✨ Fortify: Support .fpr format

docs/content/en/integrations/parsers/file/fortify.md

@@ -2,7 +2,8 @@
 title: "Fortify"
 toc_hide: true
 ---
-Import Findings from XML file format.
+You can either import the findings in .xml or in .fdr file format. </br>
+If you import a .fdr file, the parser will look for the file 'audit.fvdl' and analyze it. An extracted example can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/fortify/audit.fvdl).
 
 ### Sample Scan Data
-Sample Fortify scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/fortify).
+Sample Fortify scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/fortify).

dojo/tools/fortify/parser.py

@@ -1,7 +1,7 @@
+import re
 import logging
-
+import zipfile
 from defusedxml import ElementTree
-
 from dojo.models import Finding
 
 logger = logging.getLogger(__name__)
@@ -18,6 +18,12 @@ def get_description_for_scan_types(self, scan_type):
         return "Import Findings from XML file format."
 
     def get_findings(self, filename, test):
+        if str(filename.name).endswith('.xml'):
+            return self.parse_xml(filename, test)
+        elif str(filename.name).endswith('.fpr'):
+            return self.parse_fpr(filename, test)
+
+    def parse_xml(self, filename, test):
         fortify_scan = ElementTree.parse(filename)
         root = fortify_scan.getroot()
 
@@ -114,6 +120,51 @@ def get_findings(self, filename, test):
                 dupes.add(title)
         return items
 
+    def parse_fpr(self, filename, test):
+        if str(filename.__class__) == "<class '_io.TextIOWrapper'>":
+            input_zip = zipfile.ZipFile(filename.name, 'r')
+        else:
+            input_zip = zipfile.ZipFile(filename, 'r')
+        zipdata = {name: input_zip.read(name) for name in input_zip.namelist()}
+        root = ElementTree.fromstring(zipdata["audit.fvdl"].decode('utf-8'))
+        regex = r"{.*}"
+        matches = re.match(regex, root.tag)
+        try:
+            namespace = matches.group(0)
+        except BaseException:
+            namespace = ""
+        items = list()
+        for child in root:
+            if "Vulnerabilities" in child.tag:
+                for vuln in child:
+                    ClassID = vuln.find(f"{namespace}ClassInfo").find(f"{namespace}ClassID").text
+                    Kingdom = vuln.find(f"{namespace}ClassInfo").find(f"{namespace}Kingdom").text
+                    Type = vuln.find(f"{namespace}ClassInfo").find(f"{namespace}Type").text
+                    AnalyzerName = vuln.find(f"{namespace}ClassInfo").find(f"{namespace}AnalyzerName").text
+                    DefaultSeverity = vuln.find(f"{namespace}ClassInfo").find(f"{namespace}DefaultSeverity").text
+                    InstanceID = vuln.find(f"{namespace}InstanceInfo").find(f"{namespace}InstanceID").text
+                    InstanceSeverity = vuln.find(f"{namespace}InstanceInfo").find(f"{namespace}InstanceSeverity").text
+                    Confidence = vuln.find(f"{namespace}InstanceInfo").find(f"{namespace}Confidence").text
+                    description = Type + "\n"
+                    description += "**ClassID:** " + ClassID + "\n"
+                    description += "**Kingdom:** " + Kingdom + "\n"
+                    description += "**AnalyzerName:** " + AnalyzerName + "\n"
+                    description += "**DefaultSeverity:** " + DefaultSeverity + "\n"
+                    description += "**InstanceID:** " + InstanceID + "\n"
+                    description += "**InstanceSeverity:** " + InstanceSeverity + "\n"
+                    description += "**Confidence:** " + Confidence + "\n"
+                    items.append(
+                        Finding(
+                            title=Type + " " + ClassID,
+                            severity="High",
+                            static_finding=True,
+                            test=test,
+                            description=description,
+                            unique_id_from_tool=ClassID,
+                        )
+                    )
+        return items
+
     def format_title(self, category, filename, line_no):
         """
         Builds the title much like it is represented in Fortify