Enhancements to Govulncheck parser

[a-ruff]

Description

This Pull Request introduces several key enhancements to the govulncheck parser, aiming to provide more detailed and actionable vulnerability data within DefectDojo. The updates focus on enriching the parsed information with additional contextual details and traceability, making it easier for users to understand and act upon the findings.

Note :

• Changes have been made to the parsing of the new govulncheck format. The old format is of course still supported.
• Feel free to provide any suggestions or feedback for further improvements; If any part of the code is unclear, I can add explanatory comments or even rewrite sections for better clarity and understanding.

Key Changes :

1. Richer finding title.

• The parser now constructs the title using a combination of the Go vulnerability ID, the affected package name and the path within the package.
• Example : GO-2023-2382 - Stdlib - Net/HTTP/Internal

3. Detailed vulnerability description.

• The parser now adds more descriptive details about each vulnerability, including summary, vulnerable functions and affected versions into the description.

5. Inclusion of Trace information in the description of the finding.

• The component version is now set to the first version available in the trace.
• Previously, it was loaded from "schema_version", which is not related to the vulnerability.

7. Inclusion of details about the impact of the finding.

• The parser is now adding details about the impact of the vulnerability in the 'impact' field.

9. Introduction of and optional custom severity field.

• govulncheck is not providing severity information in its output. The parser has been updated to include an optional severity field which can be populated to set severity. This enhancement flexibility of the parser.

Screenshot:

Before :

After :

Test results
Tests have been updated with new tests to cover changes :

System check identified no issues (0 silenced).
test_parse_empty (unittests.tools.test_govulncheck_parser.TestGovulncheckParser.test_parse_empty) ... ok
test_parse_many_findings (unittests.tools.test_govulncheck_parser.TestGovulncheckParser.test_parse_many_findings) ... ok
test_parse_new_version_many_findings (unittests.tools.test_govulncheck_parser.TestGovulncheckParser.test_parse_new_version_many_findings) ... ok
test_parse_new_version_many_findings_custom_severity (unittests.tools.test_govulncheck_parser.TestGovulncheckParser.test_parse_new_version_many_findings_custom_severity) ... ok
test_parse_new_version_no_findings (unittests.tools.test_govulncheck_parser.TestGovulncheckParser.test_parse_new_version_no_findings) ... ok
test_parse_no_findings (unittests.tools.test_govulncheck_parser.TestGovulncheckParser.test_parse_no_findings) ... ok

----------------------------------------------------------------------
Ran 6 tests in 0.039s

OK
Destroying test database for alias 'default' ('test_defectdojo')...

Documentation

Do I need to update any documentation ?

Checklist

This checklist is for your information.

• Make sure to rebase your PR against the very latest dev.
• Features/Changes should be submitted against the dev.
• Bugfixes should be submitted against the bugfix branch.
• Give a meaningful name to your PR, as it may end up being used in the release notes.
• Your code is flake8 compliant.
• Your code is python 3.11 compliant.
• If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
• Model changes must include the necessary migrations in the dojo/db_migrations folder.
• Add applicable tests to the unit tests.
• Add the proper label to categorize your PR.

[dryrunsecurity]

Contextual Security Analysis

As DryRun Security performs checks, we’ll summarize them here. You can always dive into the detailed results in the section below for checks.

Status	DryRun Security Check
✅	AI-powered Sensitive Function Check
✅	Configured Sensitive Files Check
✅	AI-powered Sensitive Files Check

Chat with your AI-powered Security Buddy by typing @dryrunsecurity followed by your question into a comment.
Example: @dryrunsecurity What are common security issues with web application cookies?

Install and configure more repositories at DryRun Security

[manuel-sommer]

Hi @a-ruff ,

I would prefer if you would keep the already existing unittests report files and add an additional one if you advance govulncheck.

[mtesauro]

+1

[a-ruff]

Sure, I'll proceed with the change.

[a-ruff]

Done ✅

[a-ruff]

The check "Detect Merge Conflicts" was failing. Following rebase instructions resolved the issue.

[mtesauro]

Approved