Skip to content

Split Github Vulnerability Scan into separate SCA & SAST parsers#12773

Merged
valentijnscholten merged 26 commits intoDefectDojo:devfrom
Logicmn:github-vuln-parser-improvements
Oct 22, 2025
Merged

Split Github Vulnerability Scan into separate SCA & SAST parsers#12773
valentijnscholten merged 26 commits intoDefectDojo:devfrom
Logicmn:github-vuln-parser-improvements

Conversation

@Logicmn
Copy link
Copy Markdown
Contributor

@Logicmn Logicmn commented Jul 11, 2025 •
edited
Loading

Description

Hello! The current parser implementation for GitHub code scanning results is baked into the "Github Vulnerability Scan" scan type, which is a parser originally meant to be used for GitHub SCA (Dependabot) vulnerabilities. Since these two scan types are exceptionally different, issues can arise especially around the fields used for deduplication in the hash code. This PR splits out GitHub code scanning into its own GithubSASTParser, with a scan-type string called ""Github SAST Scan." I have included documentation, unit tests, and a new list of fields for hash code deduplication.

I also included several improvements for the original Github Vulnerability Scan parser. These improvements include:

  • Add support for the cvssSeverities which will replace the cvss field in GitHub's graphql response in October, 2025.
  • Add the permalink from the dependabotUpdate field to the finding description
  • Add GitHub's now supported epss percentage and percentile to finding.epss_score and finding.epss_percentile finding fields
  • Set finding.url to GitHub Dependabot alert hyperlink for convenience
  • Improve vulnerability ID handling (now explicitly sets finding.cve and finding.vuln_id_from_tool fields before falling back to unsaved_vulnerability_ids)
  • Fix a bug where finding.component_version was only being set when the vulnerableRequirements str started with =
  • Improve defensive coding where applicable, like using .get() to access fields

Backward compatibility: existing users of the “Github Vulnerability Scan” scan type (driven by GithubVulnerabilityParser) for SCA imports will see no change. If you’d been using it to ingest SAST/code-scanning JSON, you’ll need to switch your import to the new “Github SAST Scan” scan type (driven by GithubSASTParser).

Ref links:

@github-actions github-actions Bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR docs unittests parser labels Jul 11, 2025
@Logicmn
Copy link
Copy Markdown
Contributor Author

Logicmn commented Jul 14, 2025

@Maffooch All linting errors should be fixed now, thanks for bearing with. :)

valentijnscholten
valentijnscholten reviewed Jul 15, 2025
View reviewed changes
Comment thread dojo/tools/github_vulnerability/parser.py Outdated
valentijnscholten
valentijnscholten reviewed Jul 15, 2025
View reviewed changes
Comment thread dojo/tools/github_vulnerability/parser.py Outdated
@valentijnscholten valentijnscholten added this to the 2.49.0 milestone Jul 15, 2025
valentijnscholten
valentijnscholten reviewed Jul 30, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@valentijnscholten valentijnscholten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

comment posted above

@valentijnscholten valentijnscholten modified the milestones: 2.49.0, 2.50.0 Aug 4, 2025
dogboat
dogboat approved these changes Aug 25, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@dogboat dogboat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just two nits about import placement, but otherwise looks great; approving because they're not blockers imho.

Comment thread dojo/tools/github_sast/parser.py Outdated
Comment thread unittests/tools/test_github_sast_parser.py Outdated
@valentijnscholten valentijnscholten modified the milestones: 2.50.0, 2.51.0 Sep 2, 2025
@Logicmn
Copy link
Copy Markdown
Contributor Author

Logicmn commented Sep 27, 2025

comment posted above

Responded

@Logicmn Logicmn force-pushed the github-vuln-parser-improvements branch from 2ffb18d to 82ed3f8 Compare September 27, 2025 19:51
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Sep 27, 2025

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Sep 27, 2025

Conflicts have been resolved. A maintainer will review the pull request shortly.

mtesauro
mtesauro approved these changes Oct 2, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@valentijnscholten valentijnscholten modified the milestones: 2.51.0, 2.52.0 Oct 6, 2025
@Logicmn
Copy link
Copy Markdown
Contributor Author

Logicmn commented Oct 8, 2025

@valentijnscholten Would it be helpful if I split this out into two PRs (e.g. one for the new SAST parser, and one for the improvements to the SCA parser)? Let me know how I can help get these changes merged, thanks.

@Logicmn
Copy link
Copy Markdown
Contributor Author

Logicmn commented Oct 14, 2025

@Maffooch Need one more review, when you have time. Thanks in advance,

@valentijnscholten
Copy link
Copy Markdown
Member

valentijnscholten commented Oct 14, 2025

@Logicmn Sorry for the delay here, we had a lot of PRs for 2.51.0. This one is scheduled for 2.52.0 which where the next release from the dev branch will come from. Thanks for your work.

@Logicmn
Copy link
Copy Markdown
Contributor Author

Logicmn commented Oct 14, 2025

@Logicmn Sorry for the delay here, we had a lot of PRs for 2.51.0. This one is scheduled for 2.52.0 which where the next release from the dev branch will come from. Thanks for your work.

No problem. Thanks for clarifying.

@valentijnscholten valentijnscholten merged commit 2591fd3 into DefectDojo:dev Oct 22, 2025
89 checks passed
Maffooch pushed a commit to valentijnscholten/django-DefectDojo that referenced this pull request Feb 16, 2026
@Logicmn @valentijnscholten
Split Github Vulnerability Scan into separate SCA & SAST parsers (Def…
5c83d00 
…ectDojo#12773)

* Refactor GithubVulnerability parser and add GithubSAST parser

* More GithubVulnerability and GithubSAST parser improvements

* Add documentation

* Add tests, update docs, and add hash code fields

* Fix Github vulnerability parser unit test

* Unit tests and parser tweaks

* Rm files pushed by mistake

* Revert certain removals from unit test

* Add EPSS field population and update unit tests

* Removed some unnecessary comments and formatting

* Ruff formatting

* Fix unit tests

* Ruff formatting

* Fix unit test

* Github Vulnerability parser and docs tweaks, and upgrade instructions

* Politeness

* Fix dependabot update pr link parsing

* Backwards compatability

* Revert 2.49 docs change and add 2.51

* Add 2.51 upgrade doc

* Smol 2.51 upgrade doc fix

* Move imports to top

* Ruff lint fix

---------

Co-authored-by: Zeke Tierkel <zeketierkel@Zekes-MacBook-Pro.local>
Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mtesauro mtesauro mtesauro approved these changes

@valentijnscholten valentijnscholten valentijnscholten approved these changes

@dogboat dogboat dogboat approved these changes

@Maffooch Maffooch Maffooch approved these changes

Assignees

No one assigned

Labels

docs parser settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR unittests

Projects

None yet

Milestone

2.52.0

Development

Successfully merging this pull request may close these issues.

5 participants

@Logicmn @valentijnscholten @mtesauro @dogboat @Maffooch