Support osv-scanner Export

[themenucha]

Recently google release an open source scanner - osv-scanner. For more information: https://osv.dev/

As a Security Engineer, I will be glad if DefectDojo could support export from osv-scanner tool so that the results will appear in DefectDojo.

Since the tool is very new there are many alternatives, but I think it worth to give them a try.

Detailed info with output examples could be found here: https://github.com/google/osv-scanner

[marcinguy]

@themenucha You can use Betterscan.io for this and import to DefectDojo via SARIF. Betterscan consumes "osv-scanner" results and adds many more (for Code and Cloud) and produces SARIF final report.

Code repo of Betterscan: https://github.com/marcinguy/betterscan-ce/

I also started a discussion about it here:

https://github.com/DefectDojo/django-DefectDojo/discussions/7353

[jaskaransinghdr6j]

Any updates on supporting. osv-scanner JSON format directly?

[manuel-sommer]

@marcinguy, do you have example output to get imported into defectdojo (e.g. also SARIF output), then we can advance the unittests and close this ticket?

[manuel-sommer]

Any update on this @marcinguy or @themenucha ?

[manuel-sommer]

@jaskaransinghdr6j do you have an output available?

[devGregA]

Completed.