"product with this name already exists." error when sending trivy image scan results to DefectDojo #2285
Description
🐞 Bug report
Describe the bug
We scan Docker image using trivy image command and the hook secureCodeBox/persistence-defectdojo fails with the following error:
2024-02-13 14:29:33 INFO DefectDojoPersistenceProvider:25 - Starting DefectDojo persistence provider
2024-02-13 14:29:40 INFO DefectDojoPersistenceProvider:36 - Downloading Scan Result
2024-02-13 14:29:45 INFO DefectDojoPersistenceProvider:40 - Uploading Findings to DefectDojo at: https://defectdojo.infra.mana.wtf
2024-02-13 14:29:46 INFO VersionedEngagementsStrategy:85 - Running with DefectDojo User Id: 1
2024-02-13 14:29:46 INFO VersionedEngagementsStrategy:203 - Looking for ID of ProductType 'Application'
2024-02-13 14:29:47 INFO VersionedEngagementsStrategy:206 - ProductType 'Application' didn't already exists creating now
2024-02-13 14:29:47 INFO VersionedEngagementsStrategy:210 - Using ProductType Id: 3
2024-02-13 14:29:47 INFO VersionedEngagementsStrategy:229 - Creating Product: 'mana-game-service'
Exception in thread "main" org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: "{"name":["product with this name already exists."],"message":"{'name': [ErrorDetail(string='product with this name already exists.', code='unique')]}"}"
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:101)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:168)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:122)
at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63)
at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:825)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:783)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:717)
at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:608)
at io.securecodebox.persistence.defectdojo.service.GenericDefectDojoService.create(GenericDefectDojoService.java:221)
at io.securecodebox.persistence.strategies.VersionedEngagementsStrategy.lambda$ensureProductExistsForScan$5(VersionedEngagementsStrategy.java:230)
at java.base/java.util.Optional.orElseGet(Optional.java:364)
at io.securecodebox.persistence.strategies.VersionedEngagementsStrategy.ensureProductExistsForScan(VersionedEngagementsStrategy.java:228)
at io.securecodebox.persistence.strategies.VersionedEngagementsStrategy.run(VersionedEngagementsStrategy.java:87)
at io.securecodebox.persistence.DefectDojoPersistenceProvider.main(DefectDojoPersistenceProvider.java:43)
(We do have the product in DefectDojo and we want to reuse it for this scan results.)
Steps To Reproduce
-
Create a product "name-of-the-product" in DefectDojo
-
Run trivy scan with the following yaml:
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "trivy-image"
annotations:
defectdojo.securecodebox.io/product-type-name: Application
defectdojo.securecodebox.io/product-name: name-of-the-product
defectdojo.securecodebox.io/engagement-name: "Trivy image scan"
defectdojo.securecodebox.io/test-title: "Trivy image @ tag"
spec:
scanType: "trivy-image"
parameters:
- "registry.domain.tld/image:tag"
Expected behavior
Check if the hook persistence-defectdojo succeeds.
System (please complete the following information):
- operator-4.3.0
- trivy-4.3.0
- persistence-defectdojo-4.3.0
Google Kubernetes Engine
Client Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.4", GitCommit:"872a965c6c6526caa949f0c6ac028ef7aff3fb78", GitTreeState:"clean", BuildDate:"2022-11-09T13:28:30Z", GoVersion:"go1.19.3", Compiler:"gc", Platform:"darwin/arm64"}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.10-gke.1101000", GitCommit:"375ed214cfa092ed25d2472c1709db5d7dcda078", GitTreeState:"clean", BuildDate:"2023-11-06T09:23:17Z", GoVersion:"go1.20.10 X:boringcrypto", Compiler:"gc", Platform:"linux/amd64"}