dradis-burp 3.13.0 → 3.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: a8034f8e440c364e55c983a3d413fe7111b5d7e1
-  data.tar.gz: 0daba2fe9ef55228264d5f3e83d6a88d0ddad849
+SHA256:
+  metadata.gz: f87e164401b9a2bd5ee2a795d93448651ed2eb08d6cebc661fefde6b15c57315
+  data.tar.gz: 1e46a0f0d296996623a3e479ddd2f7d6a666672ebfade92ad4883c62a740c096
 SHA512:
-  metadata.gz: f0960ebadfdbb8096f1bf841fc707cc78290d1feaf8cb619ced75999ff0f41c66ca1b332bd9691a16a5f5683d76d8f234d829bfeaa8c59ebc5383afd5eacf2b1
-  data.tar.gz: 68f6554c4c1772bfaa8c0e2ab1d35cd3ddd679bd30dbee7269299fa2242c8ab9f5cf085f3bad2578f4ffb2e38b55ae253b52c880c8f781a52a55f339746c34eb
+  metadata.gz: f5e7b6bc8a65e1d15fec78bb2da94ea36bd11e468d9d2dc15b1535b7f7df955dbfe077bdeda67aa3e632282bc26412ccf1aafffba9068a420d5433e774becce4
+  data.tar.gz: d5691cc2a904caa1d8f469e9bd48650a424ee2768bb41f82cd78101bfacdcb65b32f2c69011cf223e2e3f32614a9ff0239e6d2ffebd4902a599f383e695c6986

data/.github/issue_template.md

@@ -0,0 +1,16 @@
+### Steps to reproduce
+
+Help us help you, how can we reproduce the problem?
+
+### Expected behavior
+Tell us what should happen
+
+### Actual behavior
+Tell us what happens instead
+
+### System configuration
+**Dradis version**:
+
+**Ruby version**:
+
+**OS version**:

data/.github/pull_request_template.md

@@ -0,0 +1,36 @@
+### Summary
+
+Provide a general description of the code changes in your pull
+request... were there any bugs you had fixed? If so, mention them. If
+these bugs have open GitHub issues, be sure to tag them here as well,
+to keep the conversation linked together.
+
+
+### Other Information
+
+If there's anything else that's important and relevant to your pull
+request, mention that information here. This could include
+benchmarks, or other information.
+
+Thanks for contributing to Dradis!
+
+
+### Copyright assignment
+
+Collaboration is difficult with commercial closed source but we want
+to keep as much of the OSS ethos as possible available to users
+who want to fix it themselves.
+
+In order to unambiguously own and sell Dradis Framework commercial
+products, we must have the copyright associated with the entire
+codebase. Any code you create which is merged must be owned by us.
+That's not us trying to be a jerks, that's just the way it works.
+
+Please review the [CONTRIBUTING.md](https://github.com/dradis/dradis-ce/blob/master/CONTRIBUTING.md)
+file for the details.
+
+You can delete this section, but the following sentence needs to
+remain in the PR's description:
+
+> I assign all rights, including copyright, to any future Dradis
+> work by myself to Security Roots.

data/CHANGELOG.md

@@ -1,10 +1,30 @@
-## Dradis Framework 3.13 (XXX, 2019) ##
+## Dradis Framework 3.18 (July, 2020) ##
 
-*   Include parsing Burp Html output
+*   No changes.
+
+## Dradis Framework 3.17 (May, 2020) ##
+
+*   No changes.
+
+## Dradis Framework 3.16 (February, 2020) ##
+
+*   Update severity fixture for specs.
+
+## Dradis Framework 3.15 (November, 2019) ##
+
+*   Make `issue.severity` available at the Issue level.
+
+## Dradis Framework 3.14 (August, 2019) ##
+
+*   No changes.
+
+## Dradis Framework 3.13 (June, 2019) ##
+
+*   Include parsing Burp Html output.
 
 ## Dradis Framework 3.12 (March, 2019) ##
 
-*   Make `issue.detail` available at the Evidence level
+*   Make `issue.detail` available at the Evidence level.
 
 ## Dradis Framework 3.11 (November, 2018) ##
 
@@ -12,17 +32,17 @@
 
 ## Dradis Framework 3.10 (August, 2018) ##
 
-*   Adds `references` and `vulnerability_classifications` as available fields
+*   Adds `references` and `vulnerability_classifications` as available fields.
 
-*   Adds `hostname` as a Node property
+*   Adds `hostname` as a Node property.
 
-*   Fixes formatting errors including `<p>`, `<a href="">`, and `<table>` tags
+*   Fixes formatting errors including `<p>`, `<a href="">`, and `<table>` tags.
 
-*   Findings with <type>134217728</type> are not bundled together into one Issue
+*   Findings with <type>134217728</type> are not bundled together into one Issue.
 
 ## Dradis Framework 3.9 (January, 2018) ##
 
-*   Encode content with UTF-8 to avoid incompatible db errors (v3.8.1)
+*   Encode content with UTF-8 to avoid incompatible db errors (v3.8.1).
 
 ## Dradis Framework 3.8 (September, 2017) ##
 

data/lib/dradis/plugins/burp/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 3
-        MINOR = 13
+        MINOR = 18
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/burp/xml/importer.rb

@@ -12,10 +12,14 @@ module Dradis::Plugins::Burp
     end
 
     class Importer < Dradis::Plugins::Upload::Importer
+      BURP_EXTENSION_TYPE = '134217728'.freeze
+      BURP_SEVERITIES     = ['Information', 'Low', 'Medium', 'High'].freeze
+
       def initialize(args={})
         args[:plugin] = Dradis::Plugins::Burp
         super(args)
       end
+
       def import(params = {})
         file_content = File.read(params[:file])
 
@@ -33,80 +37,39 @@ module Dradis::Plugins::Burp
         logger.info { 'Done.' }
 
         if doc.root.name != 'issues'
-          error = "Document doesn't seem to be in the Burp Scanner XML format."
+          error = 'Document doesn\'t seem to be in the Burp Scanner XML format.'
           logger.fatal { error }
           content_service.create_note text: error
           return false
         end
 
         # This will be filled in by the Processor while iterating over the issues
-        @hosts         = []
-        @affected_host = nil
-        @issue_text    = nil
-        @evidence_text = nil
+        @issues     = []
+        @severities = Hash.new(0)
 
+        # We need to look ahead through all issues to bring the highest severity
+        # of each instance to the Issue level.
         doc.xpath('issues/issue').each do |xml_issue|
-          process_issue(xml_issue)
-        end
-
-        logger.info { 'Burp Scanner results successfully imported' }
-        true
-      end
-
-      # Creates the Nodes/properties
-      def process_issue(xml_issue)
-        host_label = xml_issue.at('host')['ip']
-        host_label = xml_issue.at('host').text if host_label.empty?
-        affected_host = content_service.create_node(label: host_label, type: :host)
-        logger.info { "\taffects: #{host_label}" }
+          issue_id       = issue_id_for(xml_issue)
+          issue_severity = BURP_SEVERITIES.index(xml_issue.at('severity').text)
 
-        unless @hosts.include?(affected_host.label)
-          @hosts << affected_host.label
-          url = xml_issue.at('host').text
-          affected_host.set_property(:hostname, url)
-          affected_host.save
+          @severities[issue_id] = issue_severity if issue_severity > @severities[issue_id]
+          @issues << xml_issue
         end
 
-        # Burp extensions don't follow the "unique type for every Issue" logic
-        # so we have to deal with them separately
-        burp_extension_type = '134217728'.freeze
-        if xml_issue.at('type').text.to_str == burp_extension_type
-          process_extension_issues(affected_host, xml_issue)
-        else
-          process_burp_issues(affected_host, xml_issue)
-        end
-      end
-
-      # If the Issues come from the Burp app, use the type as the plugin_ic
-      def process_burp_issues(affected_host, xml_issue)
-        issue_name = xml_issue.at('name').text
-        issue_type = xml_issue.at('type').text.to_i
+        @issues.each { |xml_issue| process_issue(xml_issue) }
 
-        logger.info { "Adding #{issue_name} (#{issue_type})" }
-
-        create_issue(
-          affected_host: affected_host,
-          id: issue_type,
-          xml_issue: xml_issue
-        )
+        logger.info { 'Burp Scanner results successfully imported' }
+        true
       end
 
-      # If the Issues come from a Burp extension (type = 134217728), then
-      # use the name (spaces removed) as the plugin_id
-      def process_extension_issues(affected_host, xml_issue)
-        ext_name = xml_issue.at('name').text
-        ext_name = ext_name.gsub!(" ", "")
+      private
+      def create_issue(affected_host:, id:, xml_issue:)
+        xml_evidence = xml_issue.clone
 
-        logger.info { "Adding #{ext_name}" }
+        # Ensure that the Issue contains the highest Severity value
+        xml_issue.at('severity').content = BURP_SEVERITIES[@severities[id]]
 
-        create_issue(
-          affected_host: affected_host,
-          id: ext_name,
-          xml_issue: xml_issue
-        )
-      end
-
-      def create_issue(affected_host:, id:, xml_issue:)
         issue_text =
           template_service.process_template(
             template: 'issue',
@@ -129,7 +92,7 @@ module Dradis::Plugins::Burp
         evidence_text =
           template_service.process_template(
             template: 'evidence',
-            data: xml_issue
+            data: xml_evidence
           )
 
         if evidence_text.include?(::Burp::INVALID_UTF_REPLACE)
@@ -145,6 +108,37 @@ module Dradis::Plugins::Burp
           content: evidence_text
         )
       end
+
+      # Burp extensions don't follow the "unique type for every Issue" logic
+      # so we have to deal with them separately
+      def issue_id_for(xml_issue)
+        if xml_issue.at('type').text == BURP_EXTENSION_TYPE
+          xml_issue.at('name').text.gsub!(' ', '')
+        else
+          xml_issue.at('type').text.to_i
+        end
+      end
+
+      # Creates the Nodes/properties
+      def process_issue(xml_issue)
+        host_url   = xml_issue.at('host').text
+        host_label = xml_issue.at('host')['ip']
+        host_label = host_url if host_label.empty?
+        issue_id   = issue_id_for(xml_issue)
+
+        affected_host = content_service.create_node(label: host_label, type: :host)
+        affected_host.set_property(:hostname, host_url)
+        affected_host.save
+
+        logger.info { "Adding #{xml_issue.at('name').text} (#{issue_id})"}
+        logger.info { "\taffects: #{host_label}" }
+
+        create_issue(
+          affected_host: affected_host,
+          id: issue_id,
+          xml_issue: xml_issue
+        )
+      end
     end
   end
 end

data/spec/burp_upload_spec.rb

@@ -4,7 +4,7 @@ require 'ostruct'
 describe 'Burp upload plugin' do
 
   describe Burp::Xml::Issue do
-    it "handles invalid utf-8 bytes" do
+    it 'handles invalid utf-8 bytes' do
       doc = Nokogiri::XML(File.read('spec/fixtures/files/invalid-utf-issue.xml'))
       xml_issue = doc.xpath('issues/issue').first
       issue = Burp::Xml::Issue.new(xml_issue)
@@ -49,7 +49,7 @@ describe 'Burp upload plugin' do
       end
     end
 
-    it "creates nodes, issues, and evidence as needed" do
+    it 'creates nodes, issues, and evidence as needed' do
 
       # Host node
       #
@@ -112,6 +112,46 @@ describe 'Burp upload plugin' do
       @importer.import(file: 'spec/fixtures/files/burp.xml')
     end
 
+    it 'returns the highest <severity> at the Issue level' do
+
+      # create_issue should be called once for each issue in the xml
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:id]).to eq(8781630)
+        expect(args[:text]).to include("#[Title]#\nIssue 1")
+        expect(args[:text]).to include("#[Severity]#\nCritical")
+        OpenStruct.new(args)
+      end
+
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("#[Severity]#\nInformation")
+        expect(args[:issue].text).to include("#[Title]#\nIssue 1")
+        expect(args[:node].label).to eq('10.0.0.1')
+      end.once
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("#[Severity]#\nHigh")
+        expect(args[:issue].text).to include("#[Title]#\nIssue 1")
+        expect(args[:node].label).to eq('10.0.0.1')
+        OpenStruct.new(args)
+      end.once
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("#[Severity]#\nMedium")
+        expect(args[:issue].text).to include("#[Title]#\nIssue 1")
+        expect(args[:node].label).to eq('10.0.0.1')
+      end.once
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("#[Severity]#\nCritical")
+        expect(args[:issue].text).to include("#[Title]#\nIssue 1")
+        expect(args[:node].label).to eq('10.0.0.1')
+      end.once
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include("#[Severity]#\nLow")
+        expect(args[:issue].text).to include("#[Title]#\nIssue 1")
+        expect(args[:node].label).to eq('10.0.0.1')
+      end.once
+
+      # Run the import
+      @importer.import(file: 'spec/fixtures/files/burp_issue_severity.xml')
+    end
   end
 
   describe  Dradis::Plugins::Burp::Html::Importer do

data/spec/fixtures/files/burp_issue_severity.xml

@@ -0,0 +1,118 @@
+<?xml version="1.0"?>
+<!DOCTYPE issues [
+<!ELEMENT issues (issue*)>
+<!ATTLIST issues burpVersion CDATA "">
+<!ATTLIST issues exportTime CDATA "">
+<!ELEMENT issue (serialNumber, type, name, host, path, location, severity, confidence, issueBackground?, remediationBackground?, issueDetail?, remediationDetail?, requestresponse*)>
+<!ELEMENT serialNumber (#PCDATA)>
+<!ELEMENT type (#PCDATA)>
+<!ELEMENT name (#PCDATA)>
+<!ELEMENT host (#PCDATA)>
+<!ATTLIST host ip CDATA "">
+<!ELEMENT path (#PCDATA)>
+<!ELEMENT location (#PCDATA)>
+<!ELEMENT severity (#PCDATA)>
+<!ELEMENT confidence (#PCDATA)>
+<!ELEMENT issueBackground (#PCDATA)>
+<!ELEMENT remediationBackground (#PCDATA)>
+<!ELEMENT issueDetail (#PCDATA)>
+<!ELEMENT remediationDetail (#PCDATA)>
+<!ELEMENT requestresponse (request?, response?, responseRedirected?)>
+<!ELEMENT request (#PCDATA)>
+<!ATTLIST request base64 (true|false) "false">
+<!ELEMENT response (#PCDATA)>
+<!ATTLIST response base64 (true|false) "false">
+<!ELEMENT responseRedirected (#PCDATA)>
+]>
+<issues burpVersion="1.5.14" exportTime="Wed Nov 10 17:26:55 EDT 2014">
+  <issue>
+    <serialNumber>1833460934674078320</serialNumber>
+    <type>8781630</type>
+    <name>Issue 1</name>
+    <host ip="10.0.0.1">http://www.test.com</host>
+    <path><![CDATA[/Common/login.aspx]]></path>
+    <location><![CDATA[/Common/login.aspx]]></location>
+    <severity>Information</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Veniam fugiat possimus quaerat esse aspernatur cumque, fugit incidunt tempora nam ex atque, magni alias ullam illo voluptate sed consequatur reprehenderit qui.]]></issueBackground>
+    <remediationBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Explicabo itaque unde numquam, nihil eveniet deleniti dignissimos architecto quo neque ea impedit nam autem iusto iste, esse, aut minus animi repellat.]]></remediationBackground>
+    <issueDetail><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Corporis quisquam aut necessitatibus ex possimus suscipit ipsam ipsa repellendus quo nostrum! Dolores quibusdam modi impedit nihil necessitatibus dicta vitae dolorem sit!]]></issueDetail>
+    <requestresponse>
+      <request base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFByb3ZpZGVudCBpcHN1bSBjb25zZWN0ZXR1ciBxdWlkZW0gb2JjYWVjYXRpIG5hdHVzLCByZW0gYXQgcXVhcyBzaW50IHRlbXBvcmUgYXV0ZW0gdm9sdXB0YXRpYnVzLCB2ZW5pYW0gZnVnaWF0IGN1bXF1ZSBsYWJvcmlvc2FtIG5lY2Vzc2l0YXRpYnVzIG9tbmlzIHJlaWNpZW5kaXMgdW5kZSBtYWduYW0u]]></request>
+      <response base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFNhcGllbnRlIGZ1Z2lhdCBlYXJ1bSwgYW5pbWkgdmVybyBxdWlidXNkYW0gc2VkLCBkb2xvcnVtIGRpc3RpbmN0aW8gYWxpcXVhbSwgcmVpY2llbmRpcyBjb3Jwb3JpcyBuaWhpbCBleGNlcHR1cmkgY29uc2VjdGV0dXIgZGVsZW5pdGkgbW9sZXN0aWFzIGhhcnVtIGxhYm9yaW9zYW0gc3VudCBub3N0cnVtIG9kaW8u]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>1833460934674078321</serialNumber>
+    <type>8781631</type>
+    <name>Issue 2</name>
+    <host ip="10.0.0.1">http://www.test.com</host>
+    <path><![CDATA[/Common/login.aspx]]></path>
+    <location><![CDATA[/Common/login.aspx]]></location>
+    <severity>High</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Veniam fugiat possimus quaerat esse aspernatur cumque, fugit incidunt tempora nam ex atque, magni alias ullam illo voluptate sed consequatur reprehenderit qui.]]></issueBackground>
+    <remediationBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Explicabo itaque unde numquam, nihil eveniet deleniti dignissimos architecto quo neque ea impedit nam autem iusto iste, esse, aut minus animi repellat.]]></remediationBackground>
+    <issueDetail><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Corporis quisquam aut necessitatibus ex possimus suscipit ipsam ipsa repellendus quo nostrum! Dolores quibusdam modi impedit nihil necessitatibus dicta vitae dolorem sit!]]></issueDetail>
+    <requestresponse>
+      <request base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFByb3ZpZGVudCBpcHN1bSBjb25zZWN0ZXR1ciBxdWlkZW0gb2JjYWVjYXRpIG5hdHVzLCByZW0gYXQgcXVhcyBzaW50IHRlbXBvcmUgYXV0ZW0gdm9sdXB0YXRpYnVzLCB2ZW5pYW0gZnVnaWF0IGN1bXF1ZSBsYWJvcmlvc2FtIG5lY2Vzc2l0YXRpYnVzIG9tbmlzIHJlaWNpZW5kaXMgdW5kZSBtYWduYW0u]]></request>
+      <response base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFNhcGllbnRlIGZ1Z2lhdCBlYXJ1bSwgYW5pbWkgdmVybyBxdWlidXNkYW0gc2VkLCBkb2xvcnVtIGRpc3RpbmN0aW8gYWxpcXVhbSwgcmVpY2llbmRpcyBjb3Jwb3JpcyBuaWhpbCBleGNlcHR1cmkgY29uc2VjdGV0dXIgZGVsZW5pdGkgbW9sZXN0aWFzIGhhcnVtIGxhYm9yaW9zYW0gc3VudCBub3N0cnVtIG9kaW8u]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>1833460934674078322</serialNumber>
+    <type>134217728</type>
+    <name>Issue 3</name>
+    <host ip="10.0.0.1">http://www.test.com</host>
+    <path><![CDATA[/Common/login.aspx]]></path>
+    <location><![CDATA[/Common/login.aspx]]></location>
+    <severity>Medium</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Veniam fugiat possimus quaerat esse aspernatur cumque, fugit incidunt tempora nam ex atque, magni alias ullam illo voluptate sed consequatur reprehenderit qui.]]></issueBackground>
+    <remediationBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Explicabo itaque unde numquam, nihil eveniet deleniti dignissimos architecto quo neque ea impedit nam autem iusto iste, esse, aut minus animi repellat.]]></remediationBackground>
+    <issueDetail><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Corporis quisquam aut necessitatibus ex possimus suscipit ipsam ipsa repellendus quo nostrum! Dolores quibusdam modi impedit nihil necessitatibus dicta vitae dolorem sit!]]></issueDetail>
+    <requestresponse>
+      <request base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFByb3ZpZGVudCBpcHN1bSBjb25zZWN0ZXR1ciBxdWlkZW0gb2JjYWVjYXRpIG5hdHVzLCByZW0gYXQgcXVhcyBzaW50IHRlbXBvcmUgYXV0ZW0gdm9sdXB0YXRpYnVzLCB2ZW5pYW0gZnVnaWF0IGN1bXF1ZSBsYWJvcmlvc2FtIG5lY2Vzc2l0YXRpYnVzIG9tbmlzIHJlaWNpZW5kaXMgdW5kZSBtYWduYW0u]]></request>
+      <response base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFNhcGllbnRlIGZ1Z2lhdCBlYXJ1bSwgYW5pbWkgdmVybyBxdWlidXNkYW0gc2VkLCBkb2xvcnVtIGRpc3RpbmN0aW8gYWxpcXVhbSwgcmVpY2llbmRpcyBjb3Jwb3JpcyBuaWhpbCBleGNlcHR1cmkgY29uc2VjdGV0dXIgZGVsZW5pdGkgbW9sZXN0aWFzIGhhcnVtIGxhYm9yaW9zYW0gc3VudCBub3N0cnVtIG9kaW8u]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>1833460934674078323</serialNumber>
+    <type>8781632</type>
+    <name>Issue 4</name>
+    <host ip="10.0.0.1">http://www.test.com</host>
+    <path><![CDATA[/Common/login.aspx]]></path>
+    <location><![CDATA[/Common/login.aspx]]></location>
+    <severity>High</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Veniam fugiat possimus quaerat esse aspernatur cumque, fugit incidunt tempora nam ex atque, magni alias ullam illo voluptate sed consequatur reprehenderit qui.]]></issueBackground>
+    <remediationBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Explicabo itaque unde numquam, nihil eveniet deleniti dignissimos architecto quo neque ea impedit nam autem iusto iste, esse, aut minus animi repellat.]]></remediationBackground>
+    <issueDetail><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Corporis quisquam aut necessitatibus ex possimus suscipit ipsam ipsa repellendus quo nostrum! Dolores quibusdam modi impedit nihil necessitatibus dicta vitae dolorem sit!]]></issueDetail>
+    <requestresponse>
+      <request base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFByb3ZpZGVudCBpcHN1bSBjb25zZWN0ZXR1ciBxdWlkZW0gb2JjYWVjYXRpIG5hdHVzLCByZW0gYXQgcXVhcyBzaW50IHRlbXBvcmUgYXV0ZW0gdm9sdXB0YXRpYnVzLCB2ZW5pYW0gZnVnaWF0IGN1bXF1ZSBsYWJvcmlvc2FtIG5lY2Vzc2l0YXRpYnVzIG9tbmlzIHJlaWNpZW5kaXMgdW5kZSBtYWduYW0u]]></request>
+      <response base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFNhcGllbnRlIGZ1Z2lhdCBlYXJ1bSwgYW5pbWkgdmVybyBxdWlidXNkYW0gc2VkLCBkb2xvcnVtIGRpc3RpbmN0aW8gYWxpcXVhbSwgcmVpY2llbmRpcyBjb3Jwb3JpcyBuaWhpbCBleGNlcHR1cmkgY29uc2VjdGV0dXIgZGVsZW5pdGkgbW9sZXN0aWFzIGhhcnVtIGxhYm9yaW9zYW0gc3VudCBub3N0cnVtIG9kaW8u]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+  <issue>
+    <serialNumber>1833460934674078323</serialNumber>
+    <type>8781633</type>
+    <name>Issue 5</name>
+    <host ip="10.0.0.1">http://www.test.com</host>
+    <path><![CDATA[/Common/login.aspx]]></path>
+    <location><![CDATA[/Common/login.aspx]]></location>
+    <severity>Low</severity>
+    <confidence>Firm</confidence>
+    <issueBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Veniam fugiat possimus quaerat esse aspernatur cumque, fugit incidunt tempora nam ex atque, magni alias ullam illo voluptate sed consequatur reprehenderit qui.]]></issueBackground>
+    <remediationBackground><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Explicabo itaque unde numquam, nihil eveniet deleniti dignissimos architecto quo neque ea impedit nam autem iusto iste, esse, aut minus animi repellat.]]></remediationBackground>
+    <issueDetail><![CDATA[Lorem ipsum dolor sit amet, consectetur adipisicing elit. Corporis quisquam aut necessitatibus ex possimus suscipit ipsam ipsa repellendus quo nostrum! Dolores quibusdam modi impedit nihil necessitatibus dicta vitae dolorem sit!]]></issueDetail>
+    <requestresponse>
+      <request base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFByb3ZpZGVudCBpcHN1bSBjb25zZWN0ZXR1ciBxdWlkZW0gb2JjYWVjYXRpIG5hdHVzLCByZW0gYXQgcXVhcyBzaW50IHRlbXBvcmUgYXV0ZW0gdm9sdXB0YXRpYnVzLCB2ZW5pYW0gZnVnaWF0IGN1bXF1ZSBsYWJvcmlvc2FtIG5lY2Vzc2l0YXRpYnVzIG9tbmlzIHJlaWNpZW5kaXMgdW5kZSBtYWduYW0u]]></request>
+      <response base64="true"><![CDATA[TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2ljaW5nIGVsaXQuIFNhcGllbnRlIGZ1Z2lhdCBlYXJ1bSwgYW5pbWkgdmVybyBxdWlidXNkYW0gc2VkLCBkb2xvcnVtIGRpc3RpbmN0aW8gYWxpcXVhbSwgcmVpY2llbmRpcyBjb3Jwb3JpcyBuaWhpbCBleGNlcHR1cmkgY29uc2VjdGV0dXIgZGVsZW5pdGkgbW9sZXN0aWFzIGhhcnVtIGxhYm9yaW9zYW0gc3VudCBub3N0cnVtIG9kaW8u]]></response>
+      <responseRedirected>false</responseRedirected>
+    </requestresponse>
+  </issue>
+</issues>

data/templates/issue.fields

@@ -1,7 +1,8 @@
-issue.name
 issue.background
-issue.remediation_background
 issue.detail
-issue.remediation_detail
+issue.name
 issue.references
+issue.remediation_background
+issue.remediation_detail
+issue.severity
 issue.vulnerability_classifications

data/templates/issue.template

@@ -2,6 +2,10 @@
 %issue.name%
 
 
+#[Severity]#
+%issue.severity%
+
+
 #[Background]#
 %issue.background%
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-burp
 version: !ruby/object:Gem::Version
-  version: 3.13.0
+  version: 3.18.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-10 00:00:00.000000000 Z
+date: 2020-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -102,6 +102,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/issue_template.md"
+- ".github/pull_request_template.md"
 - ".gitignore"
 - ".rspec"
 - CHANGELOG.md
@@ -126,6 +128,7 @@ files:
 - spec/burp_upload_spec.rb
 - spec/fixtures/files/burp.html
 - spec/fixtures/files/burp.xml
+- spec/fixtures/files/burp_issue_severity.xml
 - spec/fixtures/files/invalid-utf-issue.xml
 - spec/fixtures/files/without-base64.xml
 - spec/spec_helper.rb
@@ -157,8 +160,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.12
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Burp Scanner upload plugin for the Dradis Framework.
@@ -166,6 +168,7 @@ test_files:
 - spec/burp_upload_spec.rb
 - spec/fixtures/files/burp.html
 - spec/fixtures/files/burp.xml
+- spec/fixtures/files/burp_issue_severity.xml
 - spec/fixtures/files/invalid-utf-issue.xml
 - spec/fixtures/files/without-base64.xml
 - spec/spec_helper.rb