Feature/remove unirest #1
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -19,15 +19,25 @@ | |||||||||
| package org.dependencytrack.integrations.defectdojo; | ||||||||||
|
|
||||||||||
| import alpine.common.logging.Logger; | ||||||||||
| import org.apache.http.HttpEntity; | ||||||||||
| import org.apache.http.HttpStatus; | ||||||||||
| import org.apache.http.client.methods.CloseableHttpResponse; | ||||||||||
| import org.apache.http.client.methods.HttpGet; | ||||||||||
| import org.apache.http.client.methods.HttpPost; | ||||||||||
| import org.apache.http.client.utils.URIBuilder; | ||||||||||
| import org.apache.http.entity.ContentType; | ||||||||||
| import org.apache.http.entity.mime.HttpMultipartMode; | ||||||||||
| import org.apache.http.entity.mime.MultipartEntityBuilder; | ||||||||||
| import org.apache.http.entity.mime.content.InputStreamBody; | ||||||||||
| import org.apache.http.entity.mime.content.StringBody; | ||||||||||
| import org.apache.http.util.EntityUtils; | ||||||||||
| import org.dependencytrack.common.HttpClientPool; | ||||||||||
| import org.json.JSONArray; | ||||||||||
| import org.json.JSONObject; | ||||||||||
|
|
||||||||||
| import java.io.IOException; | ||||||||||
| import java.io.InputStream; | ||||||||||
| import java.net.URISyntaxException; | ||||||||||
| import java.net.URL; | ||||||||||
| import java.text.SimpleDateFormat; | ||||||||||
| import java.util.ArrayList; | ||||||||||
|
|
@@ -40,86 +50,98 @@ public class DefectDojoClient { | |||||||||
| private final DefectDojoUploader uploader; | ||||||||||
| private final URL baseURL; | ||||||||||
|
|
||||||||||
| public DefectDojoClient(final DefectDojoUploader uploader, final URL baseURL) { | ||||||||||
| this.uploader = uploader; | ||||||||||
| this.baseURL = baseURL; | ||||||||||
| } | ||||||||||
|
|
||||||||||
| public void uploadDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson) { | ||||||||||
| LOGGER.debug("Uploading Dependency-Track findings to DefectDojo"); | ||||||||||
| HttpPost request = new HttpPost(baseURL + "/api/v2/import-scan/"); | ||||||||||
| InputStreamBody inputStreamBody = new InputStreamBody(findingsJson, ContentType.DEFAULT_BINARY, "findings.json"); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| HttpEntity data = MultipartEntityBuilder.create().setMode(HttpMultipartMode.BROWSER_COMPATIBLE) | ||||||||||
| .addPart("file", inputStreamBody) | ||||||||||
| .addPart("engagement", new StringBody(engagementId, ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("scan_type", new StringBody("Dependency Track Finding Packaging Format (FPF) Export", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("verified", new StringBody("true", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("active", new StringBody("true", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("minimum_severity", new StringBody("Info", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("close_old_findings", new StringBody("true", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("push_to_jira", new StringBody("push_to_jira", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("scan_date", new StringBody(DATE_FORMAT.format(new Date()), ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .build(); | ||||||||||
| request.setEntity(data); | ||||||||||
|
|
||||||||||
|
|
||||||||||
| try (CloseableHttpResponse response = HttpClientPool.getClient().execute(request)) { | ||||||||||
| if (response.getStatusLine().getStatusCode() == HttpStatus.SC_CREATED) { | ||||||||||
| LOGGER.debug("Successfully uploaded findings to DefectDojo"); | ||||||||||
| } else { | ||||||||||
| uploader.handleUnexpectedHttpResponse(LOGGER, request.getURI().toString(), response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase()); | ||||||||||
| } | ||||||||||
| } catch (IOException ex) { | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| } | ||||||||||
| } | ||||||||||
|
|
||||||||||
| // Pulling DefectDojo 'tests' API endpoint with engagementID filter on, and retrieve a list of existing tests | ||||||||||
| public ArrayList getDojoTestIds(final String token, final String eid) { | ||||||||||
| LOGGER.debug("Pulling DefectDojo Tests API ..."); | ||||||||||
| String testsUri = "/api/v2/tests/"; | ||||||||||
| LOGGER.debug("Make the first pagination call"); | ||||||||||
| try { | ||||||||||
| URIBuilder uriBuilder = new URIBuilder(baseURL + testsUri); | ||||||||||
| uriBuilder.addParameter("limit", "100"); | ||||||||||
| uriBuilder.addParameter("engagement", eid); | ||||||||||
| HttpGet request = new HttpGet(uriBuilder.build().toString()); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| try (CloseableHttpResponse response = HttpClientPool.getClient().execute(request)) { | ||||||||||
| if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) { | ||||||||||
| if (response.getEntity() != null) { | ||||||||||
| String stringResponse = EntityUtils.toString(response.getEntity()); | ||||||||||
| JSONObject dojoObj = new JSONObject(stringResponse); | ||||||||||
| JSONArray dojoArray = dojoObj.getJSONArray("results"); | ||||||||||
| ArrayList dojoTests = jsonToList(dojoArray); | ||||||||||
| String nextUrl = ""; | ||||||||||
| while (dojoObj.get("next") != null) { | ||||||||||
| nextUrl = dojoObj.get("next").toString(); | ||||||||||
| LOGGER.debug("Making the subsequent pagination call on " + nextUrl); | ||||||||||
| uriBuilder = new URIBuilder(nextUrl); | ||||||||||
| request = new HttpGet(uriBuilder.build().toString()); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| try (CloseableHttpResponse response1 = HttpClientPool.getClient().execute(request)) { | ||||||||||
| nextUrl = dojoObj.get("next").toString(); | ||||||||||
| stringResponse = EntityUtils.toString(response1.getEntity()); | ||||||||||
| } | ||||||||||
| dojoObj = new JSONObject(stringResponse); | ||||||||||
| dojoArray = dojoObj.getJSONArray("results"); | ||||||||||
| dojoTests.addAll(jsonToList(dojoArray)); | ||||||||||
| } | ||||||||||
| LOGGER.debug("Successfully retrieved the test list "); | ||||||||||
| return dojoTests; | ||||||||||
| } | ||||||||||
| } else { | ||||||||||
| LOGGER.warn("DefectDojo Client did not receive expected response while attempting to retrieve tests list " | ||||||||||
| + response.getStatusLine().getStatusCode() + " - " + response.getStatusLine().getReasonPhrase()); | ||||||||||
| } | ||||||||||
| } | ||||||||||
| } catch (IOException | URISyntaxException ex) { | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| } | ||||||||||
| return new ArrayList<>(); | ||||||||||
| } | ||||||||||
|
|
||||||||||
| // Given the engagement id and scan type, search for existing test id | ||||||||||
| public String getDojoTestId(final String engagementID, final ArrayList dojoTests) { | ||||||||||
| for (int i = 0; i < dojoTests.size(); i++) { | ||||||||||
| String s = dojoTests.get(i).toString(); | ||||||||||
| JSONObject dojoTest = new JSONObject(s); | ||||||||||
| if (dojoTest.get("engagement").toString().equals(engagementID) && | ||||||||||
| dojoTest.get("scan_type").toString().equals("Dependency Track Finding Packaging Format (FPF) Export")) { | ||||||||||
| return dojoTest.get("id").toString(); | ||||||||||
| } | ||||||||||
| } | ||||||||||
|
|
@@ -140,32 +162,34 @@ public ArrayList<String> jsonToList(final JSONArray jsonArray) { | |||||||||
| /* | ||||||||||
| * A Reimport will reuse (overwrite) the existing test, instead of create a new test. | ||||||||||
| * The Successfully reimport will also increase the reimport counter by 1. | ||||||||||
| */ | ||||||||||
| public void reimportDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson, final String testId) { | ||||||||||
| LOGGER.debug("Re-reimport Dependency-Track findings to DefectDojo per Engagement"); | ||||||||||
| HttpPost request = new HttpPost(baseURL + "/api/v2/reimport-scan/"); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| InputStreamBody inputStreamBody = new InputStreamBody(findingsJson, ContentType.DEFAULT_BINARY, "findings.json"); | ||||||||||
| HttpEntity fileData = MultipartEntityBuilder.create().setMode(HttpMultipartMode.BROWSER_COMPATIBLE) | ||||||||||
| .addPart("file", inputStreamBody) | ||||||||||
| .addPart("engagement", new StringBody(engagementId, ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("scan_type", new StringBody("Dependency Track Finding Packaging Format (FPF) Export", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("verified", new StringBody("true", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("active", new StringBody("true", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("minimum_severity", new StringBody("Info", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("close_old_findings", new StringBody("true", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("push_to_jira", new StringBody("push_to_jira", ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("test", new StringBody(testId, ContentType.MULTIPART_FORM_DATA)) | ||||||||||
| .addPart("scan_date", new StringBody(DATE_FORMAT.format(new Date()), ContentType.MULTIPART_FORM_DATA)) | ||||||||||
|
There was a problem hiding this comment. JavaUtilDate: Date has a bad API that leads to bugs; prefer java.time.Instant or LocalDate. ℹ️ Expand to see all @sonatype-lift commandsYou can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
Note: When talking to LiftBot, you need to refresh the page to see its response. Help us improve LIFT! (Sonatype LiftBot external survey) Was this a good recommendation for you? Answering this survey will not impact your Lift settings. [ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ] |
||||||||||
| .build(); | ||||||||||
| request.setEntity(fileData); | ||||||||||
| try (CloseableHttpResponse response = HttpClientPool.getClient().execute(request)) { | ||||||||||
| if (response.getStatusLine().getStatusCode() == HttpStatus.SC_CREATED) { | ||||||||||
| LOGGER.debug("Successfully reimport findings to DefectDojo"); | ||||||||||
| } else { | ||||||||||
| uploader.handleUnexpectedHttpResponse(LOGGER, request.getURI().toString(), response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase()); | ||||||||||
| } | ||||||||||
| } catch (IOException ex) { | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| } | ||||||||||
| } | ||||||||||
|
|
||||||||||
|
|
||||||||||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
JavaUtilDate: Date has a bad API that leads to bugs; prefer java.time.Instant or LocalDate.
ℹ️ Expand to see all @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
@sonatype-lift ignore@sonatype-lift ignoreall@sonatype-lift exclude <file|issue|path|tool>file|issue|path|toolfrom Lift findings by updating your config.toml fileNote: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
Help us improve LIFT! (Sonatype LiftBot external survey)
Was this a good recommendation for you? Answering this survey will not impact your Lift settings.
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]