-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
✨ advance import-scan api to have an additional field to finetune vulnerability parsers #9351
✨ advance import-scan api to have an additional field to finetune vulnerability parsers #9351
Conversation
Contextual Security AnalysisAs DryRun Security performs checks, we’ll summarize them here. You can always dive into the detailed results in the section below for checks.
Chat with your AI-powered Security Buddy by typing Install and configure more repositories at DryRun Security |
What does your request (and response) look like? Do you have also logs from Django? |
Lol, my import curl was malformed 😆 |
Could you take a look please @mtesauro ? |
I would make followup PRs for the mentioned use cases. |
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
@mtesauro could you take a look at this PR? I would love if this could be a way to finetune specific parsers. |
As soon as I get a clear opinion if this has the chance to get merged, I will also resolve the conflicts. What is your opinion @Maffooch ? |
@manuel-sommer From the consensus I've gathered about this PR, the resolution is that:
|
@mtesauro: Do you have a rough estimated release date for 3.0? I would like to have this feature available as soon as possible to further be able to advance various parsers. If 3.0 will take a while, can I make this PR ready to merge it earlier? |
Hi @mtesauro, |
Sure. I was reviewing PRs in prep for the March minor release and realized this one wasn't going to be in 2.x so I closed it. It's labeled "Consider for 3.0" which is used for PRs that we're not working on for 2.x but want to consider for 3.x so there' no real reason to keep this open till we're ready to start on 3.x. About 3.x timelines, I have no real idea. Every time I think I'm confident in a timeline we find something else that needs to be updated / adjusted / etc - latest is the upgrade of Django to the 4.2.10 which alters the timeline. So, it's beginning to feel like I just keep giving what I think is the timeline when I'm typing a reply only to have that change a short time after I write down the timeline somewhere. It's probably safer to use the "Debian" wording for it's releases which is "when its ready". That's about the only accurate thing I can say right now today about the move to 3.x. HTH |
Hi @mtesauro, may I throw this feature again into consideration earlier than 3.x.x. I guess multiple users would be happy if we could finetune scanners with custom values based on the scanner through api settings. I have already collected multiple use cases. Also, I could prepare a documentation page in advance and collaborate with you to get this on the road (maybe through multiple pull requests to split the work). But it makes only sense to work on it if the maintainers have time to also review and merge it. |
see issue #9250
This additional field could help to customize / finetune some scanners directly when parsing the report.
Use cases: