Feature/remove unirest #1
+2,306
−1,108
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -19,19 +19,32 @@ | |||||||||
| package org.dependencytrack.integrations.defectdojo; | ||||||||||
|
|
||||||||||
| import alpine.common.logging.Logger; | ||||||||||
| import org.apache.http.HttpStatus; | ||||||||||
| import org.apache.http.client.utils.URIBuilder; | ||||||||||
| import org.json.JSONArray; | ||||||||||
| import org.json.JSONObject; | ||||||||||
| import org.apache.http.HttpEntity; | ||||||||||
| import org.apache.http.NameValuePair; | ||||||||||
| import org.apache.http.client.entity.UrlEncodedFormEntity; | ||||||||||
| import org.apache.http.client.methods.CloseableHttpResponse; | ||||||||||
| import org.apache.http.client.methods.HttpGet; | ||||||||||
| import org.apache.http.client.methods.HttpPost; | ||||||||||
| import org.apache.http.entity.ContentType; | ||||||||||
| import org.apache.http.entity.mime.HttpMultipartMode; | ||||||||||
| import org.apache.http.entity.mime.MultipartEntityBuilder; | ||||||||||
| import org.apache.http.message.BasicNameValuePair; | ||||||||||
| import org.apache.http.util.EntityUtils; | ||||||||||
| import org.dependencytrack.common.HttpClientPool; | ||||||||||
|
|
||||||||||
| import java.io.IOException; | ||||||||||
| import java.io.InputStream; | ||||||||||
| import java.net.URISyntaxException; | ||||||||||
| import java.net.URL; | ||||||||||
| import java.nio.charset.StandardCharsets; | ||||||||||
| import java.text.SimpleDateFormat; | ||||||||||
| import java.util.ArrayList; | ||||||||||
| import java.util.Date; | ||||||||||
| import java.util.List; | ||||||||||
|
|
||||||||||
| public class DefectDojoClient { | ||||||||||
|
|
||||||||||
|
|
@@ -40,66 +53,78 @@ public class DefectDojoClient { | |||||||||
| private final DefectDojoUploader uploader; | ||||||||||
| private final URL baseURL; | ||||||||||
|
|
||||||||||
| public DefectDojoClient(final DefectDojoUploader uploader, final URL baseURL) { | ||||||||||
| this.uploader = uploader; | ||||||||||
| this.baseURL = baseURL; | ||||||||||
| } | ||||||||||
|
|
||||||||||
| public void uploadDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson) { | ||||||||||
| LOGGER.debug("Uploading Dependency-Track findings to DefectDojo"); | ||||||||||
| HttpPost request = new HttpPost(baseURL + "/api/v2/import-scan/"); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| List<NameValuePair> nameValuePairs = new ArrayList<>(); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("engagement", engagementId)); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("scan_type", "Dependency Track Finding Packaging Format (FPF) Export")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("verified", "true")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("active", "true")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("minimum_severity", "Info")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("close_old_findings", "true")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("push_to_jira", "false")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("scan_date", DATE_FORMAT.format(new Date()))); | ||||||||||
|
|
||||||||||
| HttpEntity data = MultipartEntityBuilder.create().setMode(HttpMultipartMode.BROWSER_COMPATIBLE) | ||||||||||
| .addBinaryBody("file", findingsJson, ContentType.APPLICATION_JSON, "findings.json") | ||||||||||
| .build(); | ||||||||||
| request.setEntity(data); | ||||||||||
| request.setEntity(new UrlEncodedFormEntity(nameValuePairs, StandardCharsets.UTF_8)); | ||||||||||
| try { | ||||||||||
| CloseableHttpResponse response = HttpClientPool.getClient().execute(request); | ||||||||||
| if (response.getStatusLine().getStatusCode() == HttpStatus.SC_CREATED) { | ||||||||||
| LOGGER.debug("Successfully uploaded findings to DefectDojo"); | ||||||||||
| } else { | ||||||||||
| LOGGER.warn("DefectDojo Client did not receive expected response while attempting to upload " | ||||||||||
| + "Dependency-Track findings. HTTP response code: " | ||||||||||
| + response.getStatusLine().getStatusCode() + " - " + response.getStatusLine().getReasonPhrase()); | ||||||||||
| uploader.handleUnexpectedHttpResponse(LOGGER, request.getURI().toString(), response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase()); | ||||||||||
| } | ||||||||||
| } catch (IOException ex) { | ||||||||||
| LOGGER.warn("Error while sending request from upload DT findings defectDojo Client" + ex.getMessage()); | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| } | ||||||||||
| } | ||||||||||
|
|
||||||||||
| // Pulling DefectDojo 'tests' API endpoint with engagementID filter on, and retrieve a list of existing tests | ||||||||||
| public ArrayList getDojoTestIds(final String token, final String eid) { | ||||||||||
| LOGGER.debug("Pulling DefectDojo Tests API ..."); | ||||||||||
| String testsUri = "/api/v2/tests/"; | ||||||||||
| LOGGER.debug("Make the first pagination call"); | ||||||||||
| try{ | ||||||||||
| URIBuilder uriBuilder = new URIBuilder(baseURL +testsUri); | ||||||||||
| uriBuilder.addParameter("limit", "100"); | ||||||||||
| uriBuilder.addParameter("engagement", eid); | ||||||||||
| HttpGet request = new HttpGet(uriBuilder.build().toString()); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| CloseableHttpResponse response = HttpClientPool.getClient().execute(request); | ||||||||||
| if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) { | ||||||||||
| if (response.getEntity()!=null) { | ||||||||||
| String stringResponse = EntityUtils.toString(response.getEntity()); | ||||||||||
| JSONObject dojoObj = new JSONObject(stringResponse); | ||||||||||
| JSONArray dojoArray = dojoObj.getJSONArray("results"); | ||||||||||
| ArrayList dojoTests = jsonToList(dojoArray); | ||||||||||
| String nextUrl = ""; | ||||||||||
| while (dojoObj.get("next") != null) { | ||||||||||
| nextUrl = dojoObj.get("next").toString(); | ||||||||||
| LOGGER.debug("Making the subsequent pagination call on " + nextUrl); | ||||||||||
| uriBuilder = new URIBuilder(nextUrl); | ||||||||||
| request = new HttpGet(uriBuilder.build().toString()); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| response = HttpClientPool.getClient().execute(request); | ||||||||||
| nextUrl = dojoObj.get("next").toString(); | ||||||||||
| stringResponse = EntityUtils.toString(response.getEntity()); | ||||||||||
| dojoObj = new JSONObject(stringResponse); | ||||||||||
| dojoArray = dojoObj.getJSONArray("results"); | ||||||||||
| dojoTests.addAll(jsonToList(dojoArray)); | ||||||||||
| } | ||||||||||
|
|
@@ -108,18 +133,24 @@ public ArrayList getDojoTestIds(final String token, final String eid) { | |||||||||
| } | ||||||||||
| } else { | ||||||||||
| LOGGER.warn("DefectDojo Client did not receive expected response while attempting to retrieve tests list " | ||||||||||
| + response.getStatusLine().getStatusCode() + " - " + response.getStatusLine().getReasonPhrase()); | ||||||||||
| }}catch (IOException ex){ | ||||||||||
| LOGGER.warn("Error while getting dojo test id's"+ex.getMessage()); | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| }catch (URISyntaxException ex){ | ||||||||||
| LOGGER.warn("Error while creating get request url for Defect dojo client"); | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| } | ||||||||||
| return new ArrayList<>(); | ||||||||||
| } | ||||||||||
|
|
||||||||||
| // Given the engagement id and scan type, search for existing test id | ||||||||||
| public String getDojoTestId(final String engagementID, final ArrayList dojoTests) { | ||||||||||
| for (int i = 0; i < dojoTests.size(); i++) { | ||||||||||
| String s = dojoTests.get(i).toString(); | ||||||||||
| JSONObject dojoTest = new JSONObject(s); | ||||||||||
| if (dojoTest.get("engagement").toString().equals(engagementID) && | ||||||||||
| dojoTest.get("scan_type").toString().equals("Dependency Track Finding Packaging Format (FPF) Export")) { | ||||||||||
| return dojoTest.get("id").toString(); | ||||||||||
| } | ||||||||||
| } | ||||||||||
|
|
@@ -140,32 +171,40 @@ public ArrayList<String> jsonToList(final JSONArray jsonArray) { | |||||||||
| /* | ||||||||||
| * A Reimport will reuse (overwrite) the existing test, instead of create a new test. | ||||||||||
| * The Successfully reimport will also increase the reimport counter by 1. | ||||||||||
| */ | ||||||||||
| public void reimportDependencyTrackFindings(final String token, final String engagementId, final InputStream findingsJson, final String testId) { | ||||||||||
| LOGGER.debug("Re-reimport Dependency-Track findings to DefectDojo per Engagement"); | ||||||||||
| HttpPost request = new HttpPost(baseURL + "/api/v2/reimport-scan/"); | ||||||||||
| request.addHeader("accept", "application/json"); | ||||||||||
| request.addHeader("Authorization", "Token " + token); | ||||||||||
| List<NameValuePair> nameValuePairs = new ArrayList<>(); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("engagement", engagementId)); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("scan_type", "Dependency Track Finding Packaging Format (FPF) Export")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("verified", "true")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("active", "true")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("minimum_severity", "Info")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("close_old_findings", "true")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("push_to_jira", "false")); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("test", testId)); | ||||||||||
| nameValuePairs.add(new BasicNameValuePair("scan_date", DATE_FORMAT.format(new Date()))); | ||||||||||
|
There was a problem hiding this comment. JavaUtilDate: Date has a bad API that leads to bugs; prefer java.time.Instant or LocalDate. ℹ️ Learn about @sonatype-lift commandsYou can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
Note: When talking to LiftBot, you need to refresh the page to see its response. Was this a good recommendation? |
||||||||||
| request.setEntity(new UrlEncodedFormEntity(nameValuePairs, StandardCharsets.UTF_8)); | ||||||||||
| HttpEntity fileData = MultipartEntityBuilder.create().setMode(HttpMultipartMode.BROWSER_COMPATIBLE) | ||||||||||
| .addBinaryBody("file", findingsJson, ContentType.APPLICATION_JSON, "findings.json") | ||||||||||
| .build(); | ||||||||||
| request.setEntity(fileData); | ||||||||||
| try{ | ||||||||||
| CloseableHttpResponse response = HttpClientPool.getClient().execute(request); | ||||||||||
| if (response.getStatusLine().getStatusCode() == HttpStatus.SC_CREATED) { | ||||||||||
| LOGGER.debug("Successfully reimport findings to DefectDojo"); | ||||||||||
| } else { | ||||||||||
| LOGGER.warn("DefectDojo Client did not receive expected response while attempting to reimport" | ||||||||||
| + "Dependency-Track findings. HTTP response code: " | ||||||||||
| + response.getStatusLine().getStatusCode() + " - " + response.getStatusLine().getReasonPhrase()); | ||||||||||
| uploader.handleUnexpectedHttpResponse(LOGGER, request.getURI().toString(), response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase()); | ||||||||||
| } | ||||||||||
| }catch (IOException ex){ | ||||||||||
| LOGGER.warn("Error while sending request from reimport DT findings defectDojo Client" + ex.getMessage()); | ||||||||||
| uploader.handleException(LOGGER, ex); | ||||||||||
| } | ||||||||||
| } | ||||||||||
|
|
||||||||||
|
|
||||||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
JavaUtilDate: Date has a bad API that leads to bugs; prefer java.time.Instant or LocalDate.
ℹ️ Learn about @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
@sonatype-lift ignore@sonatype-lift ignoreall@sonatype-lift exclude <file|issue|path|tool>file|issue|path|toolfrom Lift findings by updating your config.toml fileNote: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]