Source code repositories

Integration of repositories to navigate to the locaction of findings in the source code.

Findings can have a filepath and a line number as the location of the vulnerability. This is typically set when scanning an application with a Static Application Security Test (SAST) tool. If the repository of the source code is specified in the Engagement, DefectDojo will present the filepath as a link and the user can navigate directly to the location of the vulnerability.

Setting the repository in the Engagement and Test

Engagement

While editing the Engagement, users can set the URL of the specific SCM repo. For Interactive Engagement it needs to be the URL including the branch:

For CI/CD Engagement, where user could set commit hash, branch/tag and code line it should look like examples below:

If user does not set commit hash or branch/tag in appropriate fields of CI/CD Engagement edit form, the URL should look like in Interactive Engagement edit form.

SCM navigation URL is composed from Repo URL using SCM Type. Github/Gitlab SCM type is default, but user could set certain SCM type in Product custom field “scm-type”.

Product custom fields:

Product custom fields

Product SCM type add:

Product scm type

Possible SCM types could be ‘github’, ‘gitlab’, ‘bitbucket’, ‘bitbucket-standalone’, ‘gitea’, ‘codeberg’ or nothing (for default github).

When viewing a finding, the location will be presented as a link, if the repository of the source code has been set in the Engagement:

Link to location

Clicking on this link will open a new tab in the browser, with the source file of the vulnerability at the corresponding line number:

View in repository