Request/Response API CRUD Endpoints

dojo/api_v2/serializers.py

@@ -1,3 +1,4 @@
+import base64
 import collections
 import json
 import logging
@@ -45,6 +46,7 @@
     Answer,
     Answered_Survey,
     App_Analysis,
+    BurpRawRequestResponse,
     Check_List,
     ChoiceAnswer,
     ChoiceQuestion,
@@ -388,6 +390,65 @@ class BurpRawRequestResponseSerializer(serializers.Serializer):
     req_resp = RequestResponseSerializerField(required=True)
 
 
+class BurpRawRequestResponseMultiSerializer(serializers.ModelSerializer):
+    burpRequestBase64 = serializers.CharField()
+    burpResponseBase64 = serializers.CharField()
+
+    def get_stringrequest(self, obj) -> str:
+        result = ""
+        if isinstance(obj, dict):
+            result = obj.get("string_request", "")
+        elif obj.string_request:
+            result = obj.string_request
+
+        return result
+
+    def get_stringresponse(self, obj) -> str:
+        result = ""
+        if isinstance(obj, dict):
+            result = obj.get("string_response", "")
+        elif obj.string_response:
+            result = obj.string_response
+
+        return result
+
+    def to_representation(self, data):
+        return {
+            "id": data.id,
+            "finding": data.finding.id,
+            "burpRequestBase64": data.burpRequestBase64.decode("utf-8"),
+            "burpResponseBase64": data.burpResponseBase64.decode("utf-8"),
+        }
+
+    def validate(self, data):
+        b64request = data.get("burpRequestBase64", None)
+        b64response = data.get("burpResponseBase64", None)
+        finding = data.get("finding", None)
+
+        if not b64request or not b64response or not finding:
+            msg = "burpRequestBase64, burpResponseBase64, and finding are required."
+            raise ValidationError(msg)
+
+        base64.b64decode(b64request, validate=True)
+        base64.b64decode(b64response, validate=True)
+        b64request = b64request
+        b64response = b64response
+        data["burpRequestBase64"] = b64request.encode("utf-8")
+        data["burpResponseBase64"] = b64response.encode("utf-8")
+        if finding and b64request and b64response:
+            BurpRawRequestResponse(finding=finding,
+                                   burpRequestBase64=b64request,
+                                   burpResponseBase64=b64response).clean()
+        else:
+            msg = "Failed to validate data. finding, burpRequestBase64, and burpResponseBase64 cannot be null"
+            raise ValidationError(msg)
+        return data
+
+    class Meta:
+        model = BurpRawRequestResponse
+        fields = "__all__"
+
+
 class MetaSerializer(serializers.ModelSerializer):
     product = serializers.PrimaryKeyRelatedField(
         queryset=Product.objects.all(),

dojo/api_v2/views.py

@@ -2682,6 +2682,39 @@ def get_queryset(self):
         return Note_Type.objects.all().order_by("id")
 
 
+class BurpRawRequestResponseViewSet(
+    DojoModelViewSet,
+):
+    serializer_class = serializers.BurpRawRequestResponseMultiSerializer
+    queryset = BurpRawRequestResponse.objects.none()
+    filter_backends = (DjangoFilterBackend,)
+    filterset_fields = ["finding"]
+
+    def get_queryset(self):
+        results = BurpRawRequestResponse.objects.all()
+        empty_value = base64.b64encode(b"")
+        results = results.exclude(
+            burpRequestBase64__exact=empty_value,
+            burpResponseBase64__exact=empty_value,
+        )
+        return results.order_by("id")
+
+    @extend_schema(
+        responses={status.HTTP_200_OK: serializers.BurpRawRequestResponseMultiSerializer(many=True)},
+        methods=["GET"],
+    )
+    @action(methods=["get"], detail=False, serializer_class=serializers.BurpRawRequestResponseMultiSerializer,
+            filter_backends=[], pagination_class=None, url_path=r"finding/(?P<finding_id>\d+)")
+    def finding(self, request, pk=None, finding_id=None):
+        finding = get_object_or_404(Finding.objects, pk=finding_id)
+
+        reqresp = finding.get_valid_request_response_pairs() if finding else BurpRawRequestResponse.objects.all()
+
+        # Send a favorable response
+        serialized_request_response = serializers.BurpRawRequestResponseMultiSerializer(reqresp, many=True)
+        return Response(serialized_request_response.data)
+
+
 # Authorization: superuser
 class NotesViewSet(
     mixins.UpdateModelMixin,

dojo/urls.py

@@ -14,6 +14,7 @@
 from dojo.api_v2.views import (
     AnnouncementViewSet,
     AppAnalysisViewSet,
+    BurpRawRequestResponseViewSet,
     ConfigurationPermissionViewSet,
     CredentialsMappingViewSet,
     CredentialsViewSet,
@@ -156,6 +157,7 @@
 v2_api.register(r"product_type_groups", ProductTypeGroupViewSet, basename="product_type_group")
 v2_api.register(r"regulations", RegulationsViewSet, basename="regulations")
 v2_api.register(r"reimport-scan", ReImportScanView, basename="reimportscan")
+v2_api.register(r"request_response_pairs", BurpRawRequestResponseViewSet, basename="request_response_pairs")
 v2_api.register(r"risk_acceptance", RiskAcceptanceViewSet, basename="risk_acceptance")
 v2_api.register(r"roles", RoleViewSet, basename="role")
 v2_api.register(r"sla_configurations", SLAConfigurationViewset, basename="sla_configurations")

unittests/test_apiv2_methods_and_endpoints.py

@@ -9,7 +9,6 @@
     Benchmark_Product_Summary,
     Benchmark_Requirement,
     Benchmark_Type,
-    BurpRawRequestResponse,
     Choice,
     Contact,
     FileAccessToken,
@@ -92,7 +91,6 @@ def setUp(self):
             Product_Line,
             Report_Type,
             CWE,
-            BurpRawRequestResponse,
             FileAccessToken,
             UserAnnouncement,
             BannerConf,

unittests/test_rest_framework.py

@@ -31,6 +31,7 @@
 from dojo.api_v2.views import (
     AnnouncementViewSet,
     AppAnalysisViewSet,
+    BurpRawRequestResponseViewSet,
     ConfigurationPermissionViewSet,
     CredentialsMappingViewSet,
     CredentialsViewSet,
@@ -3049,3 +3050,29 @@ def __init__(self, *args, **kwargs):
         self.test_type = TestType.STANDARD
         self.deleted_objects = 1
         BaseClass.RESTEndpointTest.__init__(self, *args, **kwargs)
+
+
+class BurpRawRequestResponseTest(BaseClass.BaseClassTest):
+    fixtures = ["dojo_testdata.json"]
+
+    def __init__(self, *args, **kwargs):
+        self.endpoint_model = BurpRawRequestResponse
+        self.endpoint_path = "request_response_pairs"
+        self.viewname = "request_response_pairs"
+        self.viewset = BurpRawRequestResponseViewSet
+        self.payload = {
+            "finding": 2,
+            "burpRequestBase64": "R0VUIC9hcnRpc3QucGhwP2lkPS0xJTIwT1IlMjAxNy03JTNkMTAgSFRUUC8xLjENCkhvc3Q6IHBocC50ZXN0c3Bhcmtlci5jb20NCkFjY2VwdDogdGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOA0KQWNjZXB0LUxhbmd1YWdlOiBlbi11cyxlbjtxPTAuNQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCkNvb2tpZTogUEhQU0VTU0lEPWU1MmEwN2YwZmU1M2MwMjk0YWUyMTFiYzQ0ODEzMzJkDQpSZWZlcmVyOiBodHRwOi8vcGhwLnRlc3RzcGFya2VyLmNvbS9wcm9jZXNzLnBocD9maWxlPUdlbmVyaWNzL2luZGV4Lm5zcA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzkuMC4zOTQ1LjAgU2FmYXJpLzUzNy4zNg0KWC1TY2FubmVyOiBBY3VuZXRpeDM2MA==",
+            "burpResponseBase64": "SFRUUC8xLjEgMjAwIE9LDQpTZXQtQ29va2llOiBQSFBTRVNTSUQ9ZTUyYTA3ZjBmZTUzYzAyOTRhZTIxMWJjNDQ4MTMzMmQ7IHBhdGg9Lw0KU2VydmVyOiBBcGFjaGUvMi4yLjggKFdpbjMyKSBQSFAvNS4yLjYNCkNvbnRlbnQtTGVuZ3RoOiAzMDYxDQpYLVBvd2VyZWQtQnk6IFBIUC81LjIuNg0KUHJhZ21hOiBuby1jYWNoZQ0KRXhwaXJlczogVGh1LCAxOSBOb3YgMTk4MSAwODo1MjowMCBHTVQ8IS0tIGVuZCAjZm9vdGVyIC0tPgo8L2JvZHk+CjwvaHRtbD4K",
+        }
+
+        # This fails due to the return being a bytes object and the input being a string...
+        self.update_fields = {
+            "finding": 2,
+            "burpRequestBase64": "R0VUIC9hcnRpc3QucGhwP2lkPS0xJTIwT1IlMjAxNy03JTNkMTAgSFRUUC8xLjENCkhvc3Q6IHBocC50ZXN0c3Bhcmtlci5jb20NCkFjY2VwdDogdGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOA0KQWNjZXB0LUxhbmd1YWdlOiBlbi11cyxlbjtxPTAuNQ0KQ2FjaGUtQ29udHJvbDogbm8tY2FjaGUNCkNvb2tpZTogUEhQU0VTU0lEPWU1MmEwN2YwZmU1M2MwMjk0YWUyMTFiYzQ0ODEzMzJkDQpSZWZlcmVyOiBodHRwOi8vcGhwLnRlc3RzcGFya2VyLmNvbS9wcm9jZXNzLnBocD9maWxlPUdlbmVyaWNzL2luZGV4Lm5zcA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzkuMC4zOTQ1LjAgU2FmYXJpLzUzNy4zNg0KWC1TY2FubmVyOiBBY3VuZXRpeDM2MA==",
+            "burpResponseBase64": "SFRUUC8xLjEgMjAwIE9LDQpTZXQtQ29va2llOiBQSFBTRVNTSUQ9ZTUyYTA3ZjBmZTUzYzAyOTRhZTIxMWJjNDQ4MTMzMmQ7IHBhdGg9Lw0KU2VydmVyOiBBcGFjaGUvMi4yLjggKFdpbjMyKSBQSFAvNS4yLjYNCkNvbnRlbnQtTGVuZ3RoOiAzMDYxDQpYLVBvd2VyZWQtQnk6IFBIUC81LjIuNg0KUHJhZ21hOiBuby1jYWNoZQ0KRXhwaXJlczogVGh1LCAxOSBOb3YgMTk4MSAwODo1MjowMCBHTVQ8IS0tIGVuZCAjZm9vdGVyIC0tPgo8L2JvZHk+CjwvaHRtbD4K",
+        }
+
+        self.test_type = TestType.STANDARD
+        self.deleted_objects = 1
+        BaseClass.RESTEndpointTest.__init__(self, *args, **kwargs)