DefectDojo
Implement NodeJsScan parser
Bug description I am unable to import NodeJsScan report. The API doesn't have a key-type called 'NodeJsScan'. I am using docker setup with hot reloading.
Environment information
- Operating System: [Ubuntu16.04]
Screenshots (optional)
Could you explain what steps you are doing? Are you uploading via the api (if yes, v1 or v2?). The screenshot is from the UI, so are you uploading through the UI? And what type of scan are you uploading? There is Node Security Platform or NPM Audit available in Defect Dojo.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
![stale[bot] avatar](https://avatars.githubusercontent.com/in/1724?v=4 "Published by a pub.dev verified publisher"){kind=small}
Looks like this is not a bug but a request to support the SAST reports from https://github.com/ajinabraham/nodejsscan
Hi @valentijnscholten check this issue https://github.com/ajinabraham/nodejsscan/issues/149
Yes i was using UI. I don't remember the exact version. Let me check that.
Hi, I just ran into this as well.
Just a heads up that the docs do say that this tool is supported. @devGregA I have a report to share but I need to get it to you via some other channel. GitHub is just a little too public.
https://defectdojo.readthedocs.io/en/latest/integrations.html
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
Hey, I am also facing similar issue, can you please let me know steps to resolve this.
@dmaselbas Which version you are using. I am using defectdojo version 2.6.1 and I am not seeing any option to upload nodejsscan report.
Node JS Scans are currently not supported. If a proper sample is provided we can look at implementing it. https://defectdojo.github.io/django-DefectDojo/integrations/parsers/
@valentijnscholten could you please look at it?
git clone [email protected]:do-/dia.js.git
docker run -v $PWD/dia:/src --rm -it opensecurity/nodejsscan:v4.7 nodejsscan --json /src
available formats are --sarif, --sonarcube, --json, are any of they supported?
what I need is somehow pass to defectdojo code snippet (physicalLocation.region.snippet for --sarif)
@jonny64 the format SARIF is supported and maintained. @karthik137 could you try to use SARIF format?
What is the status here? Is someone interested to try out SARIF outpput and share a sample report if SARIF won't work?
