You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When developing documentation, there are steps to take before submitting a pull request
4
+
5
+
1. Writing your documentation with [hot reloading](#development-with-hot-reloading) live in your browser
6
+
2. Verifying your changes with a [production build](#mimic-production-environment) to ensure Hugo will minify everything correctly
7
+
8
+
## Development with Hot Reloading
9
+
10
+
This method performs the following from the `django-DefectDojo/docs` directory:
11
+
12
+
1. Remove any existing packages to perform a fresh install each time: `rm -rf public node_modules`
13
+
2. Install all packages: `npm install`
14
+
3. Start the server: `npm run dev`
15
+
4. Access the [site in the browser at http://localhost:1313](http://localhost:1313)
16
+
17
+
### Execution List
18
+
19
+
```bash
20
+
rm -rf public node_modules
21
+
npm install
22
+
npm run dev
23
+
```
24
+
25
+
or for a one liner:
26
+
27
+
```bash
28
+
rm -rf public node_modules && \
29
+
npm install && \
30
+
npm run dev
31
+
```
32
+
33
+
## Mimic Production Environment
34
+
35
+
This method performs the following from the `django-DefectDojo/docs` directory:
36
+
37
+
1. Remove any existing packages to perform a fresh install each time: `rm -rf public node_modules`
38
+
2. Install all packages in CI mode to only install from `package-lock.json`: `npm ci`
39
+
3. Run Hugo to build the site in the way the CI job does, but in development environment to point at `localhost` for integrity checks : `npm run build -- --environment development`
40
+
4. Change directory to the new `public` directory to run the site locally: `cd public`
41
+
5. Run a light weight webserver to server the files, and [access the site at http://localhost:8080](http://localhost:8080): `python3 -m http.server 8080`
42
+
6. After killing the webserver process, navigate back to the `django-DefectDojo/docs` directory: `cd ../`
The Snyk Issue API parser supports importing vulnerability data from the Snyk Issue API in JSON format. Currently only parsing issues of type `code` is supported. Samples of ther issue types are welcome.
6
+
7
+
For more information about the Snyk Issue API, refer to the [official Snyk API documentation](https://docs.snyk.io/snyk-api/reference/issues#get-orgs-org_id-issues).
8
+
9
+
### API request
10
+
Example API request to get only code issues:
11
+
```
12
+
GET https://api.snyk.io/rest/orgs/{org_id}/issues?version=2025-08-02&type=code
13
+
```
14
+
15
+
For more details see: https://docs.snyk.io/snyk-api/reference/issues#get-orgs-org_id-issues
16
+
17
+
### Sample Scan Data
18
+
Sample Snyk Issue API scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/snyk_issue_api).
19
+
20
+
### Field Mapping
21
+
The parser maps fields from the Snyk Issue API response to DefectDojo's Finding model as follows:
22
+
23
+
| Finding Field | Snyk Issue API Field | Notes |
24
+
|--------------|---------------------|-------|
25
+
| title | attributes.title ||
26
+
| severity | attributes.effective_severity_level | Mapped to Critical/High/Medium/Low/Info |
27
+
| description | attributes.description ||
28
+
| unique_id_from_tool | id | Top-level issue ID |
29
+
| file_path | coordinates[].representations[].sourceLocation.file | First occurrence |
30
+
| line | coordinates[].representations[].sourceLocation.region.start.line | Line where the issue starts |
31
+
| date | attributes.created_at | ISO format date |
32
+
| cwe | classes[].id | First CWE class found |
33
+
| active | attributes.status == "open" AND NOT attributes.ignored | Inactive if ignored or not open |
34
+
| verified | true | Always set to true |
35
+
| static_finding | true | Always set to true |
36
+
| dynamic_finding | false | Always set to false |
37
+
| out_of_scope | attributes.ignored | Set to true if issue is ignored |
38
+
| fix_available*| coordinates[].is_fixable_*| True if any fixability flag is true. |
39
+
40
+
#### Impact Field
41
+
The impact field combines multiple pieces of information:
42
+
1. Problem details:
43
+
- Source (e.g., "SNYK")
44
+
- Type (e.g., "vulnerability")
45
+
- Last update timestamp
46
+
- Severity level
47
+
2. All source locations, each containing:
48
+
- File path
49
+
- Commit ID
50
+
- Line range (start-end)
51
+
- Column range (start-end)
52
+
53
+
#### Additional Processing
54
+
- Multiple CWEs are handled by using the first one as the primary CWE and listing additional ones in the references field
55
+
- Risk scores are included in the severity_justification field when available
56
+
- Only issues with type="code" are processed
57
+
- Line numbers: Only the starting line is stored in the Finding model, but both start and end lines are included in the impact field for reference
58
+
59
+
### Default Deduplication Hashcode Fields
60
+
By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/):
0 commit comments