🐛 fix acunetix360 parser #10435 (#10440)

manuel-sommer · web-flow · commit 5bcf23220276 · 2024-06-21T16:14:46.000-05:00
diff --git a/dojo/tools/acunetix/parse_acunetix360_json.py b/dojo/tools/acunetix/parse_acunetix360_json.py
@@ -29,16 +29,30 @@ def get_findings(self, filename, test):
             sev = item["Severity"]
             if sev not in ["Info", "Low", "Medium", "High", "Critical"]:
                 sev = "Info"
-            mitigation = text_maker.handle(item.get("RemedialProcedure", ""))
-            references = text_maker.handle(item.get("RemedyReferences", ""))
+            if item["RemedialProcedure"] is not None:
+                mitigation = text_maker.handle(item.get("RemedialProcedure", ""))
+            else:
+                mitigation = None
+            if item["RemedyReferences"] is not None:
+                references = text_maker.handle(item.get("RemedyReferences", ""))
+            else:
+                references = None
             if "LookupId" in item:
                 lookupId = item["LookupId"]
-                references = (
-                    f"https://online.acunetix360.com/issues/detail/{lookupId}\n"
-                    + references
-                )
+                if references is None:
+                    references = (
+                        f"https://online.acunetix360.com/issues/detail/{lookupId}\n"
+                    )
+                else:
+                    references = (
+                        f"https://online.acunetix360.com/issues/detail/{lookupId}\n"
+                        + references
+                    )
             url = item["Url"]
-            impact = text_maker.handle(item.get("Impact", ""))
+            if item["Impact"] is not None:
+                impact = text_maker.handle(item.get("Impact", ""))
+            else:
+                impact = None
             dupe_key = title
             request = item["HttpRequest"]["Content"]
             if request is None or len(request) <= 0:
diff --git a/unittests/scans/acunetix/issue_10435.json b/unittests/scans/acunetix/issue_10435.json
@@ -0,0 +1,45 @@
+{
+    "Generated": "19/06/2024 04:48 PM",
+    "Target": {
+      "Duration": "00:00:58.0662477",
+      "Initiated": "23/02/2023 02:30 PM",
+      "ScanId": "cb10809365d246d0881eafb202e63e55",
+      "Url": "XXXX"
+    },
+    "Vulnerabilities": [
+      {
+        "Certainty": 90,
+        "Classification": null,
+        "Confirmed": false,
+        "Description": "This vulnerability is removed or expired.",
+        "ExploitationSkills": null,
+        "ExternalReferences": null,
+        "ExtraInformation": [],
+        "FirstSeenDate": "02/06/2022 05:25 PM",
+        "HttpRequest": {
+          "Content": "GET /cgi-bin/ HTTP/1.1\r\nHost: XXXX\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nCookie: PHPSESSID=1adegrqlm9oebggs8mghcs78gt\r\nReferer: https://ics-monitoring.amersports.int/cgi-bin/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36\r\nX-Scanner: Acunetix 360\r\n\r\n",
+          "Method": "GET",
+          "Parameters": []
+        },
+        "HttpResponse": {
+          "Content": "HTTP/1.1 403 Forbidden\r\nServer: Apache\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=100\r\nContent-Length: 199\r\nContent-Type: text/html; charset=iso-8859-1\r\nDate: Thu, 23 Feb 2023 09:45:56 GMT\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don't have permission to access this resource.</p>\n</body></html>\n",
+          "Duration": 668.4901,
+          "StatusCode": 403
+        },
+        "LookupId": "7ce8d15a-e5f0-4dd5-1f83-aea8034f4105",
+        "Impact": null,
+        "KnownVulnerabilities": [],
+        "LastSeenDate": "23/02/2023 10:46 AM",
+        "Name": "MissingXFrameOptionsHeader",
+        "ProofOfConcept": null,
+        "RemedialActions": null,
+        "RemedialProcedure": null,
+        "RemedyReferences": null,
+        "Severity": "Low",
+        "State": "Present",
+        "Type": "MissingXFrameOptionsHeader",
+        "Url": "XXXX",
+        "Tags": []
+      }
+    ]
+  }
diff --git a/unittests/tools/test_acunetix_parser.py b/unittests/tools/test_acunetix_parser.py
@@ -330,3 +330,9 @@ def test_parse_file_issue_10370(self):
             parser = AcunetixParser()
             findings = parser.get_findings(testfile, Test())
             self.assertEqual(1, len(findings))
+
+    def test_parse_file_issue_10435(self):
+        with open("unittests/scans/acunetix/issue_10435.json") as testfile:
+            parser = AcunetixParser()
+            findings = parser.get_findings(testfile, Test())
+            self.assertEqual(1, len(findings))
