Add SonarQube SCA (Software Composition Analysis) API Import Support#14710
Open
mathiasconradt wants to merge 4 commits intoDefectDojo:devfrom
Open
Add SonarQube SCA (Software Composition Analysis) API Import Support#14710mathiasconradt wants to merge 4 commits intoDefectDojo:devfrom
mathiasconradt wants to merge 4 commits intoDefectDojo:devfrom
Conversation
Adds Software Composition Analysis (SCA) dependency risk import to the SonarQube API integration. Changes: - Add find_sca_risks() method to api_client.py for /api/v2/sca/risk-reports endpoint - Add import_sca() method to importer.py to parse SCA risks into DefectDojo findings - Add convert_sca_severity() to map SonarQube severity (BLOCKER/CRITICAL/HIGH/MEDIUM/LOW) to DefectDojo - Enable by default via SONARQUBE_API_PARSER_SCA setting (defaults to True) Fields mapped: - riskTitle → title - vulnerabilityId → unsaved_vulnerability_ids (CVE/GHSA) - cvssScore → cvssv3_score - cweIds → cwe (first CWE) - packageUrl → component_name/component_version (parsed from PURL) - dependencyChains → included in description - riskSeverity → severity (BLOCKER mapped to Critical) Tested with SonarQube SCA API response. Security validated with SonarQube analysis. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added comprehensive test coverage for the new SCA import functionality: - Added dummy_sca_risks() to load test data from sca_risks.json - TestSonarqubeImporterSCASupport: verifies only OPEN risks imported (33 findings) - TestSonarqubeImporterValidateSCAData: validates field mapping * CVE/vulnerability ID extraction * CVSS score mapping * CWE ID extraction * Component name/version parsing from PURL * Severity conversion * Description formatting Test data includes 49 SCA risks from SonarQube demo project with HIGH severity vulnerabilities and various license issues. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updated find_sca_risks() to paginate through results: - Added pageIndex and pageSize parameters (500 per page, max 100 pages) - Handles both paginated response (issuesReleases wrapper) and flat array - Follows same pattern as find_issues() and find_hotspots() Updated test mock to wrap test data in paginated response structure to match expected API format. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Remove unnecessary else after break (RET508) - Add trailing commas (COM812) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds SCA (Software Composition Analysis) support to DefectDojo's existing SonarQube API Import integration, enabling import of dependency vulnerabilities alongside existing SAST findings and security hotspots.
Changes
API Client (
dojo/tools/api_sonarqube/api_client.py)find_sca_risks()method to fetch SCA data from SonarQube/api/v2/sca/risk-reportsendpointImporter (
dojo/tools/api_sonarqube/importer.py)get_findings()to callimport_sca()when enabledimport_sca()method to parse SCA risks into DefectDojo findingsconvert_sca_severity()to map SonarQube BLOCKER → DefectDojo CriticalSONARQUBE_API_PARSER_SCAsetting (getattr with default True)Field Mapping
riskTitle→titlevulnerabilityId→unsaved_vulnerability_idscvssScore→cvssv3_scorecweIds→cwe(first CWE)packageUrl→component_name/component_version(parsed from PURL format)dependencyChains→ included indescriptionriskSeverity→severity(BLOCKER/CRITICAL → Critical, HIGH → High, etc.)Tests (
unittests/tools/test_api_sonarqube_importer.py)dummy_sca_risks()to load test dataTestSonarqubeImporterSCASupport: verifies correct count of OPEN risks importedTestSonarqubeImporterValidateSCAData: validates field mapping, CVE extraction, PURL parsingTest Plan
Follow-on Work
None required - feature is complete and follows existing patterns for hotspots import.
Related Issues
Implements SCA support as discussed in community requests for dependency vulnerability tracking from SonarQube.
🤖 Generated with Claude Code