🎉 implement n0s1 scanner #13564

[manuel-sommer]

#13564

[mtesauro]

Approved

[valentijnscholten]

comment posted

[valentijnscholten]

This is a parser that can return different type of scans. Can you look at implementing the dynamic test_type feature similar to rusty hog?

django-DefectDojo/dojo/tools/rusty_hog/parser.py

Lines 33 to 70 in 1ba1122

	def get_tests(self, scan_type, handle):
	tree = json.load(handle)
	tests = []
	if scan_type == "Rusty Hog Scan":
	parsername = "Rusty Hog"
	for node in tree:
	if (
	"commit" in node
	or "commitHash" in node
	or "parent_commit_hash" in node
	or "old_file_id" in node
	or "new_file_id" in node
	):
	parsername = "Choctaw Hog"
	break
	if "linenum" in node or "diff" in node:
	parsername = "Duroc Hog"
	break
	if "issue_id" in node or "location" in node:
	parsername = "Gottingen Hog"
	break
	if "page_id" in node:
	parsername = "Essex Hog"
	break
	else:
	parsername = scan_type.replace(" Scan", "")
	test = ParserTest(
	name=parsername,
	parser_type=parsername,
	version="",
	)
	if parsername == "Rusty Hog": # The outputfile is empty. A subscanner can't be classified
	test.description = "The exact scanner within Rusty Hog could not be determined due to missing information within the scan result."
	else:
	test.description = parsername
	test.findings = self.__getitem(vulnerabilities=tree, scanner=parsername)
	tests.append(test)
	return tests

[manuel-sommer]

This is a parser that can return different type of scans. Can you look at implementing the dynamic test_type feature similar to rusty hog?

django-DefectDojo/dojo/tools/rusty_hog/parser.py

Lines 33 to 70 in 1ba1122

	def get_tests(self, scan_type, handle):
	tree = json.load(handle)
	tests = []
	if scan_type == "Rusty Hog Scan":
	parsername = "Rusty Hog"
	for node in tree:
	if (
	"commit" in node
	or "commitHash" in node
	or "parent_commit_hash" in node
	or "old_file_id" in node
	or "new_file_id" in node
	):
	parsername = "Choctaw Hog"
	break
	if "linenum" in node or "diff" in node:
	parsername = "Duroc Hog"
	break
	if "issue_id" in node or "location" in node:
	parsername = "Gottingen Hog"
	break
	if "page_id" in node:
	parsername = "Essex Hog"
	break
	else:
	parsername = scan_type.replace(" Scan", "")
	test = ParserTest(
	name=parsername,
	parser_type=parsername,
	version="",
	)
	if parsername == "Rusty Hog": # The outputfile is empty. A subscanner can't be classified
	test.description = "The exact scanner within Rusty Hog could not be determined due to missing information within the scan result."
	else:
	test.description = parsername
	test.findings = self.__getitem(vulnerabilities=tree, scanner=parsername)
	tests.append(test)
	return tests

Hi @valentijnscholten , before I implement this, I would need multiple different output files. I was just doing the PR, not using it to test different scenarios (for this I don't have time right now).
How about continuing with this and as soon as someone asks for other scenarios to cover, we can advance this PR with their provided scan results?

[valentijnscholten]

It's only about adding logic to set the test_type name / parser name. Bot about having all scanners supported.

[dryrunsecurity]

This pull request introduces an information disclosure issue: the n0s1 Scanner parser copies the raw "secret" field from scanner JSON into the Finding description (dojo/tools/n0s1/parser.py), which exposes sensitive data (keys, passwords, private keys) in the DefectDojo UI. This should be remediated by redacting or omitting secrets before storing/displaying them.

Information Disclosure in Finding Description in dojo/tools/n0s1/parser.py

Vulnerability

Information Disclosure in Finding Description

Description

The n0s1 Scanner parser explicitly includes the secret field from its JSON output into the description field of a Finding object. This secret field, as confirmed by the test data, contains sensitive information (e.g., AWS access keys, private keys, passwords in URLs). Since the Finding description is displayed in the DefectDojo UI without redaction, this leads to an information disclosure vulnerability where secrets discovered by the scanner are exposed to users viewing the finding details.

django-DefectDojo/dojo/tools/n0s1/parser.py

Lines 64 to 67 in 6c993e0

	description += f"**Secret:** {finding_data.get('secret', 'N/A')}\n"
	description += f"**Platform:** {details.get('platform', 'N/A')}\n"
	description += f"**Ticket Field:** {details.get('ticket_field', 'N/A')}\n"
	description += f"**Regex ID:** {merged_regex['id']}\n"

---

All finding details can be found in the DryRun Security Dashboard.