.

[dryrunsecurity]

DryRun Security Summary

The provided code changes address several security-related improvements to the application's security scanning and vulnerability reporting capabilities, including the introduction of a new JSON file containing information about a security vulnerability, improvements to the parsing and deduplication logic in the dojo/tools/mend/parser.py file, and the addition of a new unit test case to verify the parsing of a Mend scan report that includes a Software Composition Analysis (SCA) vulnerability finding.

Expand for full summary

Summary:

The provided code changes address several security-related improvements to the application's security scanning and vulnerability reporting capabilities.

The first change introduces a new JSON file containing information about a security vulnerability found in the commons-codec-1.6.jar library. The vulnerability is classified as a medium-severity "Improper Input Validation" issue that can lead to information disclosure. The recommended fix is to upgrade the library to version 1.13, which resolves the vulnerability.

The second change improves the parsing and deduplication logic in the dojo/tools/mend/parser.py file. The new changes ensure that the parser can correctly extract file path information from the "locations" field in the Mend scan report, and it introduces a deduplication mechanism to prevent the same vulnerability from being reported multiple times. These improvements enhance the accuracy and usefulness of the vulnerability reports generated by the application security tool.

The third change introduces a new unit test case to verify the parsing of a Mend scan report that includes a Software Composition Analysis (SCA) vulnerability finding. This helps to ensure the robustness and reliability of the MendParser class, which is crucial for maintaining the integrity of the security scanning process.

Files Changed:

1. unittests/scans/mend/mend_sca_vuln.json: This file contains details about a security vulnerability in the commons-codec-1.6.jar library, including the vulnerability name, severity, description, and the recommended fix.

2. dojo/tools/mend/parser.py: The changes in this file improve the parsing and deduplication logic in the _build_common_output function, which is responsible for generating findings from the Mend scan report. The new changes ensure that file path information is correctly extracted and that duplicate findings are removed.

3. unittests/tools/test_mend_parser.py: This file contains a new test case, test_parse_file_with_one_sca_vuln_finding, which verifies that the MendParser class can correctly parse a Mend scan report that includes a Software Composition Analysis (SCA) vulnerability finding.

Code Analysis

We ran 9 analyzers against 3 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[testaccount90009]

The force push was to rebase my branch against upstream/dev, vs upstream/master, as I accidentally made my branch originally off of the master branch and not dev. Apologies.

[mtesauro]

Approved