Python: How to upload files for findings using APIv2?

[fuzzah]

I need to attach some binary files (not text) to my findings in DefectDojo.
Here's method I wrote based on similar methods of DefectDojoAPIv2:

def upload_file_for_finding(self, finding_id: int, file_title: str, file_path: str) -> bool:
    with open(file_path, "rb") as f:
        filedata = f.read()

    data = {
        "title": ('', file_title),
        "file": filedata,
    }
    resp = self.api._request(
        "POST",
        f"findings/{finding_id}/files",
        files=data,
    )

    return resp.response_code == 200

(self.api is instance of DefectDojoAPIv2)

While response code I get is always 200, files don't actually appear in DefectDojo.
Also tried:

1. POST to url f"manage_files/{finding_id}/Finding" (as in web interface)
2. set "title" field to file_title ( "title": file_title )
3. set "file" field to file descriptor ( "file": open(file_path, "rb") )

Relevant docker-compose log part when creating one finding and uploading file for it (dates removed):

django-defectdojo-nginx-1         | 10.123.123.123 "POST /api/v2/findings/ HTTP/1.1" 201 2930 "-" "DefectDojo_api/1.1.6.dev2" "-"
django-defectdojo-uwsgi-1         | 10.123.123.123 () {42 vars in 623 bytes} POST /api/v2/findings/ => generated 2930 bytes in 67 msecs (HTTP/1.1 201) 8 headers in 227 bytes (1 switches on core 0)
django-defectdojo-nginx-1         | 10.123.123.123 "POST /api/v2/findings/38142/files HTTP/1.1" 301 0 "-" "DefectDojo_api/1.1.6.dev2" "-"
django-defectdojo-uwsgi-1         | 10.123.123.123 () {42 vars in 722 bytes} POST /api/v2/findings/38142/files => generated 0 bytes in 1 msecs (HTTP/1.1 301) 3 headers in 134 bytes (1 switches on core 1)
django-defectdojo-celeryworker-1  | INFO [celery.app.trace:131] Task dojo.finding.helper.post_process_finding_save[d345b65c-c828-4f05-82a8-02a910c3326d] succeeded in 0.05184522084891796s: None

where 10.123.123.123 - my local ip
Note that POST to findings/{id}/files results in message "generated 0 bytes", but the file was actually 10 bytes long.

upd:
versions:
defectdojo_api @ 6f6d5e31dd2855e3e15d756b3a01a7dd8d77fdf9
DefectDojo 2.4.1 release

[StefanFl]

I am not sure if this endpoint actually works to import files. I will investigate.

[damiencarol]

it seems this endpoint is hard to use :D.
https://demo.defectdojo.org/api/v2/oa3/swagger-ui/?docExpansion=none#/import-scan

[StefanFl]

I don't understand the purpose of this endpoint then. We can attach files to an existing finding in the UI and this should be possible via the API as well. import-scan creates new findings, that's a different use case.

[StefanFl]

When I call this endpoint with 2 strings as parameters in the JSON for title and file I get an HTTP 400 with the message:

{
  "file": [
    "The submitted data was not a file. Check the encoding type on the form."
  ]
}

How do I submit a file in a JSON object?

I think we should get rid of this endpoint and write a new one with multipart form data.

[damiencarol]

Ok. I completely missed the point.
Yes this endpoint should provide a way to upload a file. not sure how to do it by Python/API.

[StefanFl]

This will be quite an easy fix, I am already working on it. Will reopen the issue, because it is an endpoint that's not working as it should and needs a bugfix.

[StefanFl]

#5509 fixes this