Merge branch 'dev' into remove-credential-manager

Author: Maffooch

docs/content/supported_tools/parsers/file/xygeni.md

@@ -0,0 +1,79 @@
+---
+title: "Xygeni"
+toc_hide: true
+---
+### About Xygeni
+[Xygeni](https://xygeni.io) is a Software Supply Chain Security platform whose
+scanners produce JSON reports for code vulnerabilities (SAST), open-source
+dependency vulnerabilities (SCA), hard-coded secrets, IaC flaws, web-application
+vulnerabilities (DAST), CI/CD and SCM misconfigurations, and malicious or
+suspect components.
+
+This parser handles three Xygeni scan kinds in phase 1: **SAST**, **SCA**, and
+**Secrets**. All three share a common `metadata` envelope; the parser
+dispatches on `metadata.scanType`.
+
+### Scan Types
+| Scan type                | `metadata.scanType` | Xygeni CLI command (typical) |
+| ------------------------ | ------------------- | ---------------------------- |
+| `Xygeni SAST Scan`       | `sast`              | `xygeni scan --scan-type=sast --format=json` |
+| `Xygeni SCA Scan`        | `deps`              | `xygeni scan --scan-type=deps --format=json` |
+| `Xygeni Secrets Scan`    | `secrets`           | `xygeni scan --scan-type=secrets --format=json` |
+
+See the Xygeni documentation at <https://docs.xygeni.io> for installation and
+the full set of CLI options.
+
+### Acceptable JSON Format
+All three scan types share the same envelope:
+
+~~~
+{
+  "metadata": {
+    "uuid": "...",
+    "timestamp": "2026-04-26T07:08:29Z",
+    "projectName": "...",
+    "scanType": "sast" | "deps" | "secrets",
+    "format": "<scanType>-xygeni",
+    "reportProperties": {
+      "tool.name": "Xygeni",
+      "tool.version": "..."
+    }
+  },
+  ...
+}
+~~~
+
+The kind-specific payload then follows:
+
+- **SAST** — `vulnerabilities[]` — each entry carries `detector` (the rule id),
+  `severity`, `location.{filepath, beginLine, endLine, code}`, `cwe` /
+  `cwes[]`, `tags[]`, `explanation`, `uniqueHash`, `issueId`, and an optional
+  `codeFlows[]` block describing source / sink frames and the data path.
+- **SCA** — `dependencies[]` — each dependency has `name`, `version`,
+  `ecosystem`, and a nested `vulnerabilities[]` of CVE/GHSA advisories with
+  `cve`, `cwes`, `fixedVersion`, `aliases`, `overallCvssScore`, `references`,
+  `description`, `uniqueHash`, `issueId`.
+- **Secrets** — `secrets[]` — each entry has `type` (e.g.
+  `aws_access_key`), `detector`, `severity`, `location` (same shape as SAST),
+  `description`, `tags`, `uniqueHash`, `issueId`. The `secret` value and
+  `location.code` are already redacted by the Xygeni CLI before serialisation.
+
+### Sample Scan Data
+Sample Xygeni JSON reports can be found
+[here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/xygeni).
+
+### Deduplication
+
+Every finding carries `unique_id_from_tool` (set from Xygeni's vendor-stable
+`uniqueHash`) and `vuln_id_from_tool` (set from `issueId`). The deduplication
+algorithm is configured per scan type:
+
+| Scan type            | Algorithm                          | Hash-code fields (fallback)                                    |
+| -------------------- | ---------------------------------- | -------------------------------------------------------------- |
+| Xygeni SAST Scan     | `unique_id_from_tool`              | n/a                                                            |
+| Xygeni SCA Scan      | `unique_id_from_tool_or_hash_code` | `vulnerability_ids`, `component_name`, `component_version`     |
+| Xygeni Secrets Scan  | `unique_id_from_tool`              | n/a                                                            |
+
+For SCA the hash-code fallback enables cross-tool deduplication: the same
+CVE on the same package@version reported by Xygeni and another SCA scanner
+(Snyk, Trivy, etc.) collapse into a single Finding.

dojo/api_v2/mixins.py

@@ -8,7 +8,6 @@
 from rest_framework.decorators import action
 
 from dojo.api_v2 import serializers
-from dojo.models import Answer, Question
 
 
 class DeletePreviewModelMixin:
@@ -46,13 +45,3 @@ def flatten(elem):
 
         serializer = serializers.DeletePreviewSerializer(page, many=True)
         return self.get_paginated_response(serializer.data)
-
-
-class QuestionSubClassFieldsMixin:
-    def get_queryset(self):
-        return Question.objects.select_subclasses()
-
-
-class AnswerSubClassFieldsMixin:
-    def get_queryset(self):
-        return Answer.objects.select_subclasses()

dojo/api_v2/serializers.py

@@ -48,13 +48,9 @@
     SEVERITY_CHOICES,
     STATS_FIELDS,
     Announcement,
-    Answer,
-    Answered_Survey,
     App_Analysis,
     BurpRawRequestResponse,
     Check_List,
-    ChoiceAnswer,
-    ChoiceQuestion,
     Development_Environment,
     Dojo_Group,
     Dojo_Group_Member,
@@ -65,12 +61,10 @@
     Endpoint_Status,
     Engagement,
     Engagement_Presets,
-    Engagement_Survey,
     FileUpload,
     Finding,
     Finding_Group,
     Finding_Template,
-    General_Survey,
     Global_Role,
     Language_Type,
     Languages,
@@ -85,7 +79,6 @@
     Product_Type,
     Product_Type_Group,
     Product_Type_Member,
-    Question,
     Regulation,
     Risk_Acceptance,
     Role,
@@ -98,8 +91,6 @@
     Test_Import,
     Test_Import_Finding_Action,
     Test_Type,
-    TextAnswer,
-    TextQuestion,
     Tool_Configuration,
     Tool_Product_Settings,
     Tool_Type,
@@ -3106,111 +3097,6 @@ class Meta:
         exclude = ("content_type",)
 
 
-class QuestionnaireQuestionSerializer(serializers.ModelSerializer):
-    def to_representation(self, instance):
-        if isinstance(instance, TextQuestion):
-            return TextQuestionSerializer(instance=instance).data
-        if isinstance(instance, ChoiceQuestion):
-            return ChoiceQuestionSerializer(instance=instance).data
-        return QuestionSerializer(instance=instance).data
-
-    class Meta:
-        model = Question
-        exclude = ("polymorphic_ctype",)
-
-
-class QuestionSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Question
-        exclude = ("polymorphic_ctype",)
-
-
-class TextQuestionSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = TextQuestion
-        exclude = ("polymorphic_ctype",)
-
-
-class ChoiceQuestionSerializer(serializers.ModelSerializer):
-    choices = serializers.StringRelatedField(many=True)
-
-    class Meta:
-        model = ChoiceQuestion
-        exclude = ("polymorphic_ctype",)
-
-
-class QuestionnaireAnsweredSurveySerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Answered_Survey
-        fields = "__all__"
-
-
-class QuestionnaireAnswerSerializer(serializers.ModelSerializer):
-    def to_representation(self, instance):
-        if isinstance(instance, TextAnswer):
-            return TextAnswerSerializer(instance=instance).data
-        if isinstance(instance, ChoiceAnswer):
-            return ChoiceAnswerSerializer(instance=instance).data
-        return AnswerSerializer(instance=instance).data
-
-    class Meta:
-        model = Answer
-        exclude = ("polymorphic_ctype",)
-
-
-class AnswerSerializer(serializers.ModelSerializer):
-    question = serializers.StringRelatedField()
-    answered_survey = QuestionnaireAnsweredSurveySerializer()
-
-    class Meta:
-        model = Answer
-        exclude = ("polymorphic_ctype",)
-
-
-class TextAnswerSerializer(serializers.ModelSerializer):
-    question = serializers.StringRelatedField()
-    answered_survey = QuestionnaireAnsweredSurveySerializer()
-
-    class Meta:
-        model = TextAnswer
-        exclude = ("polymorphic_ctype",)
-
-
-class ChoiceAnswerSerializer(serializers.ModelSerializer):
-    answer = serializers.StringRelatedField(many=True)
-    question = serializers.StringRelatedField()
-    answered_survey = QuestionnaireAnsweredSurveySerializer()
-
-    class Meta:
-        model = ChoiceAnswer
-        exclude = ("polymorphic_ctype",)
-
-
-class QuestionnaireEngagementSurveySerializer(serializers.ModelSerializer):
-    questions = serializers.SerializerMethodField()
-
-    @extend_schema_field(serializers.ListField(child=serializers.CharField()))
-    def get_questions(self, obj):
-        questions = obj.questions.all()
-        formated_questions = []
-        for question in questions:
-            formated_question = f"Order #{question.order} - {question.text}{' (Optional)' if question.optional else ''}"
-            formated_questions.append(formated_question)
-        return formated_questions
-
-    class Meta:
-        model = Engagement_Survey
-        fields = "__all__"
-
-
-class QuestionnaireGeneralSurveySerializer(serializers.ModelSerializer):
-    survey = QuestionnaireEngagementSurveySerializer()
-
-    class Meta:
-        model = General_Survey
-        fields = "__all__"
-
-
 class AnnouncementSerializer(serializers.ModelSerializer):
 
     class Meta: