Ruff: Fix RUF052

[kiblik]

Fix RUF052. Enabler for #11490. Alternative to #11450

[dryrunsecurity]

DryRun Security Summary

The code changes enhance DefectDojo's vulnerability parsing and reporting capabilities by improving parsers for Qualys and Veracode scans, implementing rate limiting with account lockout, and focusing on more accurate and secure vulnerability data import.

Expand for full summary

Summary:

The provided code changes cover several improvements and enhancements to the DefectDojo application's vulnerability parsing and reporting functionalities. The key changes include:

1. Qualys Vulnerability Parser: Improvements to the Qualys vulnerability parser, including better handling of CVSS scores, vulnerability status, description formatting, and extraction of CVE IDs and references. These changes help ensure accurate and complete vulnerability data is imported into DefectDojo.

2. Rate Limiting and Account Lockout: Enhancements to the rate limiting decorator, which now includes the ability to enable account lockout for users who exceed the rate limit. This is an important security measure to protect the application from abuse.

3. Qualys Infrastructure Scan Parser: Implementation of a new parser for Qualys Infrastructure Scan (WebGUI XML) reports, which extracts relevant vulnerability information such as host details, operating system, and vulnerability details. The parser uses secure practices like XML parsing and HTML sanitization.

4. Veracode SAST and SCA Parsing: Improvements to the Veracode XML report parser, including separate handling for SAST (Static Application Security Testing) and SCA (Software Composition Analysis) findings. The changes ensure accurate representation of mitigation status, false positives, and deduplication of findings.

Overall, these code changes demonstrate a strong focus on improving the security and accuracy of vulnerability data imported into the DefectDojo application. The changes address various aspects of the vulnerability management process, from parsing and processing the raw scan data to providing enhanced reporting and tracking capabilities.

Files Changed:

1. dojo/tools/qualys/parser.py: Improvements to the Qualys vulnerability parser, including better CVSS handling, vulnerability status tracking, and vulnerability description formatting.
2. dojo/decorators.py: Enhancements to the rate limiting decorator, including the ability to enable account lockout for users who exceed the rate limit.
3. dojo/tools/qualys_infrascan_webgui/parser.py: Implementation of a new parser for Qualys Infrastructure Scan (WebGUI XML) reports, which extracts host details and vulnerability information.
4. dojo/tools/veracode/xml_parser.py: Improvements to the Veracode XML report parser, including separate handling for SAST and SCA findings, mitigation status tracking, and deduplication of findings.

Code Analysis

We ran 9 analyzers against 4 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved