Repository navigation
Conversation
Contributor
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
Resolve the conflict with DefectDojo#16632 (linear-time Qualys parsing): upstream now builds a glossary dict and looks each QID up with glossary.get(), so keep that lookup and re-apply the missing-glossary guard on top of it — a finding whose QID has no VULN_DETAILS entry is skipped with a warning instead of crashing the whole import on vuln_item.findtext('SEVERITY'). Verified after the merge: manage.py test unittests.tools.test_qualys_parser -> Ran 15 tests OK (includes upstream's 2 new perf tests and our regression test), ruff 0.16.10 clean.
Contributor
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #16633
Description
The Qualys XML parser aborted the whole import with
AttributeError: 'NoneType' object has no attribute 'findtext'as soon as any finding's QID had no matchingVULN_DETAILSentry in the report'sGLOSSARY: the severity lookup that runs after the guarded block dereferencedvuln_itemunconditionally.A finding whose QID is missing from the glossary is now skipped with a warning that names the QID, and the rest of the report imports normally. Of the two behaviors the issue sketches, this takes the skip: the glossary entry is the only source for the finding's severity and title, so there is nothing to import for that finding without inventing values.
Adds a regression test that deletes the
qid_6glossary entry from the sample report and asserts the 8 findings that report QID 6 are skipped with a warning while the remaining 293 import unchanged.Touches the same lookup that #16632 refactors; the two combine with at most a trivial rebase.