Wizcli improvements

[OsamaMahmood]

Description

1. Core Functionality:

• Implemented a robust parsing system for different types of Wiz CLI scan results:
  • Library vulnerabilities
  • Secrets detection
  • OS package vulnerabilities
  • Infrastructure as Code (IaC) rule matches

2. Deduplication Improvements:

• Enhanced the _generate_unique_id method to ensure consistent finding deduplication using unique_id_from_tool:
  • Now uses sorted components for stable hash generation
  • Properly handles None values and whitespace
  • Fixed docstring formatting and code style issues
  • Components are now consistently ordered regardless of input order

Checklist

This checklist is for your information.

• Make sure to rebase your PR against the very latest dev.
• Features/Changes should be submitted against the dev.
• Bugfixes should be submitted against the bugfix branch.
• Give a meaningful name to your PR, as it may end up being used in the release notes.
• Your code is flake8 compliant.
• Your code is python 3.11 compliant.
• If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
• Model changes must include the necessary migrations in the dojo/db_migrations folder.
• Add applicable tests to the unit tests.
• Add the proper label to categorize your PR.

[dryrunsecurity]

This pull request contains multiple low-confidence findings related to potential security and parsing weaknesses in the wizcli_common_parsers, including risks of information disclosure, imprecise URL matching, hardcoded severity limitations, logging exposure, and broad exception handling that could reveal system internals.

💭 Unconfirmed Findings (5)

Vulnerability	Potential Information Disclosure in Unique ID Generation
Description	Hash generation in dojo/tools/wizcli_common_parsers/parsers.py could leak finding characteristics if not carefully implemented, with potential for inadvertent sensitive data inclusion.

Vulnerability	Regex-based URL Extraction Weakness
Description	Basic regex in dojo/tools/wizcli_common_parsers/parsers.py might lead to incomplete or incorrect URL matching, creating potential limitations in URL detection.

Vulnerability	Hardcoded Severity Mapping Limitation
Description	Static severity mapping in dojo/tools/wizcli_common_parsers/parsers.py might not cover all severity variations, potentially causing unexpected severity assignments.

Vulnerability	Logging-based Information Disclosure Risks
Description	Extensive logging across multiple parser files could expose sensitive scan result details, potentially revealing system security posture if logs are not secured.

Vulnerability	Broad Exception Handling Vulnerabilities
Description	Catch-all exception blocks in multiple parser files could mask errors and potentially leak internal implementation details, exposing system internals through error messages.

---

All finding details can be found in the DryRun Security Dashboard.

[OsamaMahmood]

✅ Test Scan Results – Parser Behavior & Deduplication

1. scan_img.json

• Status: ✅ Working as expected
• Details: Deduplication is functioning correctly. No duplicate findings are created on reimport.

---

2. scan_dir.json

• Status: ✅ Working as expected
• Details: Deduplication is functioning correctly. No duplicate findings are created on reimport.

---

3. scan_iac.json

• Status: ❌ Not working as expected
• Issue: When the same scan result is reimported, the system closes the existing finding and re-creates it as a new one, instead of recognizing it as a duplicate.
• Expected Behavior: The system should retain the original finding and not create a duplicate on reimport as we are already setting unique id from tool for deduplication to work not sure whats happening .

[valentijnscholten]

Thank you @OsamaMahmood for your extensive PR. We do have some feedback:

• Could you look at updating the tests/samples scans to reflect the updates to the parsers?
• Could you look using the hash code configuration for deduplication?

I just raised #12463 to clarify the use of the unique_id_from_tool field. It's intended/accepted use is to contain value present in the report that can be used to recognize the finding inside the tool. And for strong and exact deduplication.
We will discuss internally if/how we can accomodate values computed by the parser that might be useful for deduplication.