django-DefectDojo: Unable to import from Github vulnerability scan
Bug description
When I am trying to import a Github vulnerability scan using the template given at [https://defectdojo.github.io/django-DefectDojo/integrations/import/#github-vulnerability]. I am receiving the error An exception error occurred during the report import:Expecting value: line 1 column 1 (char 0).
I did some digging on the internet and found that in some Ubuntu systems, python2.7 can’t identify json even if it’s a built-in function. Hence, I used the shebang #!/usr/local/bin python3 to prioritise python3. But I am still getting the error.
Steps to reproduce Steps to reproduce the behaviour:
- Go to ‘Products’
- Click on ‘Product name’
- Click on ‘Findings’ dropdown
- Click on ‘Import Scan Results’
- Select scan type as ‘Github Vulnerability Scan’
- Choose a report file to import
Expected behaviour Issues should populate in Finding. Because when I run the same python script locally on a terminal. It gives me expected results
Deployment method (select with an X)
- Docker
- Kubernetes
- GoDojo
- setup.bash / legacy-setup.bash
Environment information
- Operating System: [e.g. Ubuntu 18.04.1]
- DefectDojo Commit Message: [[2021-07-09 16:41:23 -0500] 24477ef3: Add release cadence to README (#4796) [ (HEAD -> master, origin/master, origin/HEAD)]
Sample scan files (optional)
#!/usr/bin/python3
import json
import requests
query = """
query getVulnerabilitiesByRepoAndOwner($name: String!, $owner: String!) {
repository(name: $name, owner: $owner) {
vulnerabilityAlerts(first: 100) {
nodes {
id
createdAt
securityVulnerability {
severity
package {
name
ecosystem
}
advisory {
description
summary
identifiers {
type
value
}
references {
url
}
cvss {
vectorString
}
}
}
vulnerableManifestPath
}
}
}
}
"""
token = '...' # generated from GitHub settings
header = {"Authorization": "Bearer " + token}
request = requests.post(url='https://api.github.com/graphql',
json={
"operationName": "getVulnerabilitiesByRepoAndOwner",
'query': query,
'variables': {
'name': '...',
'owner': '...'
}
},
headers=header)
result = request.json()
print(json.dumps(result, indent=2))
Screenshots (optional) If applicable, add screenshots to help explain your problem.
Console logs (optional) If applicable, add console logs to help explain your problem.
Additional context (optional) Add any other context about the problem here.
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 16 (9 by maintainers)
This is exactly what I did. When you are on version 2.1.0 it should work for you as well. Please make sure you are really using the same file that you uploaded here.
This report works fine with my 2.1.0 version:
Hi @vyastj, what you provided under Sample scan files is not the result of a scan but a example for a shell script to retrieve results from GitHub. Please attach an actual example of a vulnerabilities scan of GitLab, which must be a JSON file.