fortify/fcli

FoD: unhide and rename `dast-scan *-legacy` subcommands as `dast-scan *-classic`

Opened this issue · 2 comments

MikeTheSnowman commented

Enhancement Request

Issue #452 had the original fod dast-scan start and dast-scan get-config commands hidden and renamed with a -legacy prefix in order to accomidate the new FoD DAST Automated assessment capability. I think we had some uncertainty at the time if the legacy web-app/api DAST assessment types would be sticking around (or possibly some other reason).

But it's looking like DAST Automated and the Legacy DAST Assessment capabilities will be living together for now because it appears that DAST Automated is now available and does indeed appear to be it's own assessment type that can be used along side with the existing App/API DAST assessments.

With that said, I think we should consider doing the following:

  1. Make the dast-scan start-legacy and dast-scan get-config-legacy visible again
  2. Rename dast-scan start-legacy to dast-scan start-classic
  3. And rename dast-scan get-config-legacy to dast-scan get-config-classic
kadraman commented

Yes, I agree that the classic DAST will still be around. However since it is not automated (its basically just a form filling exercise) and the APIs (particularly the setup API) are incomplete I'm not sure what value it would have in fcli. Happy to uncomment/change the names if we think it adds value?

kadraman commented

I've noticed that the Azure DevOps plugin has had the "DAST Website" task removed and only has "DAST Automated" now - not sure if this makes the case for un-hiding these tasks. However I think just in case it will be best to rename them as Mike describes.