New HCL AppScan on Cloud SAST parser

[xpert98]

⚠️ Note on feature completeness ⚠️

We are narrowing the scope of acceptable enhancements to DefectDojo in preparation for v3. Learn more here:
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md

Description

This is a new parser for HCL AppScan on Cloud SAST results.

Test results

Tests are included and pass.

Documentation

Documentation included.

Checklist

This checklist is for your information.

• Make sure to rebase your PR against the very latest dev.
• Features/Changes should be submitted against the dev.
• Bugfixes should be submitted against the bugfix branch.
• Give a meaningful name to your PR, as it may end up being used in the release notes.
• Your code is flake8 compliant.
• Your code is python 3.11 compliant.
• If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
• Model changes must include the necessary migrations in the dojo/db_migrations folder.
• Add applicable tests to the unit tests.
• Add the proper label to categorize your PR.

Extra information

[dryrunsecurity]

DryRun Security Summary

The pull request adds support for the HCL AppScan on Cloud SAST XML parser in DefectDojo, enhancing the application's ability to parse and analyze security vulnerabilities from this specific tool through the implementation of a new parser class, configuration updates, and comprehensive unit testing.

Expand for full summary

Summary:

The code changes in this pull request focus on adding support for the "HCL AppScan on Cloud SAST XML" parser in the DefectDojo application security platform. The key changes include:

1. Adding the new parser to the configuration settings, including mapping the SAML2 attributes, deduplication algorithm, and hash code fields.
2. Implementing the HCLASoCSASTParser class to parse the HCL AppScan on Cloud SAST XML reports and generate Finding objects.
3. Adding unit tests to verify the correctness of the parser in handling various scenarios, such as no findings, a single finding, and multiple findings.

From an application security perspective, these changes are positive as they expand the capabilities of DefectDojo to support a wider range of vulnerability scanning tools, allowing security teams to consolidate and analyze security data from multiple sources. The attention to input validation, structured data representation, and the extraction of detailed vulnerability information in the parser implementation is also commendable.

The unit tests ensure the reliability and accuracy of the security findings reported by the HCL AppScan on Cloud SAST tool, which is crucial for effectively addressing identified vulnerabilities. The coverage of different scenarios and the validation of severity, CWE mapping, and file/line number tracking demonstrate a comprehensive approach to testing the security-critical functionality of the parser.

Overall, these changes appear to be a well-designed and secure addition to the DefectDojo application, enhancing its capabilities to support a wider range of security tools and providing a robust framework for managing and addressing security vulnerabilities.

Files Changed:

1. docs/content/en/connecting_your_tools/parsers/file/hcl_asoc_sast.md: This new documentation page provides an overview of the "HCL AppScan on Cloud SAST" parser, including details on the supported input format and a link to sample scan data.
2. dojo/tools/hcl_asoc_sast/__init__.py: This change adds an author line to the __init__.py file, which is a common and expected update in software development.
3. dojo/settings/.settings.dist.py.sha256sum: The SHA-256 hash value of the settings.dist.py file has been updated, indicating a change to the default configuration settings.
4. dojo/settings/settings.dist.py: The changes add support for the "HCL AppScan on Cloud SAST XML" parser, including mapping the SAML2 attributes, deduplication algorithm, and hash code fields.
5. unittests/scans/hcl_asoc_sast/no_issues.xml and unittests/scans/hcl_asoc_sast/one_issue.xml: These are sample XML reports used for testing the HCL AppScan on Cloud SAST parser.
6. dojo/tools/hcl_asoc_sast/parser.py: This file contains the implementation of the HCLASoCSASTParser class, which is responsible for parsing the HCL AppScan on Cloud SAST XML reports.
7. unittests/tools/test_hcl_asoc_sast_parser.py: This file contains the unit tests for the HCLASoCSASTParser class, ensuring the correctness of the parser in handling various scenarios.

Code Analysis

We ran 9 analyzers against 9 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

@xpert98 Love the contribution but have to ask: Why are those conditionals so deeply nested?

I was reviewing this PR and wondering how much "fun" it would be to handle a future change with that deep nesting. I'm almost afraid to run a cyclical complexity tool on this parser code TBH.

Can you help me understand your thinking on that?

[xpert98]

@mtesauro I went that route because of the way the data is structured. Specifically for the mitigations and references, those are separate blocks outside of each result and that seemed like a convenient way to include the relevant "why it's a problem" and "how to fix it" into each issue to be rendered along with the typical issue details like file name and line number.

[cneill]

Instead of putting the whole function after this point inside an if block when report is not None, just bail if report is None.

Suggested change

	if report is not None:
	if report is None:
	return findings

[xpert98]

I was keeping the overall style of the parser similar to the existing hcl_appscan (for DAST) parser for consistency. I can refactor if this is a dealbreaker.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[mtesauro]

@xpert98 Closing and re-opening to see if I can get ruff-linting unstuck

[mtesauro]

@mtesauro I went that route because of the way the data is structured. Specifically for the mitigations and references, those are separate blocks outside of each result and that seemed like a convenient way to include the relevant "why it's a problem" and "how to fix it" into each issue to be rendered along with the typical issue details like file name and line number.

HCL AppScan sure chose a "creative" structure for this output 🤮

[mtesauro]

I'm approving assuming the sha256sum gets fixed before it's merged.

@xpert98 You'll be happy to see PR #11299 😉

[mtesauro]

Approved