🐛 fix bearer_cli #11245

[manuel-sommer]

#11245

[dryrunsecurity]

DryRun Security Summary

The code change in the dojo/tools/bearer_cli/parser.py file is related to the handling of the snippet or code_extract fields in the Finding object, which is likely a defensive measure to handle cases where the "snippet" field may not always be available in the input data.

Expand for full summary

Summary:

The code change in the dojo/tools/bearer_cli/parser.py file is related to the handling of the snippet or code_extract fields in the Finding object. The key change is that if the "snippet" field is not present in the bearerfinding dictionary, the code will attempt to use the "code_extract" field instead. This is likely a defensive measure to handle cases where the "snippet" field may not always be available in the input data.

From an application security perspective, this change is not particularly noteworthy, as it is simply handling the parsing of a report file and creating Finding objects based on the data in the file. However, it's worth noting that the Finding object being created contains several security-relevant fields, which are likely used by other parts of the application security tooling to track and manage security findings, an important aspect of secure software development. Overall, this code change appears to be a minor improvement to the robustness of the parser and does not raise any immediate security concerns.

Files Changed:

• dojo/tools/bearer_cli/parser.py: The code change in this file is related to the handling of the snippet or code_extract fields in the Finding object. Specifically, the change is made in the get_findings method, where the description of the finding is being constructed. The key change ensures that if the "snippet" field is not present in the bearerfinding dictionary, the code will attempt to use the "code_extract" field instead.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved.

Nice way to fix for both potential cases 👍