Add support for files in generic parser

[damiencarol]

Add support for a new attributes that accept files as Base64 strings.

Ex:

{
    "title": "My wonderfull report",
    "findings": [
        {
            "title": "Vuln with image",
            "description": "Some very long description",
            "severity": "Medium",
            "files": [
                {
                    "title": "Screenshot from 2017-04-10 16-54-19.png",
                    "data": "iVBORw0KGgoAAAANSUhEUgAABWgAAAK0CAIAAAARSkPJAAAAA3N<...>TkSuQmCC"
                }
            ]
        }
    ]
}

[valentijnscholten]

Any thoughts on what happens with lots of (big) files?

[damiencarol]

@valentijnscholten no idea. I only touched the generic parser. 🤔
is it only in this PR? could it be preformance pb? I already saw this "SEVERE" errors in the past that were solved by just re-launching the pipeline 🤷

[valentijnscholten]

I think this is the first parser doin it, or at least unsaved_files is new loading all files in memory?Not easy to avoid with our current parser contact, just wondering what would happen if somebody uploads 500M of screenshots.

[damiencarol]

oh. I see.
I think today we limit to 3 files.
And most of the screenshots I saw used by InfoSec teams where PNG or BMP of few hundreds bytes.

[StefanFl]

Please adjust the example in https://defectdojo.github.io/django-DefectDojo/integrations/import/#generic-findings-import, so that we have a documentation.

Do we have an overall limit for the size of a file to upload?

[damiencarol]

mmhh I think it will be the limit of the size of the report. Django limit the upload anyway.
I don't think more checks are needed in the parser or (re)importer

[valentijnscholten]

Some docs would be nice, otherwise good to go.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[mtesauro]

I know @Maffooch updated/re-vamped file uploads a while ago (maybe a year ago) - just wondering if this uses the same location & process to save the files.

One of the clean-up things Cody did was to unify how files were saved. Prior to that, uploaded finding images were stored differently than threat model uploads so it would be good to avoid introducing a new file saving mechanism as part of this PR.

[damiencarol]

@mtesauro I used the new data structure

[Maffooch]

Cool feature

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.