Import of NPM Audit result not working when paths are empty.

[pr3l14t0r]

Ahoi! There seems to be a problem with the NPM Audit parser.
In the report i do get from my tool, some paths entries are empty in the resulting json.
Example (stripped):

    "1089551": {
      "findings": [
        {
          "version": "6.0.23",
          "paths": []
        },
        {
          "version": "5.2.18",
          "paths": []
        },
        {
          "version": "7.0.32",
          "paths": []
        }
      ],

If i use the sample json file, the import works. But changing an arbitrary paths entry to "paths": [] will lead to the same error that i get for my result file:

DEBUG [dojo.importers.importer.importer:297] IMPORT_SCAN: Parse findings
ERROR [dojo.engagement.views:698] list index out of range
Traceback (most recent call last):
File "/app/dojo/engagement/views.py", line 682, in import_scan_results
test, finding_count, closed_finding_count, _ = importer.import_scan(scan, scan_type, engagement, user, environment, active=active, verified=verified, tags=tags,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/dojo/importers/importer/importer.py", line 300, in import_scan
 parsed_findings = parser.get_findings(scan, test)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/app/dojo/tools/npm_audit/parser.py", line 24, in get_findings
return self.get_items(tree, test)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/app/dojo/tools/npm_audit/parser.py", line 55, in get_items
 item = get_item(node, test)
 ^^^^^^^^^^^^^^^^^^^^
 File "/app/dojo/tools/npm_audit/parser.py", line 99, in get_item
file_path=censor_path_hashes(item_node['findings'][0]['paths'][0]),
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^
 IndexError: list index out of range

My best guess would be that the function censor_path_hashes is handling empty paths arrays incorrectly. Could you help me out here?

** Reproduction **

Prepare sample file:

1. Download the sample NPM Scan
2. Open the json file. Within the advisories nodes, choose one or a few finding subnodes and change the "paths" value to "paths": []
3. Save the file.

In DefectDojo:

1. In a random engagement, try to add Findings via the Import Scan results feature/button.
2. Fill in necessary fields
3. As Scan Type choose NPM Audit Scan
4. Select the previously prepared file as the file to upload.
5. Observe that the import did fail:

Also notice the log files. In my case - using a containerized environment - inspect the logs of the uwsgi container.

[manuel-sommer]

Can you close this @mtesauro ?