You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When trying to upload the attached fortify report (fpr Format), i get an Internal Server Error. The logs show that an AttributeError happens while accessing some nested XML elements inside the report. Here is the line that causes the error in the current master branch:
line 33 in https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/tools/fortify/fpr_parser.py
Basically the code expects the the elements are nested like this:
AnalysisInfo->Unified->Trace->Primary->Entry->Node->SourceLocation
But in some reports the "Primary" element can have multiple child "Entry"-Elements. Some of these "Entry" elements contain "NodeRef" elements instead of "Node" elements. And that is where an AttributeError occurs. I couldnt find out what those NodeRefs are about.
Steps to reproduce
Steps to reproduce the behavior:
Upload attached fpr Report to any Engagement
Expected behavior
Vulnerabilities should be extracted successfully
Deployment method(select with an X)
Docker Compose
[ x] Kubernetes
GoDojo
Environment information
DefectDojo version: 2.32.0
Logs [18/Apr/2024 11:26:31] ERROR [dojo.engagement.views:819] 'NoneType' object has no attribute 'find' Traceback (most recent call last): File "/app/dojo/engagement/views.py", line 803, in post test, finding_count, closed_finding_count, _ = importer.import_scan(scan, scan_type, engagement, user, environment, active=active, verified=verified, tags=tags, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/dojo/importers/importer/importer.py", line 336, in import_scan parsed_findings = parser.get_findings(scan, test) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/dojo/tools/fortify/parser.py", line 24, in get_findings return self.parse_fpr(filename, test) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/dojo/tools/fortify/parser.py", line 161, in parse_fpr SourceLocationpath = vuln.find(f"{namespace}AnalysisInfo").find(f"{namespace}Unified").find(f"{namespace}Trace").find(f"{namespace}Primary").find(f"{namespace}Entry").find(f"{namespace}Node").find(f"{namespace}SourceLocation").attrib.get("path") ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ AttributeError: 'NoneType' object has no attribute 'find'
Description
When trying to upload the attached fortify report (fpr Format), i get an Internal Server Error. The logs show that an AttributeError happens while accessing some nested XML elements inside the report. Here is the line that causes the error in the current master branch:
line 33 in https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/tools/fortify/fpr_parser.py
Basically the code expects the the elements are nested like this:
AnalysisInfo->Unified->Trace->Primary->Entry->Node->SourceLocation
But in some reports the "Primary" element can have multiple child "Entry"-Elements. Some of these "Entry" elements contain "NodeRef" elements instead of "Node" elements. And that is where an AttributeError occurs. I couldnt find out what those NodeRefs are about.
Steps to reproduce
Steps to reproduce the behavior:
Expected behavior
Vulnerabilities should be extracted successfully
Deployment method (select with an
X
)Environment information
Logs
[18/Apr/2024 11:26:31] ERROR [dojo.engagement.views:819] 'NoneType' object has no attribute 'find' Traceback (most recent call last): File "/app/dojo/engagement/views.py", line 803, in post test, finding_count, closed_finding_count, _ = importer.import_scan(scan, scan_type, engagement, user, environment, active=active, verified=verified, tags=tags, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/dojo/importers/importer/importer.py", line 336, in import_scan parsed_findings = parser.get_findings(scan, test) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/dojo/tools/fortify/parser.py", line 24, in get_findings return self.parse_fpr(filename, test) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/app/dojo/tools/fortify/parser.py", line 161, in parse_fpr SourceLocationpath = vuln.find(f"{namespace}AnalysisInfo").find(f"{namespace}Unified").find(f"{namespace}Trace").find(f"{namespace}Primary").find(f"{namespace}Entry").find(f"{namespace}Node").find(f"{namespace}SourceLocation").attrib.get("path") ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ AttributeError: 'NoneType' object has no attribute 'find'
Sample scan files
fortify_sast_parrot_20240418_953_40_252978_380be8c.zip
The text was updated successfully, but these errors were encountered: