Update Burp Scan to use Hashcode Dedupe

[hblankenship]

[sc-9358]

Update Burp scan to use hashcode deduplication (versus legacy). Fields of relevance are title, file_path, severity, and vuln_id_from_tool.

[mtesauro]

Approved

[fopina]

Why file_path if this is DAST/endpoint?

[dryrunsecurity]

DryRun Security Summary

The pull request enhances DefectDojo's vulnerability management capabilities by improving Burp findings deduplication through documentation updates and configuration changes in the settings file, including a new parser configuration and deduplication algorithm for Burp scans.

Expand for full summary

Summary:

The changes in this pull request are primarily focused on improving the accuracy of the deduplication process for Burp findings in the DefectDojo vulnerability management tool. The key changes include the addition of a new section in the documentation explaining the "Hash Code changes" and the introduction of a custom deduplication configuration for the Burp parser.

The documentation updates provide guidance on recalculating the hash code and deduplicating existing Burp findings, which is a useful feature for users upgrading to the new version. Additionally, the changes to the settings file, which include the addition of a new parser configuration and deduplication algorithm for the "Burp Scan" type, suggest that the project team has identified issues with the previous deduplication logic and has implemented improvements to address them.

These changes are positive from an application security perspective, as they can help security teams better manage and prioritize the vulnerabilities identified by the Burp scanner, which is a common source of vulnerability information for many organizations.

Files Changed:

1. docs/content/en/open_source/upgrading/2.44.md: This file has been updated to include a new section titled "Hash Code changes", which explains the changes to the Burp parser deduplication configuration and provides guidance on recalculating the hash code and deduplicating existing Burp findings.

2. dojo/settings/settings.dist.py: This file has been updated to include a new parser configuration for the "Burp Scan" type, which maps the "title", "severity", and "vuln_id_from_tool" fields. Additionally, a new deduplication algorithm configuration has been added for the "Burp Scan" type, which is set to use the "DEDUPE_ALGO_HASH_CODE" algorithm.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[hblankenship]

Why file_path if this is DAST/endpoint?

Excellent question. I was only paying attention to what items were available/listed in the scanner test files. I updated to remove file_path