Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BlackDuck_Api importer broken #11301

Open
Joshua-David1 opened this issue Nov 20, 2024 · 1 comment
Open

BlackDuck_Api importer broken #11301

Joshua-David1 opened this issue Nov 20, 2024 · 1 comment
Labels

Comments

@Joshua-David1
Copy link

Overview
The default api_blackduck scanner of DefectDojo seems to have not been adapted to the latest API fetching mechanism of Blackduck SCA. Assuming BlackDuck SCA has updated the API, data fetched using the old API mechanism doesn't give the expected output anymore (this is what's used by DefectDojo right now). Certain keys are missing & the some of the keys 'name' have been changed in the returned JSON response.

Steps to reproduce

  1. Go to Settings -> Tool Configuration.
  2. Set up BlackDuck tool configuration with the required URL & api key.
  3. Spin up a new project & create a new engagement in it.
  4. Go to the settings of the new project created & click Add API Scan configuration.
  5. Set up the Tool configuration as Blackduck and set the Service1 & Service2 Fields respectively (Ref ofiicial Docs if needed).
  6. Add a new BlackDuck API test inside of the newly created engagement.
  7. If we try to import the test, defectdojo throws out an error 'An exception error occurred during the report import : 'VulnerabilityWithRedemption''.

Expected behavior
It should have imported the scans results without any problem.

Additional context
The error arises as a result of DefectDojo trying to extract the key 'VulnerabilityWithRedemption' using the BlackDuck Api. The key is not returned in the response given out by BlackDuck through API call.

@mtesauro
Copy link
Contributor

@Joshua-David1 This appears to be a duplicate of #11029

See my comment at #11029 (comment) that explains why this isn't a straightforward bug to fix.

I'll close that issue so discussion can move here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants