🎉 All Trivy Operator findings in one json

[manuel-sommer]

No description provided.

[dryrunsecurity]

DryRun Security Summary

The pull request improves the test coverage and flexibility of the TrivyOperatorParser class, which parses the output of the Trivy Operator security scanning tool, without introducing any security vulnerabilities, and enhances the reliability and robustness of the parser.

Expand for full summary

Summary:

The changes in this pull request focus on improving the test coverage and flexibility of the TrivyOperatorParser class, which is responsible for parsing the output of the Trivy Operator security scanning tool. The changes do not introduce any security vulnerabilities, but instead aim to enhance the reliability and robustness of the parser.

The key changes include:

1. Adding a new test case to verify the parser's ability to handle a JSON file containing all types of Trivy Operator reports (configuration audit, vulnerability, and exposed secret).
2. Enhancing the get_findings() method of the TrivyOperatorParser class to better handle different data structures returned by the Trivy Operator scan report.

These changes are positive from an application security perspective, as they help ensure that the parser can correctly process and extract the relevant security findings from the Trivy Operator scan reports, regardless of the format.

Files Changed:

1. unittests/tools/test_trivy_operator_parser.py: This file has been updated to include a new test case, test_findings_all_reports_in_dict, which verifies the behavior of the TrivyOperatorParser class when parsing a JSON file containing all types of Trivy Operator reports.

2. dojo/tools/trivy_operator/parser.py: The changes in this file focus on improving the get_findings() method of the TrivyOperatorParser class. The method now checks if the data object is a dictionary and if it contains specific keys related to different Trivy Operator report types. This helps the parser handle various data structures returned by the Trivy Operator scan report.

3. unittests/scans/trivy_operator/all_reports_in_dict.json: This file appears to be a sample Trivy Operator scan report that contains configuration audit, exposed secret, and vulnerability findings. The report highlights several security issues, such as a lack of read-only root file system, exposed AWS credentials, and multiple third-party library vulnerabilities. These issues should be addressed by the application owner to improve the overall security posture.

Code Analysis

We ran 9 analyzers against 3 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved