---- GSoC'19 Final Report | OWASP Foundation ( Project- DefectDojo) ----
I’m Saurabh Kumar, and this is my final report for Google Summer of Code 2019, which I spent working with the OWASP Foundation on DefectDojo.
DefectDojo is an application security tool that automates the management of security vulnerabilities. It handles importing third-party security findings, merging and deduplication, Jira integration, templating, report generation, and security metrics, all of which cut down the manual overhead of running an application security program.
Here’s what I built and fixed over the summer.
Organization: OWASP Foundation
Category: DefectDojo
Mentor: Aaron Weaver
The work broke down into new scan parsers, bug fixes, and unit tests.
Scan Parsers Implemented
-
Kiuwan Scan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1118] - Merged.
-
Openscap Scan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1193] - Merged.
-
Wapiti Scan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1206] - Merged.
-
Cobalt.io Scan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1215] - Merged.
-
Mozilla Observatory Scan Importer:
- Parser implemented.
- Unit tests added.
- Pull Request [#1226] - Merged.
-
Whitesource Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1243] - Merged.
-
Microfocus Webinspect Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1268] - Merged.
-
Wpscan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1345] - Merged.
-
Sslscan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1351] - Merged.
-
Sslyze Scan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1376] - Merged.
-
Testssl Scan Importer:
- Parser implemented.
- Unit tests added.
- [Pull Request #1397] - Merged.
Issues Fixed
Bugs I tracked down and fixed over the course of the project:
- Kiuwan CWE issue fixed - [Pull Request #1175] - Merged.
- Repo field issue resolved - [Pull Request #1177] - Merged.
- Added CVE option in findings - [Pull Request #1106] - Merged.
- Product grading issue fixed - [Pull Request #1082] - Merged.
- Static and dynamic type finding issue resolved - [Pull Request #1050] - Merged.
- Markdown_render function fixed - [Pull Request #1049] - Merged.
- Fixed #1257 and Unicode error in Contrast importer - [Pull Request #1260] - Merged.
- SSLLabs scanner issue fixed if suites not provided - [Pull Request #1367] - Merged.
- Status column now displays under review option correctly - [Pull Request #1373] - Merged.
- Veracode static and dynamic issue fixed - [Pull Request #1377] - Merged.
- Included tags in reports - [Pull Request #1400] - Merged.
- User edit form fixed to remove products - [Pull Request #1420] - Merged.
- Added current commit hash in footer - [Pull Request #1440] - Merged.
- Fixed Dependency parser - [Pull Request #1455] - Merged.
- Fixed clair klar importer - [Pull Request #1459] - Merged.
- Immuniweb issue of ValueError resolved - [Pull Request #1477] - Merged.
- Added CVE to Crashtest + dawnscanner findings - [Pull Request #1480] - Merged.
- Fixed release mode git commit showing issue - [Pull Request #1483] - Merged.
- Fixed menu overlapping - [Pull Request #1493] - Merged.
Unit Tests Implemented
To harden the existing code, I added unit tests for several components:
- Product Type Unit Tests - [Pull Request #1153] - Merged.
- Engagement Unit Tests - [Pull Request #1170] - Merged.
- Environment Unit Tests - [Pull Request #1181] - Merged.
Remaining Tasks
A couple of items are still open at the end of the program:
- Add new image and select from existing images inside the finding editor - [Issue #1354]
- Fix permission handling of users - still open.
That wraps up my GSoC’19 work on DefectDojo. Thanks to the OWASP Foundation for the opportunity and to my mentor for the guidance throughout.
Saurabh Kumar (saurabh.dakshana17@gmail.com)