dradis-csv 5.2.0 → 5.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bad2356d2ad2625aa0180faf0ab79f8a8acf40ce59afcdcd7843e1df6eaf358
-  data.tar.gz: 00bf582bd667765e48311382f06b4f10587cfbe59424802dca5c96a1b9237b8d
+  metadata.gz: 9fc992eccc61f6f4f2b7a0d2696dbda946add4cb50a38cb92cc435dea0dc1038
+  data.tar.gz: 993fdee3bc19179b7f42801f6e0a078fa6e26d0e8eec09ae60a4e89006627e09
 SHA512:
-  metadata.gz: 768891ef2bdf14268a94b4607300f8aca8ded2020335b51077efc74d0e5dad2aa36709968a2f7e09119519599c57e34610f4b4034ee0fa69a9462ad547fe9fab
-  data.tar.gz: 0021f7ee9aa94f498a2c469b4c11f3da43b85476c7bf4018e3970fa2252f93a6d02c5bc60163c81baaf802da67d39b3f3ed6bac69556587e834d19c326bfcd4e
+  metadata.gz: 7f3322fbe5e012b8bbe5eaab98450f71c3273461398f5e1d5e814c626152037216288fafe53614305789dd8a415c5ac5071bc6ed1b0ae01ee8268bd0f71964c1
+  data.tar.gz: be698324c4a89f500d9da324016e149b8d9d09842f5af2ae26a922130eb2fa21aab85d9b4baa6d76f3b3254d7ba28acb343d56a576d07dac3dc73492a87acf45

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+v5.3.0 (August 2026)
+  - Add support for managing Mappings through the Mappings Manager
+  - Add support for saving column assignments from the upload mapper
+
 v5.2.0 (June 2026)
   - No changes
 

data/app/assets/javascripts/dradis/plugins/csv/upload.js

@@ -14,6 +14,11 @@ window.addEventListener('job-done', function () {
       Turbo.visit(redirectPath);
     }
   }
+
+  if ($('body.dradis-plugins-csv-upload.new').length) {
+    $('[data-behavior~=mapping-form] input[type="submit"]')
+      .val('Done!');
+  }
 });
 
 document.addEventListener('turbo:load', function() {
@@ -60,6 +65,16 @@ document.addEventListener('turbo:load', function() {
       _setDradisFieldSelect($(this));
     });
 
+    $('[data-behavior~=dradis-field-select]').on('change', function () {
+      console.log('change!');
+      _toggleCustomFieldInput($(this));
+    });
+
+    $('[data-behavior~=dradis-field-select]').not(':disabled').each(function () {
+      console.log('initializing!');
+      _toggleCustomFieldInput($(this));
+    });
+
     $('[data-behavior~=mapping-form]').submit(function () {
       var valid = _validateIdentifierSelected() && _validateNodeSelected();
 
@@ -87,13 +102,21 @@ document.addEventListener('turbo:load', function() {
         .attr('disabled', 'disabled')
         .addClass('d-none');
 
+      $row
+        .find('[data-behavior~=custom-destination-input]')
+        .prop('disabled', true)
+        .addClass('d-none')
+        .attr('required', false);
+
+      var $activeSelect;
+
       if ($select.val() == 'issue') {
-        $row
+        $activeSelect = $row
           .find('[data-behavior~=issue-field-select]')
           .removeAttr('disabled')
           .removeClass('d-none');
       } else if ($select.val() == 'evidence') {
-        $row
+        $activeSelect = $row
           .find('[data-behavior~=evidence-field-select]')
           .removeAttr('disabled')
           .removeClass('d-none');
@@ -103,6 +126,27 @@ document.addEventListener('turbo:load', function() {
           .attr('disabled', 'disabled')
           .removeClass('d-none');
       }
+
+      if ($activeSelect) {
+        _toggleCustomFieldInput($activeSelect);
+      }
+    }
+
+    function _toggleCustomFieldInput($select) {
+      var $customInput = $select.next('[data-behavior~=custom-destination-input]');
+
+      if (!$customInput.length) {
+        return;
+      }
+
+      var isCustom = $select
+        .find('option:selected')
+        .is('[data-behavior~=custom-destination-field]');
+
+      $customInput
+        .toggleClass('d-none', !isCustom)
+        .prop('disabled', !isCustom)
+        .attr('required', isCustom);
     }
 
     function _validateNodeSelected() {

data/app/controllers/dradis/plugins/csv/upload_controller.rb

@@ -3,21 +3,31 @@ module Dradis::Plugins::CSV
     include ProjectScoped
 
     before_action :load_attachment, only: [:new, :create]
-    before_action :load_rtp_fields, only: [:new]
+    before_action :load_rtp_fields, only: [:new, :create]
     before_action :load_csv_headers, only: [:new]
 
+    # Reached after the standard upload flow has already run the file
+    # through Importer#import. If a saved mapping matched, that import
+    # already happened (see importer.rb) and there's nothing left to map.
     def new
-      @default_columns = ['Column Header', 'Entity', 'Dradis Field']
+      if saved_mapping?
+        return redirect_to main_app.project_issues_path(current_project),
+          notice: 'CSV imported using its saved mapping.'
+      end
 
+      @default_columns = ['Column Header', 'Entity', 'Dradis Field']
       @log_uid = Log.new.uid
     end
 
     def create
+      save_mapping
+
       job_logger.write 'Enqueueing job to start in the background.'
 
       MappingImportJob.perform_later(
         default_user_id: current_user.id,
         file: @attachment.fullpath.to_s,
+        headers: csv_headers,
         mappings: mappings_params[:field_attributes].to_h,
         project_id: current_project.id,
         state: state,
@@ -31,6 +41,10 @@ module Dradis::Plugins::CSV
       @job_logger ||= Log.new(uid: params[:log_uid].to_i)
     end
 
+    def csv_headers
+      @csv_headers ||= ::CSV.open(@attachment.fullpath, &:readline)
+    end
+
     def load_attachment
       filename = CGI::escape params[:attachment]
       @attachment = Attachment.find(filename, conditions: { node_id: current_project.plugin_uploads_node.id })
@@ -62,7 +76,29 @@ module Dradis::Plugins::CSV
     end
 
     def mappings_params
-      params.require(:mappings).permit(field_attributes: [:field, :type])
+      params.require(:mappings).permit(field_attributes: [:field, :type, :custom_field])
+    end
+
+    def rtp_destination
+      rtp = current_project.report_template_properties
+      rtp && rtp.as_mapping_destination
+    end
+
+    # Persist the submitted column assignments so future uploads of this CSV
+    # format can reuse them. Mappings are scoped to a report template, so
+    # projects without one keep the upload-time mapper only.
+    def save_mapping
+      return unless rtp_destination
+
+      MappingForm.new(
+        destination: rtp_destination,
+        headers: csv_headers,
+        rtp_fields: @rtp_fields
+      ).save(column_mappings: mappings_params[:field_attributes].to_h)
+    end
+
+    def saved_mapping?
+      rtp_destination && Dradis::Plugins::CSV.mapping_exists?(headers: @headers, destination: rtp_destination)
     end
 
     def state

data/app/jobs/dradis/plugins/csv/mapping_import_job.rb

@@ -13,7 +13,7 @@ module Dradis::Plugins::CSV
     #   '2' => { 'type' => 'identifier' },
     #   '3' => { 'type' => 'evidence', 'field' => 'Port' }
     # }
-    def perform(default_user_id:, file:, mappings:, project_id:, state:, uid:)
+    def perform(default_user_id:, file:, headers:, mappings:, project_id:, state:, uid:)
       logger = Log.new(uid: uid)
       logger.write { "Job id is #{job_id}." }
 
@@ -25,7 +25,8 @@ module Dradis::Plugins::CSV
         state: state
       )
 
-      importer.import_csv(file: file, mappings: mappings)
+      logger.write { 'Worker process starting background task.' }
+      importer.import_rows(file: file, headers: headers, mappings: mappings)
 
       logger.write { 'Worker process completed.' }
     end

data/app/views/dradis/plugins/csv/upload/new.html.erb

@@ -20,6 +20,12 @@
     <div class="alert alert-danger d-none" data-behavior="node-type-validation-message">
       <p>A Node Label must be selected to import evidence records.</p>
     </div>
+
+    <% if @rtp_fields && (@rtp_fields[:issue].present? || @rtp_fields[:evidence].present?) %>
+      <div class="alert alert-info">
+        <p class="m-0">This mapping will be saved and applied automatically the next time you upload a CSV file with these same column headers.</p>
+      </div>
+    <% end %>
   </div>
 
   <%= form_with url: project_upload_index_path(current_project, format: :js), method: :post, local: false, data: { behavior: 'mapping-form' } do |f| %>
@@ -37,6 +43,7 @@
         </tr>
       </thead>
       <tbody>
+        <% custom_field_option = ['Custom Field', 'Custom Field', { data: { behavior: 'custom-destination-field' } }] %>
         <% @headers.each_with_index do |header, index| %>
           <tr class="issue-type">
             <td><%= header %></td>
@@ -48,11 +55,13 @@
             <td>
               <% if @rtp_fields %>
                 <div>
-                  <% issue_options = @rtp_fields[:issue].any? ? options_for_select(@rtp_fields[:issue]) : options_for_select([[header, header]], disabled: header, selected: header) %>
+                  <% issue_options = @rtp_fields[:issue].any? ? options_for_select(@rtp_fields[:issue] + [custom_field_option]) : options_for_select([[header, header]], disabled: header, selected: header) %>
                   <%= f.select "mappings[field_attributes][#{index}][field]", issue_options, {}, class: 'form-select w-75 field-select', data: { behavior: 'dradis-field-select issue-field-select', header: header, 'combobox-config': 'no-combobox' } %>
+                  <%= f.text_field "mappings[field_attributes][#{index}][custom_field]", disabled: true, class: 'form-control w-75 mt-1 custom-field-input d-none', style: 'min-width: 0;', placeholder: 'Enter field name', data: { behavior: 'custom-destination-input' } %>
 
-                  <% evidence_options = @rtp_fields[:evidence].any? ? options_for_select(@rtp_fields[:evidence]) : options_for_select([[header, header]], disabled: header, selected: header) %>
+                  <% evidence_options = @rtp_fields[:evidence].any? ? options_for_select(@rtp_fields[:evidence] + [custom_field_option]) : options_for_select([[header, header]], disabled: header, selected: header) %>
                   <%= f.select "mappings[field_attributes][#{index}][field]", evidence_options, {}, disabled: true, class: 'form-select w-75 field-select d-none', data: { behavior: 'dradis-field-select evidence-field-select', header: header, 'combobox-config': 'no-combobox' } %>
+                  <%= f.text_field "mappings[field_attributes][#{index}][custom_field]", disabled: true, class: 'form-control w-75 mt-1 custom-field-input d-none', style: 'min-width: 0;', placeholder: 'Enter field name', data: { behavior: 'custom-destination-input' } %>
 
                   <%= f.select "mappings[field_attributes][#{index}][field]", [['N/A', '']], {}, disabled: true, class: 'form-select w-75 field-select d-none', data: { behavior: 'dradis-field-select empty-field-select', header: header, 'combobox-config': 'no-combobox' } %>
                 </div>

data/lib/dradis/plugins/csv/field_processor.rb

@@ -0,0 +1,10 @@
+module Dradis::Plugins::CSV
+  class FieldProcessor < Dradis::Plugins::Upload::FieldProcessor
+    # data is a Hash of the current row, keyed by normalized header (see
+    # Importer#normalized_row), matching how MappingForm normalizes
+    # headers when it stores each field's source_field/content.
+    def value(args = {})
+      data[args[:field]]
+    end
+  end
+end

data/lib/dradis/plugins/csv/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 5
-        MINOR = 2
+        MINOR = 3
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/csv/importer.rb

@@ -1,29 +1,54 @@
 module Dradis::Plugins::CSV
   class Importer < Dradis::Plugins::Upload::Importer
+    # Sources are dynamic (one per mapped CSV format), so report the
+    # currently known sources grouped by entity for the Mappings Manager.
     def self.templates
-      {}
+      sources = Dradis::Plugins::CSV.mapping_sources.map(&:to_s)
+
+      {
+        evidence: sources.grep(/\Aevidence_/),
+        issue: sources.grep(/\Aissue_/)
+      }
     end
 
-    def import(params={})
-      logger.info { 'Uploading CSV file...' }
+    # Runs as part of the standard upload flow, before the user would reach
+    # the column mapper. If this project already has a saved mapping for the
+    # file's headers, import immediately using it, so a recognized format
+    # never needs re-mapping and gets the same treatment (Rules Engine
+    # included) as any other plugin's upload. Unrecognized formats no-op
+    # here; UploadController sends the user to the mapper instead.
+    def import(params = {})
+      return false if mapping_service.destination.blank?
+
+      headers = CSV.open(params[:file], &:readline)
 
-      logger.info { 'Done' }
+      unless Dradis::Plugins::CSV.mapping_exists?(headers: headers, destination: mapping_service.destination)
+        logger.info { 'No saved mapping found for this CSV format.' }
+        return false
+      end
+
+      import_rows(file: params[:file], headers: headers)
     end
 
-    def import_csv(params)
-      logger.info { 'Worker process starting background task.' }
+    # Entry point for both the column mapper form submission (see
+    # MappingImportJob) and the auto-recognized import above. mappings is the
+    # raw form submission and is only consulted as a fallback, for whichever
+    # of identifier/node/entity fields has no saved Mapping to read from
+    # instead (e.g. no RTP is set, so MappingForm never persisted one).
+    def import_rows(file:, headers:, mappings: nil)
+      filename = File.basename(file)
+      @issue_lookup = {}
 
-      mappings_groups = params[:mappings].group_by { |index, mapping| mapping['type'] }
+      @issue_source, @issue_fields, id_index = mapped_fields(entity: :issue, headers: headers)
+      @evidence_source, @evidence_fields, node_index = mapped_fields(entity: :evidence, headers: headers)
 
-      filename = File.basename(params[:file])
-      id_index = Integer(mappings_groups['identifier']&.first&.first, exception: false)
+      mappings_groups = (mappings || {}).group_by { |index, mapping| mapping['type'] }
+      id_index ||= Integer(mappings_groups['identifier']&.first&.first, exception: false)
+      @node_index = node_index || Integer(mappings_groups['node']&.first&.first, exception: false)
       @evidence_mappings = mappings_groups['evidence'] || []
-      @issue_lookup = {}
       @issue_mappings = mappings_groups['issue'] || []
-      @node_index = Integer(mappings_groups['node']&.first&.first, exception: false)
-
 
-      CSV.foreach(params[:file], headers: true).with_index do |row, index|
+      CSV.foreach(file, headers: true).with_index do |row, index|
         csv_id = row[id_index] || "#{filename}-#{index}"
         process_issue(csv_id: csv_id, row: row)
         process_node(csv_id: csv_id, row: row)
@@ -34,9 +59,39 @@ module Dradis::Plugins::CSV
 
     private
 
-    attr_accessor :evidence_mappings, :issue_lookup, :issue_mappings, :node_index
+    attr_accessor :evidence_fields, :evidence_mappings, :evidence_source,
+      :issue_fields, :issue_lookup, :issue_mappings, :issue_source, :node_index
+
+    # The saved Mapping's fields (with their content templates) for this
+    # entity, excluding the reserved identifier/node field (that drives
+    # csv_id/node_label directly in import_rows, not entity content) but
+    # returning its column index instead, so import_rows can read it
+    # straight off the Mapping rather than the column mapper form. Returns
+    # all nils when there's no RTP or no saved mapping, so build_text falls
+    # back to reading the CSV directly instead of applying a template, and
+    # import_rows falls back to the form for the reserved index too.
+    def mapped_fields(entity:, headers:)
+      return [nil, nil, nil] unless mapping_service.destination.present?
+
+      source = Dradis::Plugins::CSV.mapping_source(headers: headers, entity: entity)
+      mapping = Dradis::Plugins::CSV.get_mapping(source: source, destination: mapping_service.destination)
+
+      return [nil, nil, nil] unless mapping
+
+      reserved_field = entity == :issue ? Mapping::IDENTIFIER_FIELD : Mapping::NODE_LABEL_FIELD
+      reserved, fields = mapping.mapping_fields.partition { |field| field.destination_field == reserved_field }
+      reserved = reserved.first
+
+      reserved_index = reserved && headers.index do |header|
+        Dradis::Plugins::CSV.normalize_header(header) == reserved.source_field
+      end
+
+      [source, fields, reserved_index]
+    end
+
+    def build_text(mappings:, source:, fields:, row:)
+      return apply_template(source: source, fields: fields, row: row) if fields
 
-    def build_text(mappings:, row:)
       mappings.map do |index, mapping|
         next if project.report_template_properties && mapping['field'].blank?
 
@@ -46,17 +101,23 @@ module Dradis::Plugins::CSV
       end.compact.join("\n\n")
     end
 
+    def apply_template(source:, fields:, row:)
+      data = row.to_h.transform_keys { |header| Dradis::Plugins::CSV.normalize_header(header) }
+
+      mapping_service.apply_mapping(source: source, data: data, mapping_fields: fields)
+    end
+
     def process_evidence(csv_id:, node:, row:)
       logger.info{ "\t\t => Creating evidence: (node: #{node.label}, plugin_id: #{csv_id})" }
 
       issue = issue_lookup[csv_id]
-      evidence_content = build_text(mappings: @evidence_mappings, row: row)
+      evidence_content = build_text(mappings: evidence_mappings, source: evidence_source, fields: evidence_fields, row: row)
       content_service.create_evidence(issue: issue, node: node, content: evidence_content)
     end
 
     def process_issue(csv_id:, row:)
       logger.info { "\t => Creating new issue (plugin_id: #{csv_id})" }
-      issue_text = build_text(mappings: issue_mappings, row: row)
+      issue_text = build_text(mappings: issue_mappings, source: issue_source, fields: issue_fields, row: row)
       issue = content_service.create_issue(text: issue_text, id: csv_id)
 
       issue_lookup[csv_id] = issue

data/lib/dradis/plugins/csv/mapping.rb

@@ -0,0 +1,77 @@
+module Dradis::Plugins::CSV
+  # Unlike other integrations, CSV files don't have a fixed structure, so the
+  # list of sources can't be defined upfront. Instead, a new source is
+  # registered every time a user maps a new CSV format (i.e. a new set of
+  # column headers) through the column mapper (see MappingForm). The class
+  # methods below give Dradis::Plugins::Mappings::Base's default,
+  # constant-backed implementations (mapping_sources, source_fields,
+  # default_mapping) database-backed overrides instead, so there's no
+  # DEFAULT_MAPPING/SOURCE_FIELDS constant here for them to fall back to.
+  module Mapping
+    # Reserved destination fields that carry row metadata instead of entity
+    # content. They're stored alongside the content fields but are excluded
+    # from the entity text during import.
+    IDENTIFIER_FIELD = 'plugin_id'.freeze
+    NODE_LABEL_FIELD = 'node_label'.freeze
+  end
+
+  def self.default_mapping(_source)
+    {}
+  end
+
+  # Excludes the reserved identifier/node fields from the destination field
+  # list: they carry row metadata, not entity content (see Importer#mapped_fields,
+  # which excludes them the same way when building the import template).
+  def self.field_names(source:, destination: nil, field_type: 'destination')
+    super.reject do |field|
+      field_type == 'destination' &&
+        [Mapping::IDENTIFIER_FIELD, Mapping::NODE_LABEL_FIELD].include?(field)
+    end
+  end
+
+  # Whether a format matching these headers has already been mapped for this
+  # destination, i.e. whether either its issue or evidence Mapping (or both)
+  # was saved. Shared by Importer#import (to recognize a format on upload)
+  # and UploadController (to skip the mapper for a recognized format).
+  def self.mapping_exists?(headers:, destination:)
+    sources = %i[issue evidence].map { |entity| mapping_source(headers: headers, entity: entity) }
+
+    ::Mapping.exists?(component: component, source: sources, destination: destination)
+  end
+
+  def self.mapping_sources
+    ::Mapping.where(component: component).distinct.pluck(:source).map(&:to_sym)
+  end
+
+  # The source name for a CSV format: the entity (issue/evidence) the mapping
+  # populates, plus its normalized headers joined with '/', so the Mappings
+  # Manager shows something recognizable (e.g. issue_severity/title) instead
+  # of an opaque digest. Headers are sorted so reordering columns doesn't
+  # produce a new source; any '/' inside a header name is replaced so it
+  # can't be mistaken for the join separator. The entity prefix also lets
+  # Importer.templates group sources by entity with a simple regex.
+  def self.mapping_source(headers:, entity:)
+    normalized = headers.map { |header| normalize_header(header).gsub('/', '-') }.sort
+
+    "#{entity}_#{normalized.join('/')}"
+  end
+
+  def self.normalize_header(header)
+    header.to_s.delete(" \t\r\n")
+  end
+
+  # We're building a dynamic source here since we can't rely on a fixed set of
+  # sources unlike the other integrations.
+  def self.sample(source)
+    source_fields(source).index_with { |field| field }.to_json
+  end
+
+  def self.source_fields(source)
+    ::MappingField.
+      joins(:mapping).
+      where(mappings: { component: component, source: source.to_s }).
+      where.not(source_field: 'Custom Text').
+      distinct.
+      pluck(:source_field)
+  end
+end

data/lib/dradis/plugins/csv/mapping_form.rb

@@ -0,0 +1,99 @@
+module Dradis::Plugins::CSV
+  # Converts the column mapper's form structure into persisted Mapping
+  # records, one per entity (issue/evidence), so a CSV format only needs to
+  # be mapped once: #save is the forward direction (form -> records), run
+  # the first time a format is mapped. Later uploads of a recognized format
+  # read straight from those records instead (see Importer#mapped_fields),
+  # rather than reconstructing the form.
+  class MappingForm
+    # Mapper column types that produce fields for each entity: identifier
+    # columns are stored with the issue mapping, node columns with evidence.
+    ENTITY_TYPES = {
+      issue: %w[issue identifier],
+      evidence: %w[evidence node]
+    }.freeze
+
+    attr_reader :column_mappings, :destination, :headers, :rtp_fields
+
+    # rtp_fields is { issue: [...field names...], evidence: [...] }: the
+    # destination fields actually defined on the RTP, used to gate #save (see
+    # below).
+    def initialize(destination:, headers:, rtp_fields:)
+      @destination = destination
+      @headers = headers
+      @rtp_fields = rtp_fields
+    end
+
+    # Persists one Mapping per entity that has assigned columns, so a
+    # newly-mapped CSV format is recognized automatically on future uploads
+    # (see Importer#import). Only ever called for formats with no existing
+    # mapping: Importer#import and UploadController#new short-circuit before
+    # the mapper is reached once a format already has a saved mapping.
+    #
+    # column_mappings is the mapper form submission, keyed by column index:
+    #   {
+    #     '0' => { 'type' => 'node' },
+    #     '1' => { 'type' => 'issue', 'field' => 'Title' },
+    #     '2' => { 'type' => 'identifier' },
+    #     '3' => { 'type' => 'evidence', 'field' => 'Port' }
+    #   }
+    #
+    # An entity with no RTP fields defined has nowhere valid to point a
+    # mapping, so it's skipped entirely (including its identifier/node
+    # column, if any) rather than saving a mapping with a bogus destination.
+    def save(column_mappings:)
+      @column_mappings = column_mappings
+
+      return if destination.blank?
+
+      ::Mapping.transaction do
+        ENTITY_TYPES.keys.each do |entity|
+          next if rtp_fields[entity].blank?
+
+          fields = fields_for(entity)
+          next if fields.empty?
+
+          source = Dradis::Plugins::CSV.mapping_source(headers: headers, entity: entity)
+          mapping = ::Mapping.create!(component: component, source: source, destination: destination)
+          mapping.mapping_fields.create!(fields)
+        end
+      end
+    end
+
+    private
+
+    def component
+      Dradis::Plugins::CSV.component
+    end
+
+    def fields_for(entity)
+      types = ENTITY_TYPES.fetch(entity)
+
+      column_mappings.filter_map do |index, assignment|
+        next unless types.include?(assignment['type'])
+
+        header = Dradis::Plugins::CSV.normalize_header(headers[index.to_i])
+        next if header.blank?
+
+        destination_field =
+          case assignment['type']
+          when 'identifier'
+            Mapping::IDENTIFIER_FIELD
+          when 'node'
+            Mapping::NODE_LABEL_FIELD
+          else
+            field = assignment['field'] == 'Custom Field' ? assignment['custom_field'] : assignment['field']
+            next if field.blank?
+
+            field
+          end
+
+        {
+          source_field: header,
+          content: "{{ csv[#{header}] }}",
+          destination_field: destination_field
+        }
+      end
+    end
+  end
+end

data/lib/dradis/plugins/csv.rb

@@ -7,5 +7,8 @@ module Dradis
 end
 
 require 'dradis/plugins/csv/engine'
+require 'dradis/plugins/csv/field_processor'
 require 'dradis/plugins/csv/importer'
+require 'dradis/plugins/csv/mapping'
+require 'dradis/plugins/csv/mapping_form'
 require 'dradis/plugins/csv/version'

data/spec/features/upload_spec.rb

@@ -129,6 +129,8 @@ describe 'upload feature', js: true do
 
             evidence = node.evidence.first
             expect(evidence.fields).to eq({ 'Label' => '10.0.0.1', 'Title' => 'SQL Injection', 'Location' => '10.0.0.1', 'Port' => '443' })
+
+            expect(Mapping.where(component: 'csv')).to be_empty
           end
         end
       end
@@ -235,6 +237,11 @@ describe 'upload feature', js: true do
 
               evidence = node.evidence.first
               expect(evidence.fields).to eq({ 'Label' => '10.0.0.1', 'Location' => '10.0.0.1', 'Title' => 'SQL Injection', 'Port' => '443' })
+
+              headers = CSV.open(file_path, &:readline)
+              issue_source = Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :issue)
+              evidence_source = Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :evidence)
+              expect(Mapping.where(component: 'csv').pluck(:source)).to match_array([issue_source, evidence_source])
             end
           end
         end
@@ -282,6 +289,65 @@ describe 'upload feature', js: true do
     end
   end
 
+  context 'uploading a CSV file with a saved mapping' do
+    let(:file_path) { File.expand_path('../fixtures/files/simple.csv', __dir__) }
+
+    before do
+      rtp = create(
+        :report_template_properties,
+        evidence_fields: [{ name: 'Location', type: :string, default: true }],
+        issue_fields: [{ name: 'Title', type: :string, default: true }]
+      )
+      @project.update(report_template_properties: rtp)
+
+      headers = CSV.open(file_path, &:readline)
+      issue_mapping = Mapping.create!(
+        component: 'csv',
+        source: Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :issue),
+        destination: rtp.as_mapping_destination
+      )
+      issue_mapping.mapping_fields.create!(
+        source_field: 'Id', destination_field: 'plugin_id', content: '{{ csv[Id] }}'
+      )
+      issue_mapping.mapping_fields.create!(
+        source_field: 'Title', destination_field: 'Title', content: '{{ csv[Title] }}'
+      )
+
+      evidence_mapping = Mapping.create!(
+        component: 'csv',
+        source: Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :evidence),
+        destination: rtp.as_mapping_destination
+      )
+      evidence_mapping.mapping_fields.create!(
+        source_field: 'Host', destination_field: 'node_label', content: '{{ csv[Host] }}'
+      )
+      evidence_mapping.mapping_fields.create!(
+        source_field: 'Location', destination_field: 'Location', content: '{{ csv[Location] }}'
+      )
+
+      page.refresh
+
+      find('#uploader + .combobox').click
+      find('#uploader ~ .combobox-menu .combobox-option', text: 'Dradis::Plugins::CSV').click
+    end
+
+    it 'imports immediately using the saved mapping, without showing the mapper' do
+      attach_file 'file', file_path, visible: false, disabled: false
+
+      expect(page).to have_text('CSV imported using its saved mapping', wait: 30)
+      expect(current_path).to eq(main_app.project_upload_manager_path(@project))
+
+      issue = Issue.last
+      expect(issue.fields).to include('Title' => 'SQL Injection', 'plugin' => 'csv', 'plugin_id' => '1')
+
+      node = issue.affected.first
+      expect(node.label).to eq('10.0.0.1')
+
+      evidence = node.evidence.first
+      expect(evidence.fields).to include('Location' => '10.0.0.1')
+    end
+  end
+
   describe 'CSV file samples' do
     before do
       find('#uploader + .combobox').click

data/spec/jobs/dradis/plugins/csv/mapping_import_job_spec.rb

@@ -7,17 +7,19 @@ RSpec.describe Dradis::Plugins::CSV::MappingImportJob do
     described_class.new.perform(
       default_user_id: create(:user).id,
       file: file,
+      headers: CSV.open(file, &:readline),
       mappings: {},
       project_id: create(:project).id,
+      state: 'draft',
       uid: 1
     )
   end
 
   describe '#perform' do
-    it 'calls Importer#import_csv' do
+    it 'calls Importer#import_rows' do
       dbl = double('Importer')
       allow(Dradis::Plugins::CSV::Importer).to receive(:new).and_return(dbl)
-      expect(dbl).to receive(:import_csv).and_return(true)
+      expect(dbl).to receive(:import_rows).and_return(true)
 
       perform_job
     end

data/spec/lib/dradis/plugins/csv/importer_spec.rb

@@ -2,6 +2,7 @@ require 'rails_helper'
 
 RSpec.describe Dradis::Plugins::CSV::Importer do
   let(:file) { File.expand_path('../../../.../../../fixtures/files/simple.csv', __dir__) }
+  let(:headers) { CSV.open(file, &:readline) }
   let(:project) { create(:project) }
 
   let(:instance) do
@@ -13,11 +14,11 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
     )
   end
 
-  let(:import_csv) do
-    instance.import_csv(file: file, mappings: mappings)
+  let(:import_rows) do
+    instance.import_rows(file: file, headers: headers, mappings: mappings)
   end
 
-  describe '#import_csv' do
+  describe '#import_rows' do
     context 'when project has RTP' do
       let(:mappings) do
         {
@@ -34,7 +35,7 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
 
       it 'uses the field as Dradis Field' do
-        import_csv
+        import_rows
 
         issue = Issue.first
         expect(issue.fields).to eq({ 'MyTitle' => 'SQL Injection', 'plugin' => 'csv', 'plugin_id' => '1' })
@@ -60,7 +61,7 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
 
       it 'uses the column name as Dradis Field' do
-        import_csv
+        import_rows
 
         issue = Issue.first
         expect(issue.fields).to eq({ 'Title' => 'SQL Injection', 'VulnerabilityCategory' => 'High', 'plugin' => 'csv', 'plugin_id' => '1' })
@@ -73,7 +74,7 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
 
       it 'strips out whitespace from column header' do
-        import_csv
+        import_rows
 
         issue = Issue.first
         expect(issue.fields.keys).to include('VulnerabilityCategory')
@@ -90,7 +91,7 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
 
       it 'does not create node and evidence' do
-        import_csv
+        import_rows
 
         issue = Issue.last
         expect(issue.affected.length).to eq(0)
@@ -107,7 +108,7 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
 
       it 'uses filename and row index as csv_id' do
-        import_csv
+        import_rows
 
         issue = Issue.last
         expect(issue.fields).to eq({ 'Title' => 'SQL Injection', 'plugin' => 'csv', 'plugin_id' => 'simple.csv-0' })
@@ -124,7 +125,7 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
 
       it 'still creates evidence record' do
-        import_csv
+        import_rows
 
         issue = Issue.first
         expect(issue.fields).to eq({ 'Title' => 'SQL Injection', 'plugin' => 'csv', 'plugin_id' => '1' })
@@ -137,4 +138,86 @@ RSpec.describe Dradis::Plugins::CSV::Importer do
       end
     end
   end
+
+  describe '#import' do
+    context 'when the project has no RTP' do
+      it 'does not import anything' do
+        expect(instance.import(file: file)).to eq(false)
+        expect(Issue.count).to eq(0)
+      end
+    end
+
+    context 'when the project has RTP but no saved mapping' do
+      before do
+        project.update(report_template_properties: create(:report_template_properties))
+      end
+
+      it 'does not import anything' do
+        expect(instance.import(file: file)).to eq(false)
+        expect(Issue.count).to eq(0)
+      end
+    end
+
+    context 'when a saved mapping exists for these headers' do
+      let(:rtp) { create(:report_template_properties) }
+
+      before do
+        project.update(report_template_properties: rtp)
+
+        issue_mapping = Mapping.create!(
+          component: 'csv',
+          source: Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :issue),
+          destination: rtp.as_mapping_destination
+        )
+        issue_mapping.mapping_fields.create!(
+          source_field: 'Id', destination_field: 'plugin_id', content: '{{ csv[Id] }}'
+        )
+        issue_mapping.mapping_fields.create!(
+          source_field: 'Title', destination_field: 'Title', content: '{{ csv[Title] }}'
+        )
+
+        evidence_mapping = Mapping.create!(
+          component: 'csv',
+          source: Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :evidence),
+          destination: rtp.as_mapping_destination
+        )
+        evidence_mapping.mapping_fields.create!(
+          source_field: 'Host', destination_field: 'node_label', content: '{{ csv[Host] }}'
+        )
+        evidence_mapping.mapping_fields.create!(
+          source_field: 'Location', destination_field: 'Location', content: '{{ csv[Location] }}'
+        )
+      end
+
+      it 'imports using the saved mapping' do
+        expect(instance.import(file: file)).to eq(true)
+
+        issue = Issue.last
+        expect(issue.fields).to include('Title' => 'SQL Injection', 'plugin_id' => '1')
+
+        node = issue.affected.first
+        expect(node.label).to eq('10.0.0.1')
+
+        evidence = node.evidence.first
+        expect(evidence.fields).to include('Location' => '10.0.0.1')
+      end
+    end
+  end
+
+  describe '.templates' do
+    let(:rtp) { create(:report_template_properties) }
+    let(:issue_source) { Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :issue) }
+    let(:evidence_source) { Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :evidence) }
+
+    before do
+      Mapping.create!(component: 'csv', source: issue_source, destination: rtp.as_mapping_destination)
+      Mapping.create!(component: 'csv', source: evidence_source, destination: rtp.as_mapping_destination)
+    end
+
+    it 'groups the currently known sources by entity' do
+      expect(described_class.templates).to eq(
+        issue: [issue_source], evidence: [evidence_source]
+      )
+    end
+  end
 end

data/spec/lib/dradis/plugins/csv/mapping_form_spec.rb

@@ -0,0 +1,139 @@
+require 'rails_helper'
+
+RSpec.describe Dradis::Plugins::CSV::MappingForm do
+  let(:headers) { ['Id', 'Title', 'Host', 'Vulnerability Category'] }
+  let(:destination) { 'rtp_1' }
+  let(:rtp_fields) { { issue: ['Title'], evidence: ['Rating'] } }
+  let(:column_mappings) do
+    {
+      '0' => { 'type' => 'identifier' },
+      '1' => { 'type' => 'issue', 'field' => 'Title' },
+      '2' => { 'type' => 'node', 'field' => '' },
+      '3' => { 'type' => 'evidence', 'field' => 'Rating' }
+    }
+  end
+
+  let(:issue_source) do
+    Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :issue)
+  end
+  let(:evidence_source) do
+    Dradis::Plugins::CSV.mapping_source(headers: headers, entity: :evidence)
+  end
+
+  subject(:form) do
+    described_class.new(destination: destination, headers: headers, rtp_fields: rtp_fields)
+  end
+
+  let(:save) { form.save(column_mappings: column_mappings) }
+
+  describe '#save' do
+    it 'creates one mapping per entity with normalized source fields' do
+      expect { save }.to change { Mapping.count }.by(2)
+
+      issue_mapping = Mapping.find_by(
+        component: 'csv', source: issue_source, destination: destination
+      )
+      expect(issue_mapping.mapping_fields.pluck(:destination_field, :source_field, :content)).to match_array([
+        ['plugin_id', 'Id', '{{ csv[Id] }}'],
+        ['Title', 'Title', '{{ csv[Title] }}']
+      ])
+
+      evidence_mapping = Mapping.find_by(
+        component: 'csv', source: evidence_source, destination: destination
+      )
+      expect(evidence_mapping.mapping_fields.pluck(:destination_field, :source_field, :content)).to match_array([
+        ['node_label', 'Host', '{{ csv[Host] }}'],
+        ['Rating', 'VulnerabilityCategory', '{{ csv[VulnerabilityCategory] }}']
+      ])
+    end
+
+    context 'without a destination' do
+      let(:destination) { nil }
+
+      it 'does not create any mappings' do
+        expect { save }.not_to change { Mapping.count }
+      end
+    end
+
+    context 'when only skipped or blank columns are assigned to an entity' do
+      let(:column_mappings) do
+        {
+          '0' => { 'type' => 'identifier' },
+          '1' => { 'type' => 'issue', 'field' => '' },
+          '3' => { 'type' => 'skip' }
+        }
+      end
+
+      it 'only stores the fields with a destination' do
+        expect { save }.to change { Mapping.count }.by(1)
+
+        issue_mapping = Mapping.find_by(
+          component: 'csv', source: issue_source, destination: destination
+        )
+        expect(issue_mapping.mapping_fields.pluck(:destination_field)).to eq(['plugin_id'])
+      end
+    end
+
+    context 'when the RTP has no fields defined for an entity' do
+      let(:rtp_fields) { { issue: ['Title'], evidence: [] } }
+
+      it 'does not create a mapping for that entity, even for its identifier/node column' do
+        expect { save }.to change { Mapping.count }.by(1)
+
+        expect(Mapping.find_by(source: evidence_source)).to be_nil
+
+        issue_mapping = Mapping.find_by(
+          component: 'csv', source: issue_source, destination: destination
+        )
+        expect(issue_mapping.mapping_fields.pluck(:destination_field)).to match_array(['plugin_id', 'Title'])
+      end
+    end
+
+    context 'when the RTP has no fields defined for either entity' do
+      let(:rtp_fields) { { issue: [], evidence: [] } }
+
+      it 'does not create any mappings' do
+        expect { save }.not_to change { Mapping.count }
+      end
+    end
+
+    context 'when a column is assigned to a custom field' do
+      let(:column_mappings) do
+        {
+          '0' => { 'type' => 'identifier' },
+          '1' => { 'type' => 'issue', 'field' => 'Custom Field', 'custom_field' => 'CVSS Score' },
+          '2' => { 'type' => 'node', 'field' => '' },
+          '3' => { 'type' => 'evidence', 'field' => 'Rating' }
+        }
+      end
+
+      it 'stores the typed-in name as the destination field' do
+        save
+
+        issue_mapping = Mapping.find_by(
+          component: 'csv', source: issue_source, destination: destination
+        )
+        expect(issue_mapping.mapping_fields.pluck(:destination_field)).to match_array(['plugin_id', 'CVSS Score'])
+      end
+
+      context 'when no custom field name is provided' do
+        let(:column_mappings) do
+          {
+            '0' => { 'type' => 'identifier' },
+            '1' => { 'type' => 'issue', 'field' => 'Custom Field', 'custom_field' => '' },
+            '3' => { 'type' => 'skip' }
+          }
+        end
+
+        it 'does not store a field for that column' do
+          save
+
+          issue_mapping = Mapping.find_by(
+            component: 'csv', source: issue_source, destination: destination
+          )
+          expect(issue_mapping.mapping_fields.pluck(:destination_field)).to eq(['plugin_id'])
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dradis-csv
 version: !ruby/object:Gem::Version
-  version: 5.2.0
+  version: 5.3.0
 platform: ruby
 authors:
 - Daniel Martin
@@ -79,8 +79,11 @@ files:
 - lib/dradis-csv.rb
 - lib/dradis/plugins/csv.rb
 - lib/dradis/plugins/csv/engine.rb
+- lib/dradis/plugins/csv/field_processor.rb
 - lib/dradis/plugins/csv/gem_version.rb
 - lib/dradis/plugins/csv/importer.rb
+- lib/dradis/plugins/csv/mapping.rb
+- lib/dradis/plugins/csv/mapping_form.rb
 - lib/dradis/plugins/csv/version.rb
 - spec/features/upload_spec.rb
 - spec/fixtures/files/simple (copy).csv
@@ -88,6 +91,7 @@ files:
 - spec/fixtures/files/simple_malformed.csv
 - spec/jobs/dradis/plugins/csv/mapping_import_job_spec.rb
 - spec/lib/dradis/plugins/csv/importer_spec.rb
+- spec/lib/dradis/plugins/csv/mapping_form_spec.rb
 homepage: http://dradis.com
 licenses:
 - GPL-2
@@ -116,3 +120,4 @@ test_files:
 - spec/fixtures/files/simple_malformed.csv
 - spec/jobs/dradis/plugins/csv/mapping_import_job_spec.rb
 - spec/lib/dradis/plugins/csv/importer_spec.rb
+- spec/lib/dradis/plugins/csv/mapping_form_spec.rb