ms_defender: Improve reliability and error handling

[valentijnscholten]

Fixes #11896

Exceptions such as KeyErrors were silently swallowed leading to endpoints not being created for findings.

This PR:

• Logs the exception
• Greatly reduces the chances of exceptions by using .get to retrieve values from the dict/json object
• Added test case with a report that was triggering this because of a missing defenderAvStatus field.

I tried to remove the str() wrappers everywhere, but it seems they are needed to handle the "" vs null vs None cases with these json reports. So I left them for now.

[dryrunsecurity]

DryRun Security Summary

The PR enhances the MS Defender parser by implementing data sanitization, safer dictionary access, and improved endpoint creation validation, along with corresponding unit tests to ensure more robust handling of scan results.

Expand for full summary

The PR updates the MS Defender parser and adds a corresponding unit test to improve error handling and parsing robustness for Microsoft Defender scan results. Security findings include:

1. Data Sanitization Risk (dojo/tools/ms_defender/parser.py):

   • String replacement for computerDnsName to remove problematic characters
   • Potential risk of character injection or parsing manipulation

2. Potential Information Disclosure (dojo/tools/ms_defender/parser.py):

   • Replaced direct dictionary access with .get() method
   • Mitigates risk of unhandled exceptions revealing internal application details

3. Endpoint Creation Safety (dojo/tools/ms_defender/parser.py):

   • Added existence checks before creating Endpoint objects
   • Prevents potential None value assignments that could lead to unexpected behavior

No additional critical security vulnerabilities were identified in the patch.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[valentijnscholten]

@manuel-sommer Could you review this PR?

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[manuel-sommer]

looks good to me

[mtesauro]

Approved