Skip to content

Commit c45b6b5

Browse files
aaronweaveraaronweaver
committed
Container support
1 parent 483e22e commit c45b6b5

6 files changed

Lines changed: 302 additions & 2 deletions

File tree

‎defectdojo_api/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
__version__ = '0.1.1'
1+
__version__ = '0.1.2'

‎defectdojo_api/defectdojo.py‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,16 @@ def version_url(self):
8585
"""
8686
return self.api_version
8787

88+
def get_id_from_url(self, url):
89+
"""Returns the ID from the DefectDojo API.
90+
91+
:param url: URL returned by the API
92+
93+
"""
94+
url = url.split('/')
95+
return url[len(url)-2]
96+
97+
8898
###### User API #######
8999
def list_users(self, username=None, limit=20):
90100
"""Retrieves all the users.
@@ -642,6 +652,166 @@ def upload_scan(self, engagement_id, scan_type, file, active, scan_date, tags=No
642652
files=data
643653
)
644654

655+
##### Credential API #####
656+
657+
def list_credentials(self, name=None, username=None, limit=20):
658+
"""Retrieves all the globally configured credentials.
659+
660+
:param name_contains: Search by credential name.
661+
:param username: Search by username
662+
:param limit: Number of records to return.
663+
664+
"""
665+
666+
params = {}
667+
if limit:
668+
params['limit'] = limit
669+
670+
if name:
671+
params['name__contains'] = name
672+
673+
if username:
674+
params['username__contains'] = username
675+
676+
return self._request('GET', 'credentials/', params)
677+
678+
def get_credential(self, cred_id, limit=20):
679+
"""
680+
Retrieves a credential using the given credential id.
681+
:param credential_id: Credential identification.
682+
"""
683+
return self._request('GET', 'credentials/' + str(cred_id) + '/')
684+
685+
##### Credential Mapping API #####
686+
687+
def list_credential_mappings(self, name=None, product_id_in=None, engagement_id_in=None, test_id_in=None, finding_id_in=None, limit=20):
688+
"""Retrieves mapped credentials.
689+
690+
:param name_contains: Search by credential name.
691+
:param username: Search by username
692+
:param limit: Number of records to return.
693+
694+
"""
695+
696+
params = {}
697+
if limit:
698+
params['limit'] = limit
699+
700+
if name:
701+
params['name'] = name
702+
703+
if product_id_in:
704+
params['product__id__in'] = product_id_in
705+
706+
if engagement_id_in:
707+
params['engagement__id__in'] = engagement_id_in
708+
709+
if test_id_in:
710+
params['test__id__in'] = test_id_in
711+
712+
if finding_id_in:
713+
params['finding__id__in'] = finding_id_in
714+
715+
return self._request('GET', 'credential_mappings/', params)
716+
717+
def get_credential_mapping(self, cred_mapping_id, limit=20):
718+
"""
719+
Retrieves a credential using the given credential id.
720+
:param cred_mapping_id: Credential identification.
721+
"""
722+
return self._request('GET', 'credential_mappings/' + str(cred_mapping_id) + '/')
723+
724+
##### Container API #####
725+
726+
def list_containers(self, name=None, container_type=None, limit=20):
727+
"""Retrieves all the globally configured credentials.
728+
729+
:param name_contains: Search by credential name.
730+
:param username: Search by username
731+
:param limit: Number of records to return.
732+
733+
"""
734+
735+
params = {}
736+
if limit:
737+
params['limit'] = limit
738+
739+
if name:
740+
params['name__contains'] = name
741+
742+
if container_type:
743+
params['container_type__contains'] = container_type
744+
745+
return self._request('GET', 'container/', params)
746+
747+
def get_container(self, container_id, limit=20):
748+
"""
749+
Retrieves a finding using the given container id.
750+
:param container_id: Container identification.
751+
"""
752+
return self._request('GET', 'container/' + str(container_id) + '/')
753+
754+
###### Tool API #######
755+
756+
def list_tool_types(self, name=None, limit=20):
757+
"""Retrieves all the tool types.
758+
759+
:param name_contains: Search by tool type name.
760+
:param limit: Number of records to return.
761+
762+
"""
763+
764+
params = {}
765+
if limit:
766+
params['limit'] = limit
767+
768+
if name:
769+
params['name__contains'] = name
770+
771+
return self._request('GET', 'tool_types/', params)
772+
773+
def list_tools(self, name=None, tool_type_id=None, limit=20):
774+
"""Retrieves all the tools.
775+
776+
:param name_contains: Search by tool name.
777+
:param tool_type_id: Search by tool type id
778+
:param limit: Number of records to return.
779+
780+
"""
781+
782+
params = {}
783+
if limit:
784+
params['limit'] = limit
785+
786+
if name:
787+
params['name__contains'] = name
788+
789+
if tool_type_id:
790+
params['tool_type__id'] = tool_type_id
791+
792+
return self._request('GET', 'tools/', params)
793+
794+
def list_tool_products(self, name=None, tool_configuration_id=None, limit=20):
795+
"""Retrieves all the tools.
796+
797+
:param name_contains: Search by tool name.
798+
:param tool_type_id: Search by tool type id
799+
:param limit: Number of records to return.
800+
801+
"""
802+
803+
params = {}
804+
if limit:
805+
params['limit'] = limit
806+
807+
if name:
808+
params['name__contains'] = name
809+
810+
if tool_configuration_id:
811+
params['tool_configuration__id'] = tool_configuration_id
812+
813+
return self._request('GET', 'tool_configs/', params)
814+
645815
# Utility
646816

647817
@staticmethod

‎examples/dojo-git.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
from git import Repo
2+
3+
Repo.clone_from(git_url, repo_dir)

‎examples/dojo_product.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
# Setup DefectDojo connection information
1212
host = 'http://localhost:8000'
1313
api_key = os.environ['DOJO_API_KEY']
14-
user = 'admin'
14+
user = 'admin1'
1515

1616
"""
1717
#Optionally, specify a proxy

‎examples/dojo_tools.py‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
"""
2+
Example written by Aaron Weaver <aaron.weaver@owasp.org>
3+
as part of the OWASP DefectDojo and OWASP AppSec Pipeline Security projects
4+
5+
Description: Creates a product in DefectDojo and returns information about the newly created product
6+
"""
7+
from defectdojo_api import defectdojo
8+
9+
import os
10+
11+
# Setup DefectDojo connection information
12+
host = 'http://localhost:8000'
13+
api_key = os.environ['DOJO_API_KEY']
14+
user = 'admin1'
15+
16+
#Optionally, specify a proxy
17+
proxies = {
18+
'http': 'http://localhost:8080',
19+
'https': 'http://localhost:8080',
20+
}
21+
#proxies=proxies
22+
23+
24+
# Instantiate the DefectDojo api wrapper
25+
dd = defectdojo.DefectDojoAPI(host, api_key, user, proxies=proxies, debug=False)
26+
27+
# List Tool Types
28+
tool_types = dd.list_tool_types()
29+
30+
#print "Configured Tool Types"
31+
#print tool_types.data_json(pretty=True)
32+
33+
list_credential_mappings = dd.list_credential_mappings(product_id_in=2)
34+
print "Creds"
35+
#print list_credential_mappings.data_json(pretty=True)
36+
37+
for cred in list_credential_mappings.data["objects"]:
38+
print cred["id"]
39+
print cred["credential"]
40+
get_credential = dd.get_credential(dd.get_id_from_url(cred["credential"]))
41+
print get_credential.data["selenium_script"]
42+
if get_credential.data["selenium_script"] != "None":
43+
file = open("testfile.py","w")
44+
file.write(get_credential.data["selenium_script"])
45+
file.close()
46+
print get_credential.data_json(pretty=True)
47+
48+
49+
"""
50+
list_containers = dd.list_containers()
51+
print "Containers"
52+
print list_containers.data_json(pretty=True)
53+
# Search Tool Types by Name
54+
tool_types = dd.list_tool_types(name="Source Code Repository")
55+
56+
print "Source Code Repository Tool Types"
57+
print tool_types.data["objects"][0]['id']
58+
print tool_types.data_json(pretty=True)
59+
60+
print "Configured Source Code Repository Tools"
61+
tool = dd.list_tools(tool_type_id=tool_types.data["objects"][0]['id'])
62+
print tool.data_json(pretty=True)
63+
64+
print "Products Configured to use source code repos"
65+
tool = dd.list_tool_products(tool_configuration_id=tool.data["objects"][0]['id'])
66+
print tool.data_json(pretty=True)
67+
"""

‎examples/dojo_zap.py‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
"""
2+
Example written by Aaron Weaver <aaron.weaver@owasp.org>
3+
as part of the OWASP DefectDojo and OWASP AppSec Pipeline Security projects
4+
5+
Description: Creates a product in DefectDojo and returns information about the newly created product
6+
"""
7+
from defectdojo_api import defectdojo
8+
9+
import os
10+
11+
# Setup DefectDojo connection information
12+
host = 'http://localhost:8000'
13+
api_key = os.environ['DOJO_API_KEY']
14+
user = 'admin1'
15+
16+
#Optionally, specify a proxy
17+
proxies = {
18+
'http': 'http://localhost:8080',
19+
'https': 'http://localhost:8080',
20+
}
21+
#proxies=proxies
22+
23+
24+
# Instantiate the DefectDojo api wrapper
25+
dd = defectdojo.DefectDojoAPI(host, api_key, user, debug=False)
26+
27+
# List Tool Types
28+
tool_types = dd.list_tool_types()
29+
30+
#print "Configured Tool Types"
31+
#print tool_types.data_json(pretty=True)
32+
33+
list_credential_mappings = dd.list_credential_mappings()
34+
print "CredMappings"
35+
print list_credential_mappings.data_json(pretty=True)
36+
37+
list_credentials = dd.list_credentials()
38+
print "Creds"
39+
print list_credentials.data_json(pretty=True)
40+
41+
list_containers = dd.list_containers()
42+
print "Containers"
43+
print list_containers.data_json(pretty=True)
44+
# Search Tool Types by Name
45+
tool_types = dd.list_tool_types(name="Source Code Repository")
46+
47+
print "Source Code Repository Tool Types"
48+
print tool_types.data["objects"][0]['id']
49+
print tool_types.data_json(pretty=True)
50+
51+
print "Configured Source Code Repository Tools"
52+
tool = dd.list_tools(tool_type_id=tool_types.data["objects"][0]['id'])
53+
print tool.data_json(pretty=True)
54+
55+
print "Products Configured to use source code repos"
56+
tool = dd.list_tool_products(tool_configuration_id=tool.data["objects"][0]['id'])
57+
print tool.data_json(pretty=True)
58+
59+
"""
60+
Scan by product id

0 commit comments

Comments
 (0)