External sites list shows each site's DAST grade

The newest finished scan's letter grade sits left of the worst severity
tag in the Last dynamic scan column, and the scan date moves to its own
line under them.  The grade is worked out when the page loads, with the
same rules as the PDF report, so a decision or an enhanced review made
since the scan already counts.  Hovering shows the score and the scan
date, and the grade links to the report.  Scans that kept only counts
show no grade, since a grade needs each finding's category.

Author: hackrange

app/core/dast_report.py

@@ -147,6 +147,62 @@ def score(findings: list, triaged: bool, only: str = None) -> dict:
             "counted": sum(len(v) for v in by_cat.values())}
 
 
+def scan_grade(scan, decisions: dict):
+    """The report's overall grade for one finished scan, worked out the same
+    way the PDF works it out: decisions as they stand today, false positives
+    left out, and the enhanced review's verdicts when it ran.  -> {"score",
+    "grade"}, or None when the scan kept only counts, since a grade needs
+    each finding's category."""
+    from app.core import external, external_decisions
+
+    if scan is None or scan.status != "done" or scan.summary_only:
+        return None
+    raw = external.findings_of(scan)
+    if not raw and any(getattr(scan, s) or 0 for s in SEVERITIES):
+        return None
+    found = [f for f in external_decisions.apply(raw, decisions, scan_id=scan.id)
+             if (f.get("decision") or {}).get("kind") != "false_positive"]
+    triaged = (scan.ai_status or "") == "done" and any(f.get("ai_verdict") for f in found)
+    for f in found:
+        f["owasp"] = owasp_of(f)
+    graded = score(found, triaged)
+    return {"score": graded["score"], "grade": graded["grade"], "triaged": triaged}
+
+
+def latest_grades(db, asset_ids: list) -> dict:
+    """{asset id: grade dict plus scan id and date} for each site's newest
+    finished scan, the one the list shows as its last dynamic scan.  Reads
+    only those scans' findings, and every site's decisions in one query."""
+    from app.core.models import ExternalDastScan, ExternalFindingDecision
+
+    ids = [int(i) for i in asset_ids if i]
+    if not ids:
+        return {}
+    newest: dict = {}
+    for asset_id, scan_id in (db.query(ExternalDastScan.asset_id, ExternalDastScan.id)
+                              .filter(ExternalDastScan.asset_id.in_(ids),
+                                      ExternalDastScan.status == "done")
+                              .order_by(ExternalDastScan.asset_id,
+                                        ExternalDastScan.scanned_at.desc(),
+                                        ExternalDastScan.id.desc())):
+        newest.setdefault(asset_id, scan_id)
+    if not newest:
+        return {}
+    decisions: dict = {}
+    for d in db.query(ExternalFindingDecision).filter(
+            ExternalFindingDecision.asset_id.in_(list(newest))):
+        decisions.setdefault(d.asset_id, {}).setdefault(
+            d.finding_key, {})[int(d.only_scan_id or 0)] = d
+    out = {}
+    for scan in db.query(ExternalDastScan).filter(ExternalDastScan.id.in_(list(newest.values()))):
+        graded = scan_grade(scan, decisions.get(scan.asset_id, {}))
+        if graded:
+            graded.update(scan_id=scan.id, scanned_at=scan.scanned_at,
+                          report=available(scan))
+            out[scan.asset_id] = graded
+    return out
+
+
 def _q(text: str) -> str:
     return shlex.quote(str(text or ""))
 

app/web/routes_external.py

@@ -232,6 +232,13 @@ def list_page(request: Request, q: str = "", tag: str = "", app: str = "",
             page_no = 1
         offset = (page_no - 1) * size
         rows = rows[offset:offset + size]
+        # The DAST grade of each shown site's newest scan, worked out now so
+        # a decision or a review made since the scan already counts.
+        from app.core import dast_report
+
+        grades = dast_report.latest_grades(db, [r["a"].id for r in rows])
+        for r in rows:
+            r["dast_grade"] = grades.get(r["a"].id)
         from urllib.parse import urlencode
 
         filters = [(k, v) for k, v in (("q", q), ("tag", tag), ("app", app), ("grade", grade),

app/web/templates/external.html

@@ -154,8 +154,10 @@
                   <button class="btn sm danger" type="submit">Stop</button></form>{% endif %}</div>
             {% endif %}
             {% if a.last_dast_at %}
-              {% if a.last_dast_severity in ('', 'none') %}<span class="badge ok">no findings</span>{% else %}<span class="badge {{ a.last_dast_severity }}">worst: {{ a.last_dast_severity }}</span>{% endif %}
-              {{ a.last_dast_at | dt('%Y-%m-%d') }}
+              <div class="nowrap">{% set g = r.dast_grade %}{% if g %}<a href="{{ base }}/external/{{ a.id }}/scans/{{ g.scan_id }}{{ '/report.pdf' if g.report else '' }}" class="grade {{ g.grade }}" style="text-decoration:none;margin-right:.3rem"
+                 title="DAST grade, score {{ g.score }} of 100, from the scan of {{ g.scanned_at | dt('%Y-%m-%d') }}{{ '' if g.triaged else ', every finding counted in full (no enhanced review)' }}">{{ g.grade }}</a>{% endif %}
+              {% if a.last_dast_severity in ('', 'none') %}<span class="badge ok">no findings</span>{% else %}<span class="badge {{ a.last_dast_severity }}">worst: {{ a.last_dast_severity }}</span>{% endif %}</div>
+              <div>{{ a.last_dast_at | dt('%Y-%m-%d') }}</div>
               <div class="faint">{{ a.last_dast_server }}</div>
               {% if a.last_dast_url %}<div><a rel="noopener noreferrer" {% if a.last_dast_url.startswith('http') %}target="_blank" href="{{ a.last_dast_url }}"{% else %}href="{{ base }}{{ a.last_dast_url }}"{% endif %}>result</a></div>{% endif %}
               {% if r.due == 'due' %}<span class="badge pending">overdue</span>{% endif %}