feat(defect_dojo): make apply_tags_to_findings a configurable import-…

docs/Docusaurus/docs/modules/engine_core.md

@@ -57,6 +57,7 @@ Configuration of the driven adapters in the main layer and management of on/off
             },
             "REGEX_EXPRESSION_CODE_APP": "",
             "REIMPORT_SCAN": false,
+            "APPLY_TAGS_TO_FINDINGS": false,
             "CMDB": {
                 "USE_CMDB": false,
                 "HOST_CMDB": "",
@@ -314,6 +315,9 @@ Configuration of the driven adapters in the main layer and management of on/off
         - **REIMPORT_SCAN**: Boolean value that determines whether the scan results should be re-imported into DefectDojo. 
             - If set to `true`, the tool will attempt to re-import scan results, updating the same test.  
             - If set to `false`, each scan will be imported as a new test.  
+        - **APPLY_TAGS_TO_FINDINGS**: Optional boolean value (default `false`) that determines whether the tags applied to the test are also propagated to each individual finding when importing or reimporting into DefectDojo.
+            - If set to `true`, DefectDojo applies the test tags to every finding.
+            - If set to `false` (default), the tags remain only at the test level.
         - **CMDB**: Configuration for the integration with the Configuration Management Database (CMDB).
             - **USE_CMDB**: Boolean value indicating whether to use CMDB integration (`true` or `false`).
             - **HOST_CMDB**: URL endpoint for the CMDB API.
@@ -489,6 +493,7 @@ Then, the remote config settings should look similar to this:
     "MAX_RETRIES_QUERY": 5,
     "REGEX_EXPRESSION_CODE_APP": "^([^-]+)",
     "REIMPORT_SCAN": false,
+    "APPLY_TAGS_TO_FINDINGS": false,
     "CMDB": {
         "USE_CMDB": true,
         "HOST_CMDB": "http://host_cmdb_example",
@@ -562,6 +567,7 @@ The remote config settings should look similar to this:
         "MAX_RETRIES_QUERY": 5,
         "REGEX_EXPRESSION_CODE_APP": "^([^-]+)",
         "REIMPORT_SCAN": false,
+        "APPLY_TAGS_TO_FINDINGS": false,
         "CMDB": {
             "USE_CMDB": false
         }

example_remote_config_local/engine_core/ConfigTool.json

@@ -37,6 +37,7 @@
             },
             "REGEX_EXPRESSION_CODE_APP": "^([^-]+)",
             "REIMPORT_SCAN": false,
+            "APPLY_TAGS_TO_FINDINGS": false,
             "CMDB": {
                 "USE_CMDB": false,
                 "HOST_CMDB": "",

tools/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -577,6 +577,9 @@ def _build_request_importscan(
             "get_exact_product": vulnerability_management.config_tool[
                 "VULNERABILITY_MANAGER"
             ]["DEFECT_DOJO"].get("GET_EXACT_PRODUCT", False),
+            "apply_tags_to_findings": vulnerability_management.config_tool[
+                "VULNERABILITY_MANAGER"
+            ]["DEFECT_DOJO"].get("APPLY_TAGS_TO_FINDINGS", False),
             "tool_sonarqube_configuration": (
                 tool_sonar_conf_mapping[
                     vulnerability_management.sonar_instance.upper()

tools/devsecops_engine_tools/engine_core/test/infrastructure/driven_adapters/defect_dojo/test_defect_dojo.py

@@ -171,6 +171,7 @@ def test_send_vulnerability_management(self, mock_send_import_scan):
                 test_title="engine_iac_k8s",
                 reimport_scan=True,
                 get_exact_product=False,
+                apply_tags_to_findings=False,
                 remote_config_source="github",
                 remote_config_repo="remote_config",
                 remote_config_path="mapping_path",
@@ -338,6 +339,7 @@ def test_build_request_with_cmdb(self):
                 test_title="engine_iac_k8s",
                 reimport_scan=True,
                 get_exact_product=False,
+                apply_tags_to_findings=False,
                 remote_config_source="github",
                 remote_config_repo="remote_config",
                 remote_config_path="mapping_path",
@@ -447,6 +449,7 @@ def test_build_request_without_cmdb(self):
                     "test_title": "engine_iac_k8s_test_2",
                     "reimport_scan": True,
                     "get_exact_product": False,
+                    "apply_tags_to_findings": False,
                 }
             )
             self.assertEqual(result, "import_scan_request_result")

tools/devsecops_engine_tools/engine_utilities/defect_dojo/domain/request_objects/import_scan.py

@@ -24,6 +24,7 @@ class ImportScanRequest:
     deduplication_on_engagement: str = ""
     lead: str = ""
     tags: List[str] = dataclasses.field(default_factory=list)
+    apply_tags_to_findings: bool = False
     close_old_findings: str = ""
     close_old_findings_product_scope: str = ""
     push_to_jira: str = ""

tools/devsecops_engine_tools/engine_utilities/defect_dojo/domain/serializers/import_scan.py

@@ -232,6 +232,7 @@ class ImportScanSerializer(Schema):
     expression = fields.Str(required=True)
     reimport_scan = fields.Bool(required=False)
     get_exact_product = fields.Bool(required=False)
+    apply_tags_to_findings = fields.Bool(required=False, load_default=False)
 
     @post_load
     def make_cmdb(self, data, **kwargs):

tools/devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/import_scan.py

@@ -32,7 +32,7 @@ def import_scan_api(self, request: ImportScanRequest) -> ImportScanRequest:
             "deduplication_on_engagement": request.deduplication_on_engagement,
             "lead": request.lead,
             "tags": ",".join(request.tags) if request.tags else "",
-            "apply_tags_to_findings": "true",
+            "apply_tags_to_findings": str(request.apply_tags_to_findings).lower(),
             "close_old_findings": str(request.close_old_findings),
             "close_old_findings_product_scope": str(request.close_old_findings_product_scope),
             "push_to_jira": str(request.push_to_jira),
@@ -90,7 +90,7 @@ def import_scan(self, request: ImportScanRequest, files) -> ImportScanRequest:
             "deduplication_on_engagement": request.deduplication_on_engagement,
             "lead": request.lead,
             "tags": request.tags,
-            "apply_tags_to_findings": "true",
+            "apply_tags_to_findings": str(request.apply_tags_to_findings).lower(),
             "close_old_findings": request.close_old_findings,
             "close_old_findings_product_scope": request.close_old_findings_product_scope,
             "push_to_jira": request.push_to_jira,

tools/devsecops_engine_tools/engine_utilities/defect_dojo/test/infraestucture/driver_adapter/test_import_scan.py

@@ -52,3 +52,23 @@ def test_post_import_scan_info_failure():
     )
     with pytest.raises(ApiError):
         rest_import_scan.import_scan(request, file)
+
+
+def test_import_scan_applies_tags_to_findings_when_enabled():
+    session_mock = session_manager_post(status_code=201, mock_response="import_scan.json")
+    request = ImportScanRequest(apply_tags_to_findings=True)
+    rest_import_scan = ImportScanRestConsumer(request, session_mock)
+    with open(f"{DEVSECOPS_ENGINE_UTILITIES_PATH}/defect_dojo/test/files/import_scan.json", "r") as fp:
+        rest_import_scan.import_scan(request, fp)
+    sent_data = session_mock._instance.post.call_args.kwargs["data"]
+    assert sent_data["apply_tags_to_findings"] == "true"
+
+
+def test_import_scan_does_not_apply_tags_to_findings_by_default():
+    session_mock = session_manager_post(status_code=201, mock_response="import_scan.json")
+    request = ImportScanRequest()
+    rest_import_scan = ImportScanRestConsumer(request, session_mock)
+    with open(f"{DEVSECOPS_ENGINE_UTILITIES_PATH}/defect_dojo/test/files/import_scan.json", "r") as fp:
+        rest_import_scan.import_scan(request, fp)
+    sent_data = session_mock._instance.post.call_args.kwargs["data"]
+    assert sent_data["apply_tags_to_findings"] == "false"