diff --git a/.github/renovate.json b/.github/renovate.json index 82294c1eb05..a5ae6324179 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -22,6 +22,11 @@ "commitMessageExtra": "from {{currentVersion}} to {{#if isMajor}}v{{{newMajor}}}{{else}}{{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}{{/if}}", "commitMessageSuffix": "({{packageFile}})", "labels": ["dependencies"] + },{ + "description": "Update renovate weekly (sundays) - They are releasing new versions too often, so it is a bit noisy, and keeping renovating a bit older does not create vulnerabilities in DD", + "matchDatasources": "github-releases", + "matchPackageNames": "renovatebot/renovate", + "schedule": ["* * * * 0"] }], "customDatasources": { "endoflife-oldest-maintained": { diff --git a/.github/workflows/test-helm-chart.yml b/.github/workflows/test-helm-chart.yml index 05590c43782..64305fd10c7 100644 --- a/.github/workflows/test-helm-chart.yml +++ b/.github/workflows/test-helm-chart.yml @@ -107,6 +107,9 @@ jobs: steps: - name: Checkout uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + repository: ${{ github.event.pull_request.head.repo.full_name }} + ref: ${{ github.event.pull_request.head.ref }} - name: Update values in HELM chart if: startsWith(github.head_ref, 'renovate/') || startsWith(github.head_ref, 'dependabot/') diff --git a/docs/assets/images/pro_new_sla.png b/docs/assets/images/pro_new_sla.png new file mode 100644 index 00000000000..f1654e66c59 Binary files /dev/null and b/docs/assets/images/pro_new_sla.png differ diff --git a/docs/assets/images/pro_sla_product.png b/docs/assets/images/pro_sla_product.png new file mode 100644 index 00000000000..b550dc50844 Binary files /dev/null and b/docs/assets/images/pro_sla_product.png differ diff --git a/docs/assets/images/pro_sla_risk.png b/docs/assets/images/pro_sla_risk.png new file mode 100644 index 00000000000..4f0c9544c4a Binary files /dev/null and b/docs/assets/images/pro_sla_risk.png differ diff --git a/docs/assets/images/sla_breached.png b/docs/assets/images/sla_breached.png new file mode 100644 index 00000000000..770e2749558 Binary files /dev/null and b/docs/assets/images/sla_breached.png differ diff --git a/docs/assets/images/sla_mitigated_within.png b/docs/assets/images/sla_mitigated_within.png new file mode 100644 index 00000000000..8d0ee3b95f1 Binary files /dev/null and b/docs/assets/images/sla_mitigated_within.png differ diff --git a/docs/assets/images/sla_multiple.png b/docs/assets/images/sla_multiple.png new file mode 100644 index 00000000000..9dfe03ad615 Binary files /dev/null and b/docs/assets/images/sla_multiple.png differ diff --git a/docs/config/_default/menus/menus.en.toml b/docs/config/_default/menus/menus.en.toml index 652a1d2ecdb..2189b85513a 100644 --- a/docs/config/_default/menus/menus.en.toml +++ b/docs/config/_default/menus/menus.en.toml @@ -5,7 +5,7 @@ [[main]] name = "Supported Tools" - url = "/en/connecting_your_tools/parsers/" + url = "/supported_tools/" weight = 11 [[main]] diff --git a/docs/config/_default/params.toml b/docs/config/_default/params.toml index 7c2eb8b07c2..876e6d44e2f 100644 --- a/docs/config/_default/params.toml +++ b/docs/config/_default/params.toml @@ -44,7 +44,7 @@ mainSections = ["docs"] bootstrapJavascript = false # false (default) or true # Nav - sectionNav = ["docs", "en"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"]) + sectionNav = ["docs", "en", "supported_tools"] # ["docs"] (default) or list of sections (e.g. ["docs", "guides"]) toTopButton = false # false (default) or true breadcrumbTrail = true # false (default) or true headlineHash = true # true (default) or false diff --git a/docs/content/en/about_defectdojo/about_docs.md b/docs/content/en/about_defectdojo/about_docs.md index 49640238f31..581cf3e66c3 100644 --- a/docs/content/en/about_defectdojo/about_docs.md +++ b/docs/content/en/about_defectdojo/about_docs.md @@ -46,7 +46,7 @@ Whether you're a Pro or an Open-Source user, we have many resources that can hel - Our [New User Checklist](../new_user_checklist) covers the fundamentals of setting up your DefectDojo environment and setting up your import, triage and reporting workflows. -- We support a large amount of [security tool integrations](/en/connecting_your_tools/parsers/) to help fit DefectDojo in your DevSecOps program. +- We support a large amount of [security tool integrations](/supported_tools/) to help fit DefectDojo in your DevSecOps program. - Our team maintains a [YouTube Channel](https://www.youtube.com/@defectdojo) which hosts tutorials, archived Office Hours events and other content. New subscribers are always welcome! diff --git a/docs/content/en/about_defectdojo/faq.md b/docs/content/en/about_defectdojo/faq.md index 3a109cc743e..e97bc10f82a 100644 --- a/docs/content/en/about_defectdojo/faq.md +++ b/docs/content/en/about_defectdojo/faq.md @@ -12,9 +12,7 @@ Here are some frequently asked questions about working with DefectDojo - both in ### How should I organize my security testing in DefectDojo? -DefectDojo can support any security testing or reporting environment, but to optimize your use of DefectDojo you'll need to make sure things are in the right place. - -There's no one-size-fits-all solution for DefectDojo, because everyone's security team and operations look different. We have a very detailed article on [common use cases](/en/about_defectdojo/examples_of_use/) that has examples of how different organizations apply RBAC and the DefectDojo data model to support their needs. +While DefectDojo can support any security or testing environment, everyone’s security team and operations look different, so there’s no one-size-fits-all approach to using it. We have a very detailed article on [common use cases](/en/about_defectdojo/examples_of_use) that has examples of how different organizations apply RBAC and the DefectDojo data model to support their needs. ### What are the recommended workflows for security testing in DefectDojo? @@ -37,7 +35,7 @@ Role and permission assignment generally happens at the Product Type / Product l ### What tools are supported by DefectDojo? -DefectDojo supports reports from over 200 security tools, both commercial and Open Source. See our [Parser List](/en/connecting_your_tools/parsers/) for more information on these tools. +DefectDojo supports reports from over 200 security tools, both commercial and Open Source. See our [Parser List](/supported_tools/) for more information on these tools. If you're looking to add a new tool to your suite, we have a list of recommended Open Source tools which you can check out [here](https://defectdojo.com/blog/announcing-the-defectdojo-open-source-security-awards). @@ -56,7 +54,7 @@ For more information on Reimport, see our [article](/en/connecting_your_tools/im ### How can I troubleshoot Import errors? -DefectDojo supports a wide variety of tools. If you're seeing inconsistent behavior when importing a report, we recommend checking to see if the file structure matches what the tool is expecting. See our [Parser List](/en/connecting_your_tools/parsers/) to see if your tool is supported, and check to make sure that the file format matches what the tool expects. You can also compare the structure to our Unit Tests. +DefectDojo supports a wide variety of tools. If you're seeing inconsistent behavior when importing a report, we recommend checking to see if the file structure matches what the tool is expecting. See our [Parser List](/supported_tools/) to see if your tool is supported, and check to make sure that the file format matches what the tool expects. You can also compare the structure to our Unit Tests. **DefectDojo Pro** has a Universal Parser import method which allows you to handle any JSON, CSV or XML file. **DefectDojo OS** users can write custom parsers for the same purpose. @@ -64,7 +62,7 @@ Finally, third-party report formats have been known to change without warning, a ### How should I handle large scan files? -Importing a large report into DefectDojo can be a lengthy process. Reports of 2MB contain substantial amounts of data which can take a long time to translate into Findings. This depends on the security tool's report format itself +Importing a large report into DefectDojo can be a lengthy process. Reports of 2MB contain substantial amounts of data which can take a long time to translate into Findings. This depends on the security tool's report format itself. Our recommended approach is to break a large report up before import - rather than ingesting a report of **all** a tool's vulnerabilities at once, split them up by software project, application or by another context. This makes it much easier for DefectDojo to handle and categorize the data, and has the added benefit of proactively organizing your Findings, which makes for more relevant and faster report generation. diff --git a/docs/content/en/about_defectdojo/pro_features.md b/docs/content/en/about_defectdojo/pro_features.md index 9f6fa3110eb..ef2c09c1f48 100644 --- a/docs/content/en/about_defectdojo/pro_features.md +++ b/docs/content/en/about_defectdojo/pro_features.md @@ -70,6 +70,6 @@ Supported tools for Connectors include: Are you using an unsupported or customized scanning tool? Or do you just wish DefectDojo handled a report slightly differently? Use DefectDojo Pro's Universal Parser to turn any .json or .csv report into an actionable set of Findings, and have DefectDojo parse the data however you like. -See our [Universal Parser Guide](/en/connecting_your_tools/parsers/universal_parser/) for more information. +See our [Universal Parser Guide](/en/connecting_your_tools/universal_parser/) for more information. ![image](images/universal_parser_3.png) diff --git a/docs/content/en/connecting_your_tools/connectors/about_connectors.md b/docs/content/en/connecting_your_tools/connectors/about_connectors.md index d21670167fe..b1502a2c714 100644 --- a/docs/content/en/connecting_your_tools/connectors/about_connectors.md +++ b/docs/content/en/connecting_your_tools/connectors/about_connectors.md @@ -63,7 +63,7 @@ When you're ready to add more tools to DefectDojo, you can easily rearrange your ## My Connector isn't supported -Fortunately, DefectDojo can still handle manual import for a wide range of security tools. Please see our [Supported Tool List](../../parsers/), as well as our guide to Importing data. +Fortunately, DefectDojo can still handle manual import for a wide range of security tools. Please see our [Supported Tool List](/supported_tools), as well as our guide to Importing data. # **Next Steps** diff --git a/docs/content/en/connecting_your_tools/external_tools.md b/docs/content/en/connecting_your_tools/external_tools.md index 3b7bfe29a91..fcc27eca29f 100644 --- a/docs/content/en/connecting_your_tools/external_tools.md +++ b/docs/content/en/connecting_your_tools/external_tools.md @@ -921,4 +921,4 @@ If you encounter any issues with these tools, please check the following: - Ensure you're using the correct binary for your operating system and CPU architecture. - Verify that the API key is set correctly in your environment variables. - Check that the DefectDojo URL is correct and accessible. -- When importing, confirm that the report file exists and is in the supported format for the specified scan type. You can review the supported scanners for DefectDojo on our [supported tools list](../parsers). +- When importing, confirm that the report file exists and is in the supported format for the specified scan type. You can review the supported scanners for DefectDojo on our [supported tools list](/supported_tools). diff --git a/docs/content/en/connecting_your_tools/import_intro.md b/docs/content/en/connecting_your_tools/import_intro.md index cea4d77a6b8..c0576c93aa1 100644 --- a/docs/content/en/connecting_your_tools/import_intro.md +++ b/docs/content/en/connecting_your_tools/import_intro.md @@ -29,7 +29,7 @@ There are two main ways that DefectDojo can upload Finding reports. | | **UI Import** | **API** | **Connectors** (Pro) | **Smart Upload** (Pro)| | --- | --- | --- | --- | --- | -| **Supported Scan Types** | All: see [Supported Tools](/en/connecting_your_tools/parsers) | All: see [Supported Tools](/en/connecting_your_tools/parsers) | Snyk, Semgrep, Burp Suite, AWS Security Hub, Probely, Checkmarx, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable | +| **Supported Scan Types** | All: see [Supported Tools](/supported_tools/) | All: see [Supported Tools](/supported_tools/) | Snyk, Semgrep, Burp Suite, AWS Security Hub, Probely, Checkmarx, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable | | **Automation?** | Available via API: `/reimport` `/import` endpoints | Triggered from [CLI Importer](../external_tools) or external code | Connectors is inherently automated | Available via API: `/smart_upload_import` endpoint | ### Product Hierarchy and organization diff --git a/docs/content/en/connecting_your_tools/parsers/universal_parser.md b/docs/content/en/connecting_your_tools/universal_parser.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/universal_parser.md rename to docs/content/en/connecting_your_tools/universal_parser.md diff --git a/docs/content/en/open_source/upgrading/2.48.2.md b/docs/content/en/open_source/upgrading/2.48.2.md index 1e8b1b8ef67..468fe636362 100644 --- a/docs/content/en/open_source/upgrading/2.48.2.md +++ b/docs/content/en/open_source/upgrading/2.48.2.md @@ -6,4 +6,4 @@ description: Tag invalid character cleanup --- ## Tag Formatting Update -In [2.46.0](../2.46.md) tag validation was added to disallow commas, spaces and quotes in tags. Some parsers were still creating tags with invalid characters. This is fixed in this release and this release will run another data migration to replace any invalid character in tag with an underscore '`_`'. \ No newline at end of file +In [2.46.0](../2.46) tag validation was added to disallow commas, spaces and quotes in tags. Some parsers were still creating tags with invalid characters. This is fixed in this release and this release will run another data migration to replace any invalid character in tag with an underscore '`_`'. \ No newline at end of file diff --git a/docs/content/en/working_with_findings/sla_configuration.md b/docs/content/en/working_with_findings/sla_configuration.md new file mode 100644 index 00000000000..3a9bc1e0781 --- /dev/null +++ b/docs/content/en/working_with_findings/sla_configuration.md @@ -0,0 +1,76 @@ +--- +title: "SLA Configuration" +description: "Configure Service Level Agreements for different Products" +weight: 2 +--- + +Each Product in DefectDojo can have its own Service Level Agreement (SLA) configuration, which represents the days your organization has to remediate or otherwise manage a Finding. + +SLA can be set based on either **[Finding Severity](/en/working_with_findings/organizing_engagements_tests/product_hierarchy/#findings)** or **[Finding Risk](/en/working_with_findings/finding_priority/)** (in DefectDojo Pro). + +![image](images/sla_multiple.png) + +SLAs apply a countdown of days to a Finding based on the day that the Finding was created in DefectDojo. If a Finding is not Closed within the countdown, the Finding will be labeled as in breach of SLA. + +## Working with SLAs + +You can use SLAs as a way to represent your organizations remediation policies. You can also use them as a way to prioritize the longest-active, most critical Findings in your DefectDojo instance. + +* You can sort or filter Finding tables by SLA days. +* SLA violations can be configured to trigger [Notifications](/en/customize_dojo/notifications/about_notifications/) to DefectDojo users assigned to the related Product. +* In **DefectDojo Pro**, SLA performance is also tracked on the [Executive Insights and Remediation](/en/customize_dojo/dashboards/pro_dashboards/) Metrics Dashboards. +* SLA compliance can also be used to create custom [Dashboard Tiles](/en/customize_dojo/dashboards/about_custom_dashboard_tiles/#sla-violation-tile) in **DefectDojo Pro**. + +### Mitigated Within SLA status + +If a Finding is successfully Mitigated by the SLA deadline, the Finding will record a ✅ green check mark in the Mitigated Within SLA column. + +![image](images/sla_mitigated_within.png) + +If a Finding was Mitigated, but not before the SLA was violated, the Finding will record a ❌ red X in the Mitigated Within SLA column. + +### Breaching SLAs + +When an SLA for a given Finding is violated (the Finding is not Closed within the SLA timeline) the ✅ green check will switch to a ❌ red X. The SLA will continue to be tracked with a negative number, to represent how many days the SLA has been breached by. + +![image](images/sla_breached.png) + +## Managing SLA Configurations (Pro) + +In DefectDojo Pro, one or more SLA Configurations are managed under the **Configuration > Service Level Agreements** part of the sidebar. You can create a **New Service Level Agreement** or work with existing SLA configurations from the **All Service Level Agreements** page. + +![image](images/pro_sla_risk.png) + +SLA Configurations can only be edited by Superusers or by a user with the corresponding [Configuration Permission](/en/customize_dojo/user_management/user_permission_chart/#configuration-permission-chart). + +### Configuring SLA + +SLA configurations contain the days assigned to each **Severity** or **Risk** value of DefectDojo. + +![image](images/pro_new_sla.png) + +Each Service Level Agreement can have a unique name, along with an optional description. + +**Restart SLA on Finding Reactivation**: if enabled, this option will start an SLA over when a Finding is Reopened. Otherwise, the SLA will be based on when the Finding was created. + +When editing an SLA, you can choose whether that SLA will use **Severity** or **Risk** as a benchmark for assigning Days To Remediate. This is done by selecting the related option from the **Service Level configuration Type** section of the form. + +From here, you can set the number of days allowed for each **Severity** or **Risk** level. You can also selectively enforce SLAs; by unchecking the **Enforce ___ Finding Days** you can ignore SLA calculation for those levels of Severity or Risk. + +## Apply an SLA Configuration to a Product (Pro) + +Newly created Products in DefectDojo will always apply the **Default SLA Configuration**, which can be set to different values if you wish. + +If you have SLA configurations, you can choose which of these is applied to your Product from the **Edit Product** form. + +![image](images/pro_sla_product.png) + +### SLA Recalculation + +Once a new SLA has been selected for a Product, all of the associated Findings' SLAs will need to be recalculated by DefectDojo. While this process is running, a Product's SLA cannot be changed. + +## Notes on SLAs + +* SLAs can be optionally restarted once a [Risk Accepted](/en/working_with_findings/findings_workflows/risk_acceptances/) Finding reactivates. This is set when creating the Risk Acceptance by setting the **Restart SLA Expired** field. +* Reimporting a Finding does not restart the SLA - SLAs are always calculated from when a Finding was first detected unless **Restart SLA on Finding Reactivation** is enabled. +* Risk Acceptance expiry or reactivation of a Closed Finding are the only ways to reset or recalculate an SLA for a Finding once it is created (without changing the Product's SLA configuration). diff --git a/docs/content/supported_tools/_index.md b/docs/content/supported_tools/_index.md new file mode 100644 index 00000000000..0429a2744b7 --- /dev/null +++ b/docs/content/supported_tools/_index.md @@ -0,0 +1,37 @@ +--- +title: "Index" +date: 2021-02-02T20:46:29+01:00 +draft: false +type: docs + +cascade: +- type: "blog" + # set to false to include a blog section in the section nav along with docs + toc_root: true + _target: + path: "/blog/**" +- type: "docs" + _target: + path: "/**" +exclude_search: true +--- +DefectDojo can parse data from 200+ security reports and counting. + +## DefectDojo Pro Methods +DefectDojo Pro users have enhanced methods of import available for certain tools. + +**Connectors** allow you to automatically import and sync vulnerabilities from certain tools. + +**Smart Upload** allows you to split infrastructure-wide scan files up by component or endpoint, and easily combine those results with other Findings from the same location. + +| [Connectors](/en/connecting_your_tools/connectors/about_connectors/): supported tools | [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/): supported tools | +| --- | --- | +| AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz | + +# All Supported Tools + +All of these listed reports can be ingested via [Import/Reimport](/en/connecting_your_tools/import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API. + +If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](/supported_tools/parsers/generic_findings_import/) method. + +DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](/en/connecting_your_tools/universal_parser). \ No newline at end of file diff --git a/docs/content/en/connecting_your_tools/parsers/_index.md b/docs/content/supported_tools/parsers/_index.md similarity index 50% rename from docs/content/en/connecting_your_tools/parsers/_index.md rename to docs/content/supported_tools/parsers/_index.md index 031d47990b4..d290a5c465c 100644 --- a/docs/content/en/connecting_your_tools/parsers/_index.md +++ b/docs/content/supported_tools/parsers/_index.md @@ -1,8 +1,18 @@ --- -title: "Supported Report Types" -description: "DefectDojo has the ability to import scan reports from a large number of security tools." +title: "Supported Tools" +date: 2021-02-02T20:46:29+01:00 draft: false -weight: 5 +type: docs + +cascade: +- type: "blog" + # set to false to include a blog section in the section nav along with docs + toc_root: true + _target: + path: "/blog/**" +- type: "docs" + _target: + path: "/**" exclude_search: true --- @@ -15,14 +25,14 @@ DefectDojo can parse data from 180+ security reports and counting. **Smart Upload** allows you to split infrastructure-wide scan files up by component or endpoint, and easily combine those results with other Findings from the same location. -| [Connectors](../connectors/about_connectors): supported tools | [Smart Upload](../import_scan_files/smart_upload/): supported tools | +| [Connectors](/en/connecting_your_tools/connectors/about_connectors/): supported tools | [Smart Upload](/en/connecting_your_tools/import_scan_files/smart_upload/): supported tools | | --- | --- | -| Anchore, AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz | +| AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, Probely, Semgrep, SonarQube, Snyk, Tenable | Nexpose, NMap, OpenVas, Qualys, Tenable, Wiz | # All Supported Tools -All of these listed reports can be ingested via [Import/Reimport](../import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API. +All of these listed reports can be ingested via [Import/Reimport](/en/connecting_your_tools/import_intro) methods. This means that they can be imported to both Open-Source and Pro instances using the UI or API. -If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](./generic_findings_import/) method. +If your tool is not in this list, there's a good chance that DefectDojo can still import a report from the tool. Consider the [Generic Findings Import](/supported_tools/parsers/generic_findings_import/) method. -DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](./universal_parser). +DefectDojo Pro users can import any JSON or CSV report using the [Universal Parser](/en/connecting_your_tools/universal_parser). diff --git a/docs/content/en/connecting_your_tools/parsers/api/_index.md b/docs/content/supported_tools/parsers/api/_index.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/_index.md rename to docs/content/supported_tools/parsers/api/_index.md diff --git a/docs/content/en/connecting_your_tools/parsers/api/blackduck.md b/docs/content/supported_tools/parsers/api/blackduck.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/blackduck.md rename to docs/content/supported_tools/parsers/api/blackduck.md diff --git a/docs/content/en/connecting_your_tools/parsers/api/bugcrowd.md b/docs/content/supported_tools/parsers/api/bugcrowd.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/bugcrowd.md rename to docs/content/supported_tools/parsers/api/bugcrowd.md diff --git a/docs/content/en/connecting_your_tools/parsers/api/cobalt.md b/docs/content/supported_tools/parsers/api/cobalt.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/cobalt.md rename to docs/content/supported_tools/parsers/api/cobalt.md diff --git a/docs/content/en/connecting_your_tools/parsers/api/edgescan.md b/docs/content/supported_tools/parsers/api/edgescan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/edgescan.md rename to docs/content/supported_tools/parsers/api/edgescan.md diff --git a/docs/content/en/connecting_your_tools/parsers/api/sonarqube.md b/docs/content/supported_tools/parsers/api/sonarqube.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/sonarqube.md rename to docs/content/supported_tools/parsers/api/sonarqube.md diff --git a/docs/content/en/connecting_your_tools/parsers/api/vulners.md b/docs/content/supported_tools/parsers/api/vulners.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/api/vulners.md rename to docs/content/supported_tools/parsers/api/vulners.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/_index.md b/docs/content/supported_tools/parsers/file/_index.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/_index.md rename to docs/content/supported_tools/parsers/file/_index.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/acunetix.md b/docs/content/supported_tools/parsers/file/acunetix.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/acunetix.md rename to docs/content/supported_tools/parsers/file/acunetix.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/anchore_engine.md b/docs/content/supported_tools/parsers/file/anchore_engine.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/anchore_engine.md rename to docs/content/supported_tools/parsers/file/anchore_engine.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/anchore_enterprise.md b/docs/content/supported_tools/parsers/file/anchore_enterprise.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/anchore_enterprise.md rename to docs/content/supported_tools/parsers/file/anchore_enterprise.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/anchore_grype.md b/docs/content/supported_tools/parsers/file/anchore_grype.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/anchore_grype.md rename to docs/content/supported_tools/parsers/file/anchore_grype.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/anchorectl_policies.md b/docs/content/supported_tools/parsers/file/anchorectl_policies.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/anchorectl_policies.md rename to docs/content/supported_tools/parsers/file/anchorectl_policies.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/anchorectl_vulns.md b/docs/content/supported_tools/parsers/file/anchorectl_vulns.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/anchorectl_vulns.md rename to docs/content/supported_tools/parsers/file/anchorectl_vulns.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/appcheck_web_application_scanner.md b/docs/content/supported_tools/parsers/file/appcheck_web_application_scanner.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/appcheck_web_application_scanner.md rename to docs/content/supported_tools/parsers/file/appcheck_web_application_scanner.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/appspider.md b/docs/content/supported_tools/parsers/file/appspider.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/appspider.md rename to docs/content/supported_tools/parsers/file/appspider.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/aqua.md b/docs/content/supported_tools/parsers/file/aqua.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/aqua.md rename to docs/content/supported_tools/parsers/file/aqua.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/arachni.md b/docs/content/supported_tools/parsers/file/arachni.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/arachni.md rename to docs/content/supported_tools/parsers/file/arachni.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/asff.md b/docs/content/supported_tools/parsers/file/asff.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/asff.md rename to docs/content/supported_tools/parsers/file/asff.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/auditjs.md b/docs/content/supported_tools/parsers/file/auditjs.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/auditjs.md rename to docs/content/supported_tools/parsers/file/auditjs.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/aws_inspector2.md b/docs/content/supported_tools/parsers/file/aws_inspector2.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/aws_inspector2.md rename to docs/content/supported_tools/parsers/file/aws_inspector2.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/aws_prowler.md b/docs/content/supported_tools/parsers/file/aws_prowler.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/aws_prowler.md rename to docs/content/supported_tools/parsers/file/aws_prowler.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/aws_prowler_v3plus.md b/docs/content/supported_tools/parsers/file/aws_prowler_v3plus.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/aws_prowler_v3plus.md rename to docs/content/supported_tools/parsers/file/aws_prowler_v3plus.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/awssecurityhub.md b/docs/content/supported_tools/parsers/file/awssecurityhub.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/awssecurityhub.md rename to docs/content/supported_tools/parsers/file/awssecurityhub.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/azure_security_center_recommendations.md b/docs/content/supported_tools/parsers/file/azure_security_center_recommendations.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/azure_security_center_recommendations.md rename to docs/content/supported_tools/parsers/file/azure_security_center_recommendations.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/bandit.md b/docs/content/supported_tools/parsers/file/bandit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/bandit.md rename to docs/content/supported_tools/parsers/file/bandit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/bearer_cli.md b/docs/content/supported_tools/parsers/file/bearer_cli.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/bearer_cli.md rename to docs/content/supported_tools/parsers/file/bearer_cli.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/blackduck.md b/docs/content/supported_tools/parsers/file/blackduck.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/blackduck.md rename to docs/content/supported_tools/parsers/file/blackduck.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/blackduck_binary_analysis.md b/docs/content/supported_tools/parsers/file/blackduck_binary_analysis.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/blackduck_binary_analysis.md rename to docs/content/supported_tools/parsers/file/blackduck_binary_analysis.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/blackduck_component_risk.md b/docs/content/supported_tools/parsers/file/blackduck_component_risk.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/blackduck_component_risk.md rename to docs/content/supported_tools/parsers/file/blackduck_component_risk.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/brakeman.md b/docs/content/supported_tools/parsers/file/brakeman.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/brakeman.md rename to docs/content/supported_tools/parsers/file/brakeman.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/bugcrowd.md b/docs/content/supported_tools/parsers/file/bugcrowd.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/bugcrowd.md rename to docs/content/supported_tools/parsers/file/bugcrowd.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/bundler_audit.md b/docs/content/supported_tools/parsers/file/bundler_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/bundler_audit.md rename to docs/content/supported_tools/parsers/file/bundler_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/burp.md b/docs/content/supported_tools/parsers/file/burp.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/burp.md rename to docs/content/supported_tools/parsers/file/burp.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/burp_api.md b/docs/content/supported_tools/parsers/file/burp_api.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/burp_api.md rename to docs/content/supported_tools/parsers/file/burp_api.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/burp_dastardly.md b/docs/content/supported_tools/parsers/file/burp_dastardly.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/burp_dastardly.md rename to docs/content/supported_tools/parsers/file/burp_dastardly.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/burp_graphql.md b/docs/content/supported_tools/parsers/file/burp_graphql.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/burp_graphql.md rename to docs/content/supported_tools/parsers/file/burp_graphql.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/burp_suite_dast.md b/docs/content/supported_tools/parsers/file/burp_suite_dast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/burp_suite_dast.md rename to docs/content/supported_tools/parsers/file/burp_suite_dast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cargo_audit.md b/docs/content/supported_tools/parsers/file/cargo_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cargo_audit.md rename to docs/content/supported_tools/parsers/file/cargo_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/checkmarx.md b/docs/content/supported_tools/parsers/file/checkmarx.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/checkmarx.md rename to docs/content/supported_tools/parsers/file/checkmarx.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/checkmarx_cxflow_sast.md b/docs/content/supported_tools/parsers/file/checkmarx_cxflow_sast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/checkmarx_cxflow_sast.md rename to docs/content/supported_tools/parsers/file/checkmarx_cxflow_sast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/checkmarx_one.md b/docs/content/supported_tools/parsers/file/checkmarx_one.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/checkmarx_one.md rename to docs/content/supported_tools/parsers/file/checkmarx_one.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/checkov.md b/docs/content/supported_tools/parsers/file/checkov.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/checkov.md rename to docs/content/supported_tools/parsers/file/checkov.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/chefinspect.md b/docs/content/supported_tools/parsers/file/chefinspect.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/chefinspect.md rename to docs/content/supported_tools/parsers/file/chefinspect.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/clair.md b/docs/content/supported_tools/parsers/file/clair.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/clair.md rename to docs/content/supported_tools/parsers/file/clair.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cloudsploit.md b/docs/content/supported_tools/parsers/file/cloudsploit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cloudsploit.md rename to docs/content/supported_tools/parsers/file/cloudsploit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cobalt.md b/docs/content/supported_tools/parsers/file/cobalt.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cobalt.md rename to docs/content/supported_tools/parsers/file/cobalt.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/codechecker.md b/docs/content/supported_tools/parsers/file/codechecker.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/codechecker.md rename to docs/content/supported_tools/parsers/file/codechecker.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/codeql.md b/docs/content/supported_tools/parsers/file/codeql.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/codeql.md rename to docs/content/supported_tools/parsers/file/codeql.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/contrast.md b/docs/content/supported_tools/parsers/file/contrast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/contrast.md rename to docs/content/supported_tools/parsers/file/contrast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/coverity_api.md b/docs/content/supported_tools/parsers/file/coverity_api.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/coverity_api.md rename to docs/content/supported_tools/parsers/file/coverity_api.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/coverity_scan.md b/docs/content/supported_tools/parsers/file/coverity_scan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/coverity_scan.md rename to docs/content/supported_tools/parsers/file/coverity_scan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/crashtest_security.md b/docs/content/supported_tools/parsers/file/crashtest_security.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/crashtest_security.md rename to docs/content/supported_tools/parsers/file/crashtest_security.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cred_scan.md b/docs/content/supported_tools/parsers/file/cred_scan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cred_scan.md rename to docs/content/supported_tools/parsers/file/cred_scan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/crunch42.md b/docs/content/supported_tools/parsers/file/crunch42.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/crunch42.md rename to docs/content/supported_tools/parsers/file/crunch42.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cyberwatch_galeax.md b/docs/content/supported_tools/parsers/file/cyberwatch_galeax.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cyberwatch_galeax.md rename to docs/content/supported_tools/parsers/file/cyberwatch_galeax.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cyclonedx.md b/docs/content/supported_tools/parsers/file/cyclonedx.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cyclonedx.md rename to docs/content/supported_tools/parsers/file/cyclonedx.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/cycognito.md b/docs/content/supported_tools/parsers/file/cycognito.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/cycognito.md rename to docs/content/supported_tools/parsers/file/cycognito.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/dawnscanner.md b/docs/content/supported_tools/parsers/file/dawnscanner.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/dawnscanner.md rename to docs/content/supported_tools/parsers/file/dawnscanner.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/deepfence_threatmapper.md b/docs/content/supported_tools/parsers/file/deepfence_threatmapper.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/deepfence_threatmapper.md rename to docs/content/supported_tools/parsers/file/deepfence_threatmapper.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/dependency_check.md b/docs/content/supported_tools/parsers/file/dependency_check.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/dependency_check.md rename to docs/content/supported_tools/parsers/file/dependency_check.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/dependency_track.md b/docs/content/supported_tools/parsers/file/dependency_track.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/dependency_track.md rename to docs/content/supported_tools/parsers/file/dependency_track.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/detect_secrets.md b/docs/content/supported_tools/parsers/file/detect_secrets.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/detect_secrets.md rename to docs/content/supported_tools/parsers/file/detect_secrets.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/dockerbench.md b/docs/content/supported_tools/parsers/file/dockerbench.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/dockerbench.md rename to docs/content/supported_tools/parsers/file/dockerbench.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/dockle.md b/docs/content/supported_tools/parsers/file/dockle.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/dockle.md rename to docs/content/supported_tools/parsers/file/dockle.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/drheader.md b/docs/content/supported_tools/parsers/file/drheader.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/drheader.md rename to docs/content/supported_tools/parsers/file/drheader.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/dsop.md b/docs/content/supported_tools/parsers/file/dsop.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/dsop.md rename to docs/content/supported_tools/parsers/file/dsop.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/edgescan.md b/docs/content/supported_tools/parsers/file/edgescan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/edgescan.md rename to docs/content/supported_tools/parsers/file/edgescan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/eslint.md b/docs/content/supported_tools/parsers/file/eslint.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/eslint.md rename to docs/content/supported_tools/parsers/file/eslint.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/fortify.md b/docs/content/supported_tools/parsers/file/fortify.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/fortify.md rename to docs/content/supported_tools/parsers/file/fortify.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gcloud_artifact_scan.md b/docs/content/supported_tools/parsers/file/gcloud_artifact_scan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gcloud_artifact_scan.md rename to docs/content/supported_tools/parsers/file/gcloud_artifact_scan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/generic.md b/docs/content/supported_tools/parsers/file/generic.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/generic.md rename to docs/content/supported_tools/parsers/file/generic.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ggshield.md b/docs/content/supported_tools/parsers/file/ggshield.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ggshield.md rename to docs/content/supported_tools/parsers/file/ggshield.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/github_sast.md b/docs/content/supported_tools/parsers/file/github_sast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/github_sast.md rename to docs/content/supported_tools/parsers/file/github_sast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/github_secrets_detection_report.md b/docs/content/supported_tools/parsers/file/github_secrets_detection_report.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/github_secrets_detection_report.md rename to docs/content/supported_tools/parsers/file/github_secrets_detection_report.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/github_vulnerability.md b/docs/content/supported_tools/parsers/file/github_vulnerability.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/github_vulnerability.md rename to docs/content/supported_tools/parsers/file/github_vulnerability.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitlab_api_fuzzing.md b/docs/content/supported_tools/parsers/file/gitlab_api_fuzzing.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitlab_api_fuzzing.md rename to docs/content/supported_tools/parsers/file/gitlab_api_fuzzing.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitlab_container_scan.md b/docs/content/supported_tools/parsers/file/gitlab_container_scan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitlab_container_scan.md rename to docs/content/supported_tools/parsers/file/gitlab_container_scan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitlab_dast.md b/docs/content/supported_tools/parsers/file/gitlab_dast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitlab_dast.md rename to docs/content/supported_tools/parsers/file/gitlab_dast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitlab_dep_scan.md b/docs/content/supported_tools/parsers/file/gitlab_dep_scan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitlab_dep_scan.md rename to docs/content/supported_tools/parsers/file/gitlab_dep_scan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitlab_sast.md b/docs/content/supported_tools/parsers/file/gitlab_sast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitlab_sast.md rename to docs/content/supported_tools/parsers/file/gitlab_sast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitlab_secret_detection_report.md b/docs/content/supported_tools/parsers/file/gitlab_secret_detection_report.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitlab_secret_detection_report.md rename to docs/content/supported_tools/parsers/file/gitlab_secret_detection_report.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gitleaks.md b/docs/content/supported_tools/parsers/file/gitleaks.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gitleaks.md rename to docs/content/supported_tools/parsers/file/gitleaks.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/gosec.md b/docs/content/supported_tools/parsers/file/gosec.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/gosec.md rename to docs/content/supported_tools/parsers/file/gosec.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/govulncheck.md b/docs/content/supported_tools/parsers/file/govulncheck.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/govulncheck.md rename to docs/content/supported_tools/parsers/file/govulncheck.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/h1.md b/docs/content/supported_tools/parsers/file/h1.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/h1.md rename to docs/content/supported_tools/parsers/file/h1.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/hadolint.md b/docs/content/supported_tools/parsers/file/hadolint.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/hadolint.md rename to docs/content/supported_tools/parsers/file/hadolint.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/harbor_vulnerability.md b/docs/content/supported_tools/parsers/file/harbor_vulnerability.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/harbor_vulnerability.md rename to docs/content/supported_tools/parsers/file/harbor_vulnerability.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/hcl_appscan.md b/docs/content/supported_tools/parsers/file/hcl_appscan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/hcl_appscan.md rename to docs/content/supported_tools/parsers/file/hcl_appscan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/hcl_asoc_sast.md b/docs/content/supported_tools/parsers/file/hcl_asoc_sast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/hcl_asoc_sast.md rename to docs/content/supported_tools/parsers/file/hcl_asoc_sast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/horusec.md b/docs/content/supported_tools/parsers/file/horusec.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/horusec.md rename to docs/content/supported_tools/parsers/file/horusec.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/humble.md b/docs/content/supported_tools/parsers/file/humble.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/humble.md rename to docs/content/supported_tools/parsers/file/humble.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/huskyci.md b/docs/content/supported_tools/parsers/file/huskyci.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/huskyci.md rename to docs/content/supported_tools/parsers/file/huskyci.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/hydra.md b/docs/content/supported_tools/parsers/file/hydra.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/hydra.md rename to docs/content/supported_tools/parsers/file/hydra.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ibm_app.md b/docs/content/supported_tools/parsers/file/ibm_app.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ibm_app.md rename to docs/content/supported_tools/parsers/file/ibm_app.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/immuniweb.md b/docs/content/supported_tools/parsers/file/immuniweb.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/immuniweb.md rename to docs/content/supported_tools/parsers/file/immuniweb.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/intsights.md b/docs/content/supported_tools/parsers/file/intsights.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/intsights.md rename to docs/content/supported_tools/parsers/file/intsights.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/invicti.md b/docs/content/supported_tools/parsers/file/invicti.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/invicti.md rename to docs/content/supported_tools/parsers/file/invicti.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/jfrog_xray_api_summary_artifact.md b/docs/content/supported_tools/parsers/file/jfrog_xray_api_summary_artifact.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/jfrog_xray_api_summary_artifact.md rename to docs/content/supported_tools/parsers/file/jfrog_xray_api_summary_artifact.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/jfrog_xray_on_demand_binary_scan.md b/docs/content/supported_tools/parsers/file/jfrog_xray_on_demand_binary_scan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/jfrog_xray_on_demand_binary_scan.md rename to docs/content/supported_tools/parsers/file/jfrog_xray_on_demand_binary_scan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/jfrog_xray_unified.md b/docs/content/supported_tools/parsers/file/jfrog_xray_unified.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/jfrog_xray_unified.md rename to docs/content/supported_tools/parsers/file/jfrog_xray_unified.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/jfrogxray.md b/docs/content/supported_tools/parsers/file/jfrogxray.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/jfrogxray.md rename to docs/content/supported_tools/parsers/file/jfrogxray.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kics.md b/docs/content/supported_tools/parsers/file/kics.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kics.md rename to docs/content/supported_tools/parsers/file/kics.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kiuwan.md b/docs/content/supported_tools/parsers/file/kiuwan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kiuwan.md rename to docs/content/supported_tools/parsers/file/kiuwan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kiuwan_sca.md b/docs/content/supported_tools/parsers/file/kiuwan_sca.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kiuwan_sca.md rename to docs/content/supported_tools/parsers/file/kiuwan_sca.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/krakend_audit.md b/docs/content/supported_tools/parsers/file/krakend_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/krakend_audit.md rename to docs/content/supported_tools/parsers/file/krakend_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kubeaudit.md b/docs/content/supported_tools/parsers/file/kubeaudit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kubeaudit.md rename to docs/content/supported_tools/parsers/file/kubeaudit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kubebench.md b/docs/content/supported_tools/parsers/file/kubebench.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kubebench.md rename to docs/content/supported_tools/parsers/file/kubebench.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kubehunter.md b/docs/content/supported_tools/parsers/file/kubehunter.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kubehunter.md rename to docs/content/supported_tools/parsers/file/kubehunter.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/kubescape.md b/docs/content/supported_tools/parsers/file/kubescape.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/kubescape.md rename to docs/content/supported_tools/parsers/file/kubescape.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/legitify.md b/docs/content/supported_tools/parsers/file/legitify.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/legitify.md rename to docs/content/supported_tools/parsers/file/legitify.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/mayhem.md b/docs/content/supported_tools/parsers/file/mayhem.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/mayhem.md rename to docs/content/supported_tools/parsers/file/mayhem.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/mend.md b/docs/content/supported_tools/parsers/file/mend.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/mend.md rename to docs/content/supported_tools/parsers/file/mend.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/meterian.md b/docs/content/supported_tools/parsers/file/meterian.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/meterian.md rename to docs/content/supported_tools/parsers/file/meterian.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/microfocus_webinspect.md b/docs/content/supported_tools/parsers/file/microfocus_webinspect.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/microfocus_webinspect.md rename to docs/content/supported_tools/parsers/file/microfocus_webinspect.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/mobsf.md b/docs/content/supported_tools/parsers/file/mobsf.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/mobsf.md rename to docs/content/supported_tools/parsers/file/mobsf.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/mobsf_scorecard.md b/docs/content/supported_tools/parsers/file/mobsf_scorecard.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/mobsf_scorecard.md rename to docs/content/supported_tools/parsers/file/mobsf_scorecard.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/mozilla_observatory.md b/docs/content/supported_tools/parsers/file/mozilla_observatory.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/mozilla_observatory.md rename to docs/content/supported_tools/parsers/file/mozilla_observatory.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ms_defender.md b/docs/content/supported_tools/parsers/file/ms_defender.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ms_defender.md rename to docs/content/supported_tools/parsers/file/ms_defender.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/n0s1.md b/docs/content/supported_tools/parsers/file/n0s1.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/n0s1.md rename to docs/content/supported_tools/parsers/file/n0s1.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/nancy.md b/docs/content/supported_tools/parsers/file/nancy.md similarity index 90% rename from docs/content/en/connecting_your_tools/parsers/file/nancy.md rename to docs/content/supported_tools/parsers/file/nancy.md index 5a41f75abaf..bc4b7d32a3c 100644 --- a/docs/content/en/connecting_your_tools/parsers/file/nancy.md +++ b/docs/content/supported_tools/parsers/file/nancy.md @@ -16,7 +16,7 @@ This parser expects a JSON file. Sample Nancy scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/nancy). ### Link To Tool -See Nancy on GitHub: https://github.com/sonatype-nexus-community/nancy +See Nancy on [Github](https://github.com/sonatype-nexus-community/nancy) ### Default Deduplication Hashcode Fields By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/): diff --git a/docs/content/en/connecting_your_tools/parsers/file/netsparker.md b/docs/content/supported_tools/parsers/file/netsparker.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/netsparker.md rename to docs/content/supported_tools/parsers/file/netsparker.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/neuvector.md b/docs/content/supported_tools/parsers/file/neuvector.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/neuvector.md rename to docs/content/supported_tools/parsers/file/neuvector.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/neuvector_compliance.md b/docs/content/supported_tools/parsers/file/neuvector_compliance.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/neuvector_compliance.md rename to docs/content/supported_tools/parsers/file/neuvector_compliance.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/nexpose.md b/docs/content/supported_tools/parsers/file/nexpose.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/nexpose.md rename to docs/content/supported_tools/parsers/file/nexpose.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/nikto.md b/docs/content/supported_tools/parsers/file/nikto.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/nikto.md rename to docs/content/supported_tools/parsers/file/nikto.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/nmap.md b/docs/content/supported_tools/parsers/file/nmap.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/nmap.md rename to docs/content/supported_tools/parsers/file/nmap.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/noseyparker.md b/docs/content/supported_tools/parsers/file/noseyparker.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/noseyparker.md rename to docs/content/supported_tools/parsers/file/noseyparker.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/npm_audit.md b/docs/content/supported_tools/parsers/file/npm_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/npm_audit.md rename to docs/content/supported_tools/parsers/file/npm_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/npm_audit_7_plus.md b/docs/content/supported_tools/parsers/file/npm_audit_7_plus.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/npm_audit_7_plus.md rename to docs/content/supported_tools/parsers/file/npm_audit_7_plus.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/nsp.md b/docs/content/supported_tools/parsers/file/nsp.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/nsp.md rename to docs/content/supported_tools/parsers/file/nsp.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/nuclei.md b/docs/content/supported_tools/parsers/file/nuclei.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/nuclei.md rename to docs/content/supported_tools/parsers/file/nuclei.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/openscap.md b/docs/content/supported_tools/parsers/file/openscap.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/openscap.md rename to docs/content/supported_tools/parsers/file/openscap.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/openvas.md b/docs/content/supported_tools/parsers/file/openvas.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/openvas.md rename to docs/content/supported_tools/parsers/file/openvas.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ort.md b/docs/content/supported_tools/parsers/file/ort.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ort.md rename to docs/content/supported_tools/parsers/file/ort.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ossindex_devaudit.md b/docs/content/supported_tools/parsers/file/ossindex_devaudit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ossindex_devaudit.md rename to docs/content/supported_tools/parsers/file/ossindex_devaudit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/osv_scanner.md b/docs/content/supported_tools/parsers/file/osv_scanner.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/osv_scanner.md rename to docs/content/supported_tools/parsers/file/osv_scanner.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/outpost24.md b/docs/content/supported_tools/parsers/file/outpost24.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/outpost24.md rename to docs/content/supported_tools/parsers/file/outpost24.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/php_security_audit_v2.md b/docs/content/supported_tools/parsers/file/php_security_audit_v2.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/php_security_audit_v2.md rename to docs/content/supported_tools/parsers/file/php_security_audit_v2.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/php_symfony_security_check.md b/docs/content/supported_tools/parsers/file/php_symfony_security_check.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/php_symfony_security_check.md rename to docs/content/supported_tools/parsers/file/php_symfony_security_check.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/pip_audit.md b/docs/content/supported_tools/parsers/file/pip_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/pip_audit.md rename to docs/content/supported_tools/parsers/file/pip_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/pmd.md b/docs/content/supported_tools/parsers/file/pmd.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/pmd.md rename to docs/content/supported_tools/parsers/file/pmd.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/popeye.md b/docs/content/supported_tools/parsers/file/popeye.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/popeye.md rename to docs/content/supported_tools/parsers/file/popeye.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/progpilot.md b/docs/content/supported_tools/parsers/file/progpilot.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/progpilot.md rename to docs/content/supported_tools/parsers/file/progpilot.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ptart.md b/docs/content/supported_tools/parsers/file/ptart.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ptart.md rename to docs/content/supported_tools/parsers/file/ptart.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/pwn_sast.md b/docs/content/supported_tools/parsers/file/pwn_sast.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/pwn_sast.md rename to docs/content/supported_tools/parsers/file/pwn_sast.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/qualys.md b/docs/content/supported_tools/parsers/file/qualys.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/qualys.md rename to docs/content/supported_tools/parsers/file/qualys.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/qualys_hacker_guardian.md b/docs/content/supported_tools/parsers/file/qualys_hacker_guardian.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/qualys_hacker_guardian.md rename to docs/content/supported_tools/parsers/file/qualys_hacker_guardian.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/qualys_infrascan_webgui.md b/docs/content/supported_tools/parsers/file/qualys_infrascan_webgui.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/qualys_infrascan_webgui.md rename to docs/content/supported_tools/parsers/file/qualys_infrascan_webgui.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/qualys_webapp.md b/docs/content/supported_tools/parsers/file/qualys_webapp.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/qualys_webapp.md rename to docs/content/supported_tools/parsers/file/qualys_webapp.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/rapplex.md b/docs/content/supported_tools/parsers/file/rapplex.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/rapplex.md rename to docs/content/supported_tools/parsers/file/rapplex.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/redhatsatellite.md b/docs/content/supported_tools/parsers/file/redhatsatellite.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/redhatsatellite.md rename to docs/content/supported_tools/parsers/file/redhatsatellite.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/retirejs.md b/docs/content/supported_tools/parsers/file/retirejs.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/retirejs.md rename to docs/content/supported_tools/parsers/file/retirejs.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/reversinglabs_spectraassure.md b/docs/content/supported_tools/parsers/file/reversinglabs_spectraassure.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/reversinglabs_spectraassure.md rename to docs/content/supported_tools/parsers/file/reversinglabs_spectraassure.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/risk_recon.md b/docs/content/supported_tools/parsers/file/risk_recon.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/risk_recon.md rename to docs/content/supported_tools/parsers/file/risk_recon.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/rubocop.md b/docs/content/supported_tools/parsers/file/rubocop.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/rubocop.md rename to docs/content/supported_tools/parsers/file/rubocop.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/rusty_hog.md b/docs/content/supported_tools/parsers/file/rusty_hog.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/rusty_hog.md rename to docs/content/supported_tools/parsers/file/rusty_hog.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sarif.md b/docs/content/supported_tools/parsers/file/sarif.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sarif.md rename to docs/content/supported_tools/parsers/file/sarif.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/scantist.md b/docs/content/supported_tools/parsers/file/scantist.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/scantist.md rename to docs/content/supported_tools/parsers/file/scantist.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/scout_suite.md b/docs/content/supported_tools/parsers/file/scout_suite.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/scout_suite.md rename to docs/content/supported_tools/parsers/file/scout_suite.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/semgrep.md b/docs/content/supported_tools/parsers/file/semgrep.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/semgrep.md rename to docs/content/supported_tools/parsers/file/semgrep.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/semgrep_pro.md b/docs/content/supported_tools/parsers/file/semgrep_pro.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/semgrep_pro.md rename to docs/content/supported_tools/parsers/file/semgrep_pro.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/skf.md b/docs/content/supported_tools/parsers/file/skf.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/skf.md rename to docs/content/supported_tools/parsers/file/skf.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/snyk.md b/docs/content/supported_tools/parsers/file/snyk.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/snyk.md rename to docs/content/supported_tools/parsers/file/snyk.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/snyk_code.md b/docs/content/supported_tools/parsers/file/snyk_code.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/snyk_code.md rename to docs/content/supported_tools/parsers/file/snyk_code.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/snyk_issue_api.md b/docs/content/supported_tools/parsers/file/snyk_issue_api.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/snyk_issue_api.md rename to docs/content/supported_tools/parsers/file/snyk_issue_api.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/solar_appscreener.md b/docs/content/supported_tools/parsers/file/solar_appscreener.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/solar_appscreener.md rename to docs/content/supported_tools/parsers/file/solar_appscreener.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sonarqube.md b/docs/content/supported_tools/parsers/file/sonarqube.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sonarqube.md rename to docs/content/supported_tools/parsers/file/sonarqube.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sonatype.md b/docs/content/supported_tools/parsers/file/sonatype.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sonatype.md rename to docs/content/supported_tools/parsers/file/sonatype.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/spotbugs.md b/docs/content/supported_tools/parsers/file/spotbugs.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/spotbugs.md rename to docs/content/supported_tools/parsers/file/spotbugs.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ssh_audit.md b/docs/content/supported_tools/parsers/file/ssh_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ssh_audit.md rename to docs/content/supported_tools/parsers/file/ssh_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/ssl_labs.md b/docs/content/supported_tools/parsers/file/ssl_labs.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/ssl_labs.md rename to docs/content/supported_tools/parsers/file/ssl_labs.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sslscan.md b/docs/content/supported_tools/parsers/file/sslscan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sslscan.md rename to docs/content/supported_tools/parsers/file/sslscan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sslyze.md b/docs/content/supported_tools/parsers/file/sslyze.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sslyze.md rename to docs/content/supported_tools/parsers/file/sslyze.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/stackhawk.md b/docs/content/supported_tools/parsers/file/stackhawk.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/stackhawk.md rename to docs/content/supported_tools/parsers/file/stackhawk.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sysdig_cli.md b/docs/content/supported_tools/parsers/file/sysdig_cli.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sysdig_cli.md rename to docs/content/supported_tools/parsers/file/sysdig_cli.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/sysdig_reports.md b/docs/content/supported_tools/parsers/file/sysdig_reports.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/sysdig_reports.md rename to docs/content/supported_tools/parsers/file/sysdig_reports.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/talisman.md b/docs/content/supported_tools/parsers/file/talisman.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/talisman.md rename to docs/content/supported_tools/parsers/file/talisman.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/tenable.md b/docs/content/supported_tools/parsers/file/tenable.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/tenable.md rename to docs/content/supported_tools/parsers/file/tenable.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/terrascan.md b/docs/content/supported_tools/parsers/file/terrascan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/terrascan.md rename to docs/content/supported_tools/parsers/file/terrascan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/testssl.md b/docs/content/supported_tools/parsers/file/testssl.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/testssl.md rename to docs/content/supported_tools/parsers/file/testssl.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/tfsec.md b/docs/content/supported_tools/parsers/file/tfsec.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/tfsec.md rename to docs/content/supported_tools/parsers/file/tfsec.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/threagile.md b/docs/content/supported_tools/parsers/file/threagile.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/threagile.md rename to docs/content/supported_tools/parsers/file/threagile.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/threat_composer.md b/docs/content/supported_tools/parsers/file/threat_composer.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/threat_composer.md rename to docs/content/supported_tools/parsers/file/threat_composer.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/trivy.md b/docs/content/supported_tools/parsers/file/trivy.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/trivy.md rename to docs/content/supported_tools/parsers/file/trivy.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/trivy_operator.md b/docs/content/supported_tools/parsers/file/trivy_operator.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/trivy_operator.md rename to docs/content/supported_tools/parsers/file/trivy_operator.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/trufflehog.md b/docs/content/supported_tools/parsers/file/trufflehog.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/trufflehog.md rename to docs/content/supported_tools/parsers/file/trufflehog.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/trufflehog3.md b/docs/content/supported_tools/parsers/file/trufflehog3.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/trufflehog3.md rename to docs/content/supported_tools/parsers/file/trufflehog3.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/trustwave.md b/docs/content/supported_tools/parsers/file/trustwave.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/trustwave.md rename to docs/content/supported_tools/parsers/file/trustwave.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/trustwave_fusion_api.md b/docs/content/supported_tools/parsers/file/trustwave_fusion_api.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/trustwave_fusion_api.md rename to docs/content/supported_tools/parsers/file/trustwave_fusion_api.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/twistlock.md b/docs/content/supported_tools/parsers/file/twistlock.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/twistlock.md rename to docs/content/supported_tools/parsers/file/twistlock.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/vcg.md b/docs/content/supported_tools/parsers/file/vcg.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/vcg.md rename to docs/content/supported_tools/parsers/file/vcg.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/veracode.md b/docs/content/supported_tools/parsers/file/veracode.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/veracode.md rename to docs/content/supported_tools/parsers/file/veracode.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/veracode_sca.md b/docs/content/supported_tools/parsers/file/veracode_sca.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/veracode_sca.md rename to docs/content/supported_tools/parsers/file/veracode_sca.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wapiti.md b/docs/content/supported_tools/parsers/file/wapiti.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wapiti.md rename to docs/content/supported_tools/parsers/file/wapiti.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wazuh.md b/docs/content/supported_tools/parsers/file/wazuh.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wazuh.md rename to docs/content/supported_tools/parsers/file/wazuh.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wfuzz.md b/docs/content/supported_tools/parsers/file/wfuzz.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wfuzz.md rename to docs/content/supported_tools/parsers/file/wfuzz.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/whispers.md b/docs/content/supported_tools/parsers/file/whispers.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/whispers.md rename to docs/content/supported_tools/parsers/file/whispers.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/whitehat_sentinel.md b/docs/content/supported_tools/parsers/file/whitehat_sentinel.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/whitehat_sentinel.md rename to docs/content/supported_tools/parsers/file/whitehat_sentinel.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wiz.md b/docs/content/supported_tools/parsers/file/wiz.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wiz.md rename to docs/content/supported_tools/parsers/file/wiz.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wizcli_dir.md b/docs/content/supported_tools/parsers/file/wizcli_dir.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wizcli_dir.md rename to docs/content/supported_tools/parsers/file/wizcli_dir.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wizcli_iac.md b/docs/content/supported_tools/parsers/file/wizcli_iac.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wizcli_iac.md rename to docs/content/supported_tools/parsers/file/wizcli_iac.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wizcli_img.md b/docs/content/supported_tools/parsers/file/wizcli_img.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wizcli_img.md rename to docs/content/supported_tools/parsers/file/wizcli_img.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/wpscan.md b/docs/content/supported_tools/parsers/file/wpscan.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/wpscan.md rename to docs/content/supported_tools/parsers/file/wpscan.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/xanitizer.md b/docs/content/supported_tools/parsers/file/xanitizer.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/xanitizer.md rename to docs/content/supported_tools/parsers/file/xanitizer.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/xeol.md b/docs/content/supported_tools/parsers/file/xeol.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/xeol.md rename to docs/content/supported_tools/parsers/file/xeol.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/yarn_audit.md b/docs/content/supported_tools/parsers/file/yarn_audit.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/yarn_audit.md rename to docs/content/supported_tools/parsers/file/yarn_audit.md diff --git a/docs/content/en/connecting_your_tools/parsers/file/zap.md b/docs/content/supported_tools/parsers/file/zap.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/file/zap.md rename to docs/content/supported_tools/parsers/file/zap.md diff --git a/docs/content/en/connecting_your_tools/parsers/generic_findings_import.md b/docs/content/supported_tools/parsers/generic_findings_import.md similarity index 100% rename from docs/content/en/connecting_your_tools/parsers/generic_findings_import.md rename to docs/content/supported_tools/parsers/generic_findings_import.md diff --git a/docs/content/supported_tools/parsers/universal_parser.md b/docs/content/supported_tools/parsers/universal_parser.md new file mode 100644 index 00000000000..476f088d716 --- /dev/null +++ b/docs/content/supported_tools/parsers/universal_parser.md @@ -0,0 +1,162 @@ +--- +title: "🌐 Universal Parser (Pro)" +description: "" +draft: "false" +weight: 1 +pro-feature: true +--- + +Note: The Universal Parser is only available in DefectDojo Pro. + +The Universal Parser is currently in Beta. See our [announcement presentation](https://community.defectdojo.com/universalparser) for more information. + +## About Universal Parser +DefectDojo has a large, regularly updated library of parsers to help security teams ingest data. However, sometimes users have a tool that's unsupported by the parsers, or they may want to import data into the DefectDojo model differently from the way the parser does. + +DefectDojo's Universal Parser is meant to give our users with unsupported report types a path forward, to import and map **any JSON, CSV or XML file**. + +**The Universal Parser is:** + +* A quick way to support file formats for which we do not have Community parsers, such as reports produced by internal tools +* A tool to help you ingest data, even if a Community parser is out-of-date or doesn't structure findings the way you would like +* An alternative to custom scripting to transform tool reports into the CSV/JSON format expected by the "Generic Findings Import" scan type +* Designed to be easy to use for anyone, with no coding and minimal configuration required + +**The Universal Parser is not:** + +* A comprehensive replacement for open source parsers, Connectors, or carefully-massaged "Generic Findings Import" reports +* Capable of handling nuanced, branching logic to structure findings + +The Universal Parser configuration is only available in the Pro UI, though you can still import scans using a Universal Parser via the old UI or API. + +## Step 1: Creating a new Universal Parser + +You can create a new Universal Parser by clicking the "New Universal Parser" button in the navigation bar under the "Import" section, or from the link on the "Add Findings" page. + +![image](images/universal_parser.png) + +The first screen will ask you for a scan file and a parser name. + +![image](images/universal_parser_2.png) + +The file should: + +* Have a recognized extension (see supported file extensions below) +* Contain enough finding-like objects to be representative of real reports - i.e., one that includes values in all optional fields +* Not be larger than about 1-2MB - beyond this point it will generally just take longer to parse the file, without any benefit + +The parser name will be used when creating the Test_Type for this new parser. You'll find your newly-created Universal Parser in the scan types drop-down on the "Add Findings" page with a name like "Universal Parser - MyCustomParser". Parser names must be unique to prevent confusion when selecting a scan type for imports. + +## Step 2: Mapping your Finding fields + +![image](images/universal_parser_3.png) + +After uploading an example scan file, selecting a parser name, and clicking "Next", the following page will let you configure the way this Universal Parser will populate finding fields when using this configuration to perform imports. On the right, you will find a selection of DefectDojo finding fields (output fields). Drop-down menus to the left of each output field allow you to select which item(s) (input fields) from your scan file's structure should be used to populate them. + +Example: + +If you've uploaded a scan file in JSON format that looks like this: + +``` +{ + "findings": [ + { + "title": "Finding 1 Title", + "description": "Finding 1 Description", + "severity": "CRITICAL", + "CVE": "CVE-2025-12345", + ... + }, + { + "title": "Finding 2 Title", + "description": "Finding 2 Description", + "severity": "LOW", + "CVE": "CVE-2025-54321", + ... + }, + ... + + ] +} +``` + +You'll see a hierarchical representation of the unique fields we detected based on the structure of the input file, with icons indicating the type of each field (if we can determine this). You can then select the "title" input field in the drop-down menu that populates the "Title" output field, the "description" input field can go with the "Description" output field, and so on. + +Input field names don't have to match the names of output fields, and your scan file may not have an equivalent to all DefectDojo output fields. + +### Required fields +The following output fields require an input field mapping: + +* Title +* Severity +* Description + +### About severities +A Universal Parser will accept any case variation of the DefectDojo severities - "CRITICAL", "Critical", "cRiTiCaL", etc. - and apply it to your findings. Any value that doesn't match a DefectDojo severity will be replaced with "Info". This mirrors how parsers and Connectors work today: unknown values are generally mapped to "Info". + +### Multi-select fields +Some output fields will accept multiple input fields. If you decide to select more than one input field, we will provide that field's value under a header with that input field's name. + +Example + +`description` + +This was pulled from a field called "description" in the input file + +`detailed_description` + +This was pulled from a field called "detailed_description" in the input file + +## Step 3: Previewing your Findings + +Once you've selected your mappings from input fields to output fields, you can click the "Next" button to see a preview of what the Findings from your input file will look like once they are imported to DefectDojo with your chosen configuration. Some fields will have an "expand" button next to them to allow you to see the full, rendered MarkDown of what that field will look like. We will only render previews of the first 25 Findings from your input file, but you can also see how many findings were detected in the whole scan file. + +If the previews don't look like you expected, you can hit the "Back" button to tweak the mappings. Once you are satisfied with your configuration, click the "Submit" button to create your new Universal Parser. This will not perform an import automatically. + +Once your Universal Parser is created, you'll be redirected to the "Add Findings" page where you can upload and import a scan file matching the structure of the example file you provided in Step 1. + +## Additional notes about Universal Parser configuration + +### Choosing the right input fields + +Each vendor may produce very different scan report formats, some of which will map more closely to DefectDojo's finding model than others. We allow for significant flexibility in what we will accept, but we must impose some structure to ensure that findings don't get garbled in the translation from input to output. While we can accommodate optional input fields, we don't accept "global" fields, or fields that occur a different number of times than the number of finding objects. + +#### Example + +``` +{ + "scan_type": "MyToolScan", // <- There is only one instance of this field, which doesn't match the number of findings + "findings": [ + { + "title": "Finding 1 Title", + "description": "Finding 1 Description", + "severity": "CRITICAL", + "CVE": "CVE-2025-12345", // <- This optional field only appears in Finding 1 - that's okay! + ... + }, + { + "title": "Finding 2 Title", + "description": "Finding 2 Description", + "severity": "CRITICAL", + ... // <- While there is no "CVE" field here, we can still query for it and simply default to a null value + }, + ... 5 more findings ... + ], + "global_details": [ + { + "nested_detail": "Global detail 1" + }, + { + "nested_detail": "Global detail 2" // <- The number of "global_details" objects (2) does not match the number of individual finding objects (7) + } + + ] +} +``` + +## After saving a Universal Parser + +You can edit the Test_Type associated with your Universal Parser to change: +* Whether it is "active" or not. If not, it will not appear as an option in the "Scan Type" drop-down on the "Add Findings" page +* Whether its findings should be marked "static" or "dynamic" +* You can tweak the same-tool and cross-tool deduplication hash codes, as well as the reimport hash codes, for your Universal Parser under "Enterprise Settings". By default, only same-tool deduplication and reimport hash codes are populated, with the required values Title, Severity, and Description. diff --git a/dojo/engagement/views.py b/dojo/engagement/views.py index b45b417e39c..706210b569c 100644 --- a/dojo/engagement/views.py +++ b/dojo/engagement/views.py @@ -4,7 +4,7 @@ import operator import re import time -from datetime import datetime +from datetime import datetime, timedelta from functools import partial, reduce from pathlib import Path from tempfile import NamedTemporaryFile @@ -142,6 +142,9 @@ def engagement_calendar(request): engagements = engagements.select_related("lead") engagements = engagements.prefetch_related("product") + for e in engagements: + if e.target_end: + e.target_end += timedelta(days=1) add_breadcrumb( title="Engagement Calendar", top_level=True, request=request) return render( diff --git a/dojo/forms.py b/dojo/forms.py index 3ed2961c170..77bbcc57266 100644 --- a/dojo/forms.py +++ b/dojo/forms.py @@ -1131,6 +1131,18 @@ def __init__(self, *args, **kwargs): else: self.fields["lead"].queryset = get_authorized_users(Permissions.Test_View).filter(is_active=True) + def is_valid(self): + valid = super().is_valid() + + # we're done now if not valid + if not valid: + return valid + if self.cleaned_data["target_start"] > self.cleaned_data["target_end"]: + self.add_error("target_start", "Your target start date exceeds your target end date") + self.add_error("target_end", "Your target start date exceeds your target end date") + return False + return True + class Meta: model = Test fields = ["title", "test_type", "target_start", "target_end", "description", diff --git a/dojo/importers/default_importer.py b/dojo/importers/default_importer.py index 726e55717eb..188a31b6acb 100644 --- a/dojo/importers/default_importer.py +++ b/dojo/importers/default_importer.py @@ -226,7 +226,11 @@ def process_findings( # Process any endpoints on the endpoint, or added on the form self.process_endpoints(finding, self.endpoints_to_add) # Parsers must use unsaved_tags to store tags, so we can clean them - finding.tags = clean_tags(finding.unsaved_tags) + cleaned_tags = clean_tags(finding.unsaved_tags) + if isinstance(cleaned_tags, list): + finding.tags.set(cleaned_tags) + elif isinstance(cleaned_tags, str): + finding.tags.set([cleaned_tags]) # Process any files self.process_files(finding) # Process vulnerability IDs diff --git a/dojo/importers/default_reimporter.py b/dojo/importers/default_reimporter.py index f6c687c2f53..a5d6bdc30c0 100644 --- a/dojo/importers/default_reimporter.py +++ b/dojo/importers/default_reimporter.py @@ -700,8 +700,12 @@ def finding_post_processing( if len(self.endpoints_to_add) > 0: self.endpoint_manager.chunk_endpoints_and_disperse(finding, self.endpoints_to_add) # Parsers must use unsaved_tags to store tags, so we can clean them - if finding.unsaved_tags: - finding.tags = clean_tags(finding.unsaved_tags) + if finding_from_report.unsaved_tags: + cleaned_tags = clean_tags(finding_from_report.unsaved_tags) + if isinstance(cleaned_tags, list): + finding.tags.set(cleaned_tags) + elif isinstance(cleaned_tags, str): + finding.tags.set([cleaned_tags]) # Process any files if finding_from_report.unsaved_files: finding.unsaved_files = finding_from_report.unsaved_files diff --git a/dojo/middleware.py b/dojo/middleware.py index 5b50f3cc987..8c7cb55d2d3 100644 --- a/dojo/middleware.py +++ b/dojo/middleware.py @@ -16,7 +16,7 @@ from django.shortcuts import redirect from django.urls import reverse from django.utils.functional import SimpleLazyObject -from social_core.exceptions import AuthCanceled, AuthFailed, AuthForbidden +from social_core.exceptions import AuthCanceled, AuthFailed, AuthForbidden, AuthTokenError from social_django.middleware import SocialAuthExceptionMiddleware from watson.middleware import SearchContextMiddleware from watson.search import search_context_manager @@ -83,20 +83,23 @@ def __call__(self, request): class CustomSocialAuthExceptionMiddleware(SocialAuthExceptionMiddleware): def process_exception(self, request, exception): if isinstance(exception, requests.exceptions.RequestException): - messages.error(request, "Please use the standard login below.") + messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_REQUEST_EXCEPTION) return redirect("/login?force_login_form") if isinstance(exception, AuthCanceled): - messages.warning(request, "Social login was canceled. Please try again or use the standard login.") + messages.warning(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_CANCELED) return redirect("/login?force_login_form") if isinstance(exception, AuthFailed): - messages.error(request, "Social login failed. Please try again or use the standard login.") + messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FAILED) return redirect("/login?force_login_form") if isinstance(exception, AuthForbidden): - messages.error(request, "You are not authorized to log in via this method. Please contact support or use the standard login.") + messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FORBIDDEN) + return redirect("/login?force_login_form") + if isinstance(exception, AuthTokenError): + messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_TOKEN_ERROR) return redirect("/login?force_login_form") if isinstance(exception, TypeError) and "'NoneType' object is not iterable" in str(exception): logger.warning("OIDC login error: NoneType is not iterable") - messages.error(request, "An unexpected error occurred during social login. Please use the standard login.") + messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_NONE_TYPE) return redirect("/login?force_login_form") logger.error(f"Unhandled exception during social login: {exception}") return super().process_exception(request, exception) diff --git a/dojo/models.py b/dojo/models.py index aadd28bbc6f..dd025908626 100644 --- a/dojo/models.py +++ b/dojo/models.py @@ -1093,8 +1093,8 @@ def save(self, *args, **kwargs): product.async_updating = True super(Product, product).save() # launch the async task to update all finding sla expiration dates - from dojo.sla_config.helpers import update_sla_expiration_dates_sla_config_async # noqa: I001, PLC0415 circular import - update_sla_expiration_dates_sla_config_async(self, products, tuple(severities)) + from dojo.sla_config.helpers import async_update_sla_expiration_dates_sla_config_sync # noqa: I001, PLC0415 circular import + async_update_sla_expiration_dates_sla_config_sync(self, products, severities=severities) def clean(self): sla_days = [self.critical, self.high, self.medium, self.low] @@ -1255,8 +1255,8 @@ def save(self, *args, **kwargs): sla_config.async_updating = True super(SLA_Configuration, sla_config).save() # launch the async task to update all finding sla expiration dates - from dojo.sla_config.helpers import update_sla_expiration_dates_product_async # noqa: I001, PLC0415 circular import - update_sla_expiration_dates_product_async(self, sla_config) + from dojo.sla_config.helpers import async_update_sla_expiration_dates_sla_config_sync # noqa: I001, PLC0415 circular import + async_update_sla_expiration_dates_sla_config_sync(sla_config, Product.objects.filter(id=self.id)) def get_absolute_url(self): return reverse("view_product", args=[str(self.id)]) @@ -3151,16 +3151,25 @@ def get_sla_configuration(self): return self.test.engagement.product.sla_configuration def get_sla_period(self): + # Determine which method to use to calculate the SLA + from dojo.utils import get_custom_method # noqa: PLC0415 circular import + if method := get_custom_method("FINDING_SLA_PERIOD_METHOD"): + return method(self) + # Run the default method sla_configuration = self.get_sla_configuration() sla_period = getattr(sla_configuration, self.severity.lower(), None) enforce_period = getattr(sla_configuration, str("enforce_" + self.severity.lower()), None) return sla_period, enforce_period def set_sla_expiration_date(self): + # First check if SLA is enabled globally system_settings = System_Settings.objects.get() if not system_settings.enable_finding_sla: return + # Call the internal method to set the sla expiration date + self._set_sla_expiration_date() + def _set_sla_expiration_date(self): # some parsers provide date as a `str` instead of a `date` in which case we need to parse it #12299 on GitHub sla_start_date = self.get_sla_start_date() if sla_start_date and isinstance(sla_start_date, str): diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py index b435f4970b8..8e636470db4 100644 --- a/dojo/settings/settings.dist.py +++ b/dojo/settings/settings.dist.py @@ -175,6 +175,12 @@ DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_KEY=(str, ""), DD_SOCIAL_AUTH_GITHUB_ENTERPRISE_SECRET=(str, ""), DD_SOCIAL_AUTH_USERNAME_IS_FULL_EMAIL=(bool, True), + DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_REQUEST_EXCEPTION=(str, "Please use the standard login below."), + DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_CANCELED=(str, "Social login was canceled. Please try again or use the standard login."), + DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FAILED=(str, "Social login failed. Please try again or use the standard login."), + DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FORBIDDEN=(str, "You are not authorized to log in via this method. Please contact support or use the standard login."), + DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_NONE_TYPE=(str, "An unexpected error occurred during social login. Please use the standard login."), + DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_TOKEN_ERROR=(str, "Social login failed due to an invalid or expired token. Please try again or use the standard login."), DD_SAML2_ENABLED=(bool, False), # Allows to override default SAML authentication backend. Check https://djangosaml2.readthedocs.io/contents/setup.html#custom-user-attributes-processing DD_SAML2_AUTHENTICATION_BACKENDS=(str, "djangosaml2.backends.Saml2Backend"), @@ -651,6 +657,13 @@ def generate_url(scheme, double_slashes, user, password, host, port, path, param if value := env("DD_SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT"): SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT = value +SOCIAL_AUTH_EXCEPTION_MESSAGE_REQUEST_EXCEPTION = env("DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_REQUEST_EXCEPTION") +SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_CANCELED = env("DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_CANCELED") +SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FAILED = env("DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FAILED") +SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FORBIDDEN = env("DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FORBIDDEN") +SOCIAL_AUTH_EXCEPTION_MESSAGE_NONE_TYPE = env("DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_NONE_TYPE") +SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_TOKEN_ERROR = env("DD_SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_TOKEN_ERROR") + AUTH0_OAUTH2_ENABLED = env("DD_SOCIAL_AUTH_AUTH0_OAUTH2_ENABLED") SOCIAL_AUTH_AUTH0_KEY = env("DD_SOCIAL_AUTH_AUTH0_KEY") SOCIAL_AUTH_AUTH0_SECRET = env("DD_SOCIAL_AUTH_AUTH0_SECRET") diff --git a/dojo/sla_config/helpers.py b/dojo/sla_config/helpers.py index 57633d0c2ec..da5899a85b0 100644 --- a/dojo/sla_config/helpers.py +++ b/dojo/sla_config/helpers.py @@ -2,26 +2,27 @@ from dojo.celery import app from dojo.decorators import dojo_async_task -from dojo.models import Finding, Product, SLA_Configuration -from dojo.utils import calculate_grade, mass_model_updater +from dojo.models import Finding, Product, SLA_Configuration, System_Settings +from dojo.utils import get_custom_method, mass_model_updater logger = logging.getLogger(__name__) @dojo_async_task @app.task -def update_sla_expiration_dates_sla_config_async(sla_config, products, severities, *args, **kwargs): - update_sla_expiration_dates_sla_config_sync(sla_config, products, severities) +def async_update_sla_expiration_dates_sla_config_sync(sla_config: SLA_Configuration, products: list[Product], *args, severities: list[str] | None = None, **kwargs): + if method := get_custom_method("FINDING_SLA_EXPIRATION_CALCULATION_METHOD"): + method(sla_config, products, severities=severities) + else: + update_sla_expiration_dates_sla_config_sync(sla_config, products, severities=severities) -@dojo_async_task -@app.task -def update_sla_expiration_dates_product_async(product, sla_config, *args, **kwargs): - update_sla_expiration_dates_sla_config_sync(sla_config, [product]) - - -def update_sla_expiration_dates_sla_config_sync(sla_config, products, severities=None): +def update_sla_expiration_dates_sla_config_sync(sla_config: SLA_Configuration, products: list[Product], severities: list[str] | None = None): logger.info("Updating finding SLA expiration dates within the %s SLA configuration", sla_config) + # First check if SLA is enabled globally + system_settings = System_Settings.objects.get() + if not system_settings.enable_finding_sla: + return # update each finding that is within the SLA configuration that was saved findings = Finding.objects.filter(test__engagement__product__sla_configuration_id=sla_config.id) if products: @@ -29,22 +30,22 @@ def update_sla_expiration_dates_sla_config_sync(sla_config, products, severities if severities: findings = findings.filter(severity__in=severities) - findings = findings.prefetch_related( + findings = ( + findings.prefetch_related( "test", "test__engagement", "test__engagement__product", "test__engagement__product__sla_configuration", + ) + .order_by("id") + .only("id", "sla_start_date", "date", "severity", "test") ) - - findings = findings.order_by("id").only("id", "sla_start_date", "date", "severity", "test") - + # Call the internal method so that we are not checking system settings for each finding mass_model_updater(Finding, findings, lambda f: f.set_sla_expiration_date(), fields=["sla_expiration_date"]) # reset the async updating flag to false for all products using this sla config - for product in products: - product.async_updating = False - super(Product, product).save() - calculate_grade(product) + # use update as we don't want save() and signals to be triggered + products.update(async_updating=False) # reset the async updating flag to false for this sla config sla_config.async_updating = False diff --git a/dojo/test/views.py b/dojo/test/views.py index b5777f15cac..4249ff7a270 100644 --- a/dojo/test/views.py +++ b/dojo/test/views.py @@ -3,7 +3,7 @@ import logging import operator import time -from datetime import datetime +from datetime import datetime, timedelta from functools import reduce from django.contrib import messages @@ -393,6 +393,9 @@ def test_calendar(request): tests = tests.prefetch_related("test_type", "lead", "engagement__product") add_breadcrumb(title=_("Test Calendar"), top_level=True, request=request) + for t in tests: + if t.target_end: + t.target_end += timedelta(days=1) return render(request, "dojo/calendar.html", { "caltype": "tests", "leads": request.GET.getlist("lead", ""), diff --git a/dojo/tools/nancy/parser.py b/dojo/tools/nancy/parser.py index 52b45bc52ee..2d4f4d986eb 100644 --- a/dojo/tools/nancy/parser.py +++ b/dojo/tools/nancy/parser.py @@ -1,6 +1,7 @@ import json from cvss.cvss3 import CVSS3 +from cvss.cvss4 import CVSS4 from dojo.models import Finding @@ -64,17 +65,18 @@ def get_items(self, vulnerable, test): out_of_scope=False, static_finding=True, dynamic_finding=False, - vuln_id_from_tool=associated_vuln["Id"], + vuln_id_from_tool=associated_vuln.get("Id", associated_vuln.get("ID")), references="\n".join(references), ) - finding.unsaved_vulnerability_ids = vulnerability_ids - + cvss_vector = associated_vuln["CvssVector"] # CVSSv3 vector - if associated_vuln["CvssVector"]: + if cvss_vector and cvss_vector.startswith("CVSS:3."): finding.cvssv3 = CVSS3( associated_vuln["CvssVector"]).clean_vector() - + elif cvss_vector and cvss_vector.startswith("CVSS:4."): + finding.cvssv4 = CVSS4( + associated_vuln["CvssVector"]).clean_vector() # do we have a CWE? if associated_vuln["Title"].startswith("CWE-"): cwe = (associated_vuln["Title"] diff --git a/helm/defectdojo/Chart.yaml b/helm/defectdojo/Chart.yaml index f38e5988843..3e3ef73d073 100644 --- a/helm/defectdojo/Chart.yaml +++ b/helm/defectdojo/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 appVersion: "2.53.0-dev" description: A Helm chart for Kubernetes to install DefectDojo name: defectdojo -version: 1.8.1-dev +version: 1.8.2-dev icon: https://defectdojo.com/hubfs/DefectDojo_favicon.png maintainers: - name: madchap diff --git a/helm/defectdojo/README.md b/helm/defectdojo/README.md index 7fd44828e41..aa468e6bc61 100644 --- a/helm/defectdojo/README.md +++ b/helm/defectdojo/README.md @@ -495,7 +495,7 @@ kubectl delete pvc data-defectdojo-redis-0 data-defectdojo-postgresql-0 # General information about chart values -![Version: 1.8.1-dev](https://img.shields.io/badge/Version-1.8.1--dev-informational?style=flat-square) ![AppVersion: 2.53.0-dev](https://img.shields.io/badge/AppVersion-2.53.0--dev-informational?style=flat-square) +![Version: 1.8.2-dev](https://img.shields.io/badge/Version-1.8.2--dev-informational?style=flat-square) ![AppVersion: 2.53.0-dev](https://img.shields.io/badge/AppVersion-2.53.0--dev-informational?style=flat-square) A Helm chart for Kubernetes to install DefectDojo @@ -674,11 +674,11 @@ A Helm chart for Kubernetes to install DefectDojo | host | string | `"defectdojo.default.minikube.local"` | Primary hostname of instance | | imagePullPolicy | string | `"Always"` | | | imagePullSecrets | string | `nil` | When using a private registry, name of the secret that holds the registry secret (eg deploy token from gitlab-ci project) Create secrets as: kubectl create secret docker-registry defectdojoregistrykey --docker-username=registry_username --docker-password=registry_password --docker-server='https://index.docker.io/v1/' | -| images.django.image.digest | string | `""` | Prefix "sha@" is expected in this place | +| images.django.image.digest | string | `""` | Prefix "sha256:" is expected in this place | | images.django.image.registry | string | `""` | | | images.django.image.repository | string | `"defectdojo/defectdojo-django"` | | | images.django.image.tag | string | `""` | If empty, use appVersion. Another possible values are: latest, X.X.X, X.X.X-debian, X.X.X-alpine (where X.X.X is version of DD). For dev builds (only for testing purposes): nightly-dev, nightly-dev-debian, nightly-dev-alpine. To see all, check https://hub.docker.com/r/defectdojo/defectdojo-django/tags. | -| images.nginx.image.digest | string | `""` | Prefix "sha@" is expected in this place | +| images.nginx.image.digest | string | `""` | Prefix "sha256:" is expected in this place | | images.nginx.image.registry | string | `""` | | | images.nginx.image.repository | string | `"defectdojo/defectdojo-nginx"` | | | images.nginx.image.tag | string | `""` | If empty, use appVersion. Another possible values are: latest, X.X.X, X.X.X-alpine (where X.X.X is version of DD). For dev builds (only for testing purposes): nightly-dev, nightly-dev-alpine. To see all, check https://hub.docker.com/r/defectdojo/defectdojo-nginx/tags. | diff --git a/helm/defectdojo/templates/media-pvc.yaml b/helm/defectdojo/templates/media-pvc.yaml index 57fcae8e0c7..a6aa54005d8 100644 --- a/helm/defectdojo/templates/media-pvc.yaml +++ b/helm/defectdojo/templates/media-pvc.yaml @@ -4,7 +4,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: - {{- with .Values.extraAnnotations }} + {{- with $.Values.extraAnnotations }} annotations: {{- range $key, $value := . }} {{ $key }}: {{ quote $value }} @@ -16,19 +16,19 @@ metadata: app.kubernetes.io/instance: {{ $.Release.Name }} app.kubernetes.io/managed-by: {{ $.Release.Service }} helm.sh/chart: {{ include "defectdojo.chart" $ }} - {{- range $key, $value := .Values.extraLabels }} + {{- range $key, $value := $.Values.extraLabels }} {{ $key }}: {{ quote $value }} {{- end }} name: {{ $fullName }} - namespace: {{ .Release.Namespace }} + namespace: {{ $.Release.Namespace }} spec: accessModes: {{- toYaml .persistentVolumeClaim.accessModes | nindent 4 }} resources: requests: storage: {{ .persistentVolumeClaim.size }} - {{- if .persistentVolumeClaim.storageClassName }} - storageClassName: {{ .persistentVolumeClaim.storageClassName }} + {{- with .persistentVolumeClaim.storageClassName }} + storageClassName: {{ . }} {{- end }} {{- end }} {{- end }} diff --git a/helm/defectdojo/values.schema.json b/helm/defectdojo/values.schema.json index 76b1411877d..29331072e96 100644 --- a/helm/defectdojo/values.schema.json +++ b/helm/defectdojo/values.schema.json @@ -865,7 +865,7 @@ "type": "object", "properties": { "digest": { - "description": "Prefix \"sha@\" is expected in this place", + "description": "Prefix \"sha256:\" is expected in this place", "type": "string" }, "registry": { @@ -889,7 +889,7 @@ "type": "object", "properties": { "digest": { - "description": "Prefix \"sha@\" is expected in this place", + "description": "Prefix \"sha256:\" is expected in this place", "type": "string" }, "registry": { diff --git a/helm/defectdojo/values.yaml b/helm/defectdojo/values.yaml index cd850ace3c1..cf04f33bf11 100644 --- a/helm/defectdojo/values.yaml +++ b/helm/defectdojo/values.yaml @@ -37,7 +37,7 @@ images: # For dev builds (only for testing purposes): nightly-dev, nightly-dev-debian, nightly-dev-alpine. # To see all, check https://hub.docker.com/r/defectdojo/defectdojo-django/tags. tag: "" - # -- Prefix "sha@" is expected in this place + # -- Prefix "sha256:" is expected in this place digest: "" nginx: image: @@ -48,7 +48,7 @@ images: # For dev builds (only for testing purposes): nightly-dev, nightly-dev-alpine. # To see all, check https://hub.docker.com/r/defectdojo/defectdojo-nginx/tags. tag: "" - # -- Prefix "sha@" is expected in this place + # -- Prefix "sha256:" is expected in this place digest: "" # -- Enables application network policy diff --git a/requirements.txt b/requirements.txt index dd924805be1..776b32ce4b8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -18,7 +18,7 @@ django_extensions==4.1 django-slack==5.19.0 django-watson==1.6.3 django-prometheus==2.4.1 -Django==5.1.13 +Django==5.1.14 django-single-session==0.2.0 djangorestframework==3.16.1 html2text==2025.4.15 diff --git a/unittests/scans/generic/generic_report1_more_tags.json b/unittests/scans/generic/generic_report1_more_tags.json new file mode 100644 index 00000000000..0c383ea5552 --- /dev/null +++ b/unittests/scans/generic/generic_report1_more_tags.json @@ -0,0 +1,34 @@ +{ + "findings": [ + { + "title": "test title", + "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau", + "active": true, + "verified": true, + "severity": "Medium", + "impact": "Some impact", + "date": "2021-01-06", + "cve": "CVE-2020-36234", + "cwe": 261, + "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", + "tags": ["security", "network", "hardened"], + "unique_id_from_tool": "3287f2d0-554f-491b-8516-3c349ead8ee5", + "vuln_id_from_tool": "TEST1" + }, + { + "title": "test title2", + "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau2", + "active": true, + "verified": false, + "severity": "Medium", + "impact": "Some impact", + "date": "2021-01-06", + "cve": "CVE-2020-36235", + "cwe": 287, + "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", + "tags": ["security", "network", "hardened"], + "unique_id_from_tool": "42500af3-68c5-4dc3-8022-191d93c2f1f7", + "vuln_id_from_tool": "TEST2" + } + ] +} \ No newline at end of file diff --git a/unittests/scans/nancy/issue_12860.json b/unittests/scans/nancy/issue_12860.json new file mode 100644 index 00000000000..d2b767c2b88 --- /dev/null +++ b/unittests/scans/nancy/issue_12860.json @@ -0,0 +1,147 @@ +{ + "audited": [ + { + "Coordinates": "pkg:golang/github.com/ulikunitz/xz@v0.5.9", + "Reference": "https://ossindex.sonatype.org/component/pkg:golang/github.com/ulikunitz/xz@v0.5.9?utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Vulnerabilities": [ + { + "ID": "CVE-2025-58058", + "Title": "[CVE-2025-58058] CWE-770: Allocation of Resources Without Limits or Throttling", + "Description": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.", + "CvssScore": "5.3", + "CvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "Cve": "CVE-2025-58058", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2025-58058?component-type=golang&component-name=github.com%2Fulikunitz%2Fxz&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + } + ], + "InvalidSemVer": false + }, + { + "Coordinates": "pkg:golang/golang.org/x/crypto@v0.0.0-20190227175134-215aa809caaf", + "Reference": "https://ossindex.sonatype.org/component/pkg:golang/golang.org/x/crypto@v0.0.0-20190227175134-215aa809caaf?utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Vulnerabilities": [ + { + "ID": "CVE-2022-27191", + "Title": "[CVE-2022-27191] CWE-noinfo", + "Description": "The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.", + "CvssScore": "7.5", + "CvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "Cve": "CVE-2022-27191", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2022-27191?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + }, + { + "ID": "CVE-2023-48795", + "Title": "[CVE-2023-48795] CWE-354: Improper Validation of Integrity Check Value", + "Description": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-48795 for details", + "CvssScore": "5.9", + "CvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", + "Cve": "CVE-2023-48795", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2023-48795?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + }, + { + "ID": "CVE-2024-45337", + "Title": "[CVE-2024-45337] CWE-863: Incorrect Authorization", + "Description": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.", + "CvssScore": "7.6", + "CvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", + "Cve": "CVE-2024-45337", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2024-45337?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + }, + { + "ID": "CVE-2025-22869", + "Title": "[CVE-2025-22869] CWE-770: Allocation of Resources Without Limits or Throttling", + "Description": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.", + "CvssScore": "6.9", + "CvssVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "Cve": "CVE-2025-22869", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2025-22869?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + } + ], + "InvalidSemVer": false + }, + { + "Coordinates": "pkg:golang/golang.org/x/text@v0.3.0", + "Reference": "https://ossindex.sonatype.org/component/pkg:golang/golang.org/x/text@v0.3.0?utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Vulnerabilities": [], + "InvalidSemVer": false + } + ], + "excluded": null, + "exclusions": [], + "invalid": [], + "num_audited": 3, + "num_exclusions": 0, + "num_vulnerable": 2, + "version": "1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "vulnerable": [ + { + "Coordinates": "pkg:golang/github.com/ulikunitz/xz@v0.5.9", + "Reference": "https://ossindex.sonatype.org/component/pkg:golang/github.com/ulikunitz/xz@v0.5.9?utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Vulnerabilities": [ + { + "ID": "CVE-2025-58058", + "Title": "[CVE-2025-58058] CWE-770: Allocation of Resources Without Limits or Throttling", + "Description": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.", + "CvssScore": "5.3", + "CvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "Cve": "CVE-2025-58058", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2025-58058?component-type=golang&component-name=github.com%2Fulikunitz%2Fxz&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + } + ], + "InvalidSemVer": false + }, + { + "Coordinates": "pkg:golang/golang.org/x/crypto@v0.0.0-20190227175134-215aa809caaf", + "Reference": "https://ossindex.sonatype.org/component/pkg:golang/golang.org/x/crypto@v0.0.0-20190227175134-215aa809caaf?utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Vulnerabilities": [ + { + "ID": "CVE-2022-27191", + "Title": "[CVE-2022-27191] CWE-noinfo", + "Description": "The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.", + "CvssScore": "7.5", + "CvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "Cve": "CVE-2022-27191", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2022-27191?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + }, + { + "ID": "CVE-2023-48795", + "Title": "[CVE-2023-48795] CWE-354: Improper Validation of Integrity Check Value", + "Description": "The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-48795 for details", + "CvssScore": "5.9", + "CvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", + "Cve": "CVE-2023-48795", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2023-48795?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + }, + { + "ID": "CVE-2024-45337", + "Title": "[CVE-2024-45337] CWE-863: Incorrect Authorization", + "Description": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.", + "CvssScore": "7.6", + "CvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", + "Cve": "CVE-2024-45337", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2024-45337?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + }, + { + "ID": "CVE-2025-22869", + "Title": "[CVE-2025-22869] CWE-770: Allocation of Resources Without Limits or Throttling", + "Description": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.", + "CvssScore": "6.9", + "CvssVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", + "Cve": "CVE-2025-22869", + "Reference": "https://ossindex.sonatype.org/vulnerability/CVE-2025-22869?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.52-next-c4870647da6f9c6f78060307eacc7267a8d81b4d", + "Excluded": false + } + ], + "InvalidSemVer": false + } + ] +} \ No newline at end of file diff --git a/unittests/test_parsers.py b/unittests/test_parsers.py index 95857154de8..ae88f73b924 100644 --- a/unittests/test_parsers.py +++ b/unittests/test_parsers.py @@ -29,7 +29,7 @@ def test_file_existence(self): "sysdig_common", # common classes for sysdig parsers }: with self.subTest(parser=parser_dir.name, category="docs"): - doc_file = Path(basedir) / "docs" / "content" / "en" / "connecting_your_tools" / "parsers" / category / f"{doc_name}.md" + doc_file = Path(basedir) / "docs" / "content" / "supported_tools" / "parsers" / category / f"{doc_name}.md" self.assertTrue( Path(doc_file).is_file(), f"Documentation file '{doc_file}' is missing or using different name", @@ -106,7 +106,7 @@ def test_file_existence(self): i = 0 def test_parser_existence(self): - for docs in os.scandir(Path(basedir) / "docs" / "content" / "en" / "connecting_your_tools" / "parsers" / "file"): + for docs in os.scandir(Path(basedir) / "docs" / "content" / "supported_tools" / "parsers" / "file"): if docs.name not in { "_index.md", "codeql.md", "edgescan.md", }: diff --git a/unittests/test_social_auth_failure_handling.py b/unittests/test_social_auth_failure_handling.py index 0cf55f8d860..808a5bb7c97 100644 --- a/unittests/test_social_auth_failure_handling.py +++ b/unittests/test_social_auth_failure_handling.py @@ -7,7 +7,7 @@ from django.http import HttpResponse from django.test import RequestFactory, override_settings from requests.exceptions import ConnectionError as RequestsConnectionError -from social_core.exceptions import AuthCanceled, AuthFailed, AuthForbidden +from social_core.exceptions import AuthCanceled, AuthFailed, AuthForbidden, AuthTokenError from dojo.middleware import CustomSocialAuthExceptionMiddleware @@ -52,6 +52,7 @@ def test_social_auth_exception_redirects_to_login(self): (AuthCanceled("User canceled login"), "Social login was canceled. Please try again or use the standard login."), (AuthFailed("Token exchange failed"), "Social login failed. Please try again or use the standard login."), (AuthForbidden("User not allowed"), "You are not authorized to log in via this method. Please contact support or use the standard login."), + (AuthTokenError("Invalid or expired token"), "Social login failed due to an invalid or expired token. Please try again or use the standard login."), ] for path in login_paths: for exception, expected_message in exceptions: diff --git a/unittests/test_tags.py b/unittests/test_tags.py index 994c0ce5480..f4723ae8bcb 100644 --- a/unittests/test_tags.py +++ b/unittests/test_tags.py @@ -15,8 +15,9 @@ class TagTests(DojoAPITestCase): def setUp(self, *args, **kwargs): super().setUp() self.login_as_admin() - self.scans_path = get_unit_tests_scans_path("zap") - self.zap_sample5_filename = self.scans_path / "5_zap_sample_one.xml" + self.zap_sample5_filename = get_unit_tests_scans_path("zap") / "5_zap_sample_one.xml" + self.generic_sample_with_tags_filename = get_unit_tests_scans_path("generic") / "generic_report1.json" + self.generic_sample_with_more_tags_filename = get_unit_tests_scans_path("generic") / "generic_report1_more_tags.json" def test_create_product_with_tags(self, expected_status_code: int = 201): product_id = Product.objects.all().first().id @@ -285,6 +286,28 @@ def test_import_multipart_tags(self): for tag in success_tags: self.assertIn(tag, response["tags"]) + def test_import_report_with_tags(self): + def assert_tags_in_findings(findings: list[dict], expected_finding_count: int, desired_tags: list[str]) -> None: + self.assertEqual(expected_finding_count, len(findings)) + for finding in findings: + self.assertEqual(len(desired_tags), len(finding.get("tags"))) + for tag in desired_tags: + self.assertIn(tag, finding["tags"]) + + # Import a report with findings that have tags + import0 = self.import_scan_with_params(self.generic_sample_with_tags_filename, scan_type="Generic Findings Import") + test_id = import0["test"] + response = self.get_test_findings_api(test_id) + findings = response["results"] + # Make sure we have what we are looking for + assert_tags_in_findings(findings, 2, ["security", "network"]) + # Reimport with a different report that has more tags + self.reimport_scan_with_params(test_id, self.generic_sample_with_more_tags_filename, scan_type="Generic Findings Import") + response = self.get_test_findings_api(test_id) + findings = response["results"] + # Make sure we have what we are looking for + assert_tags_in_findings(findings, 2, ["security", "network", "hardened"]) + class InheritedTagsTests(DojoAPITestCase): fixtures = ["dojo_testdata.json"] diff --git a/unittests/tools/test_nancy_parser.py b/unittests/tools/test_nancy_parser.py index bd21cc44adc..09b3194360d 100644 --- a/unittests/tools/test_nancy_parser.py +++ b/unittests/tools/test_nancy_parser.py @@ -35,3 +35,14 @@ def test_nancy_plus_parser_with_many_vuln_has_many_findings(self): self.assertEqual(0, finding.cwe) self.assertIsNotNone(finding.description) self.assertGreater(len(finding.description), 0) + + def test_nancy_issue_12860(self): + with (get_unit_tests_scans_path("nancy") / "issue_12860.json").open(encoding="utf-8") as testfile: + parser = NancyParser() + findings = parser.get_findings(testfile, Test()) + self.assertEqual(5, len(findings)) + with self.subTest(i=0): + finding = findings[0] + self.assertEqual("[CVE-2025-58058] CWE-770: Allocation of Resources Without Limits or Throttling", finding.title) + finding = findings[3] + self.assertEqual("[CVE-2024-45337] CWE-863: Incorrect Authorization", finding.title)