Skip to content

Always clean up Nessus policy in vulnscan.py job #13

@mcdonnnj

Description

@mcdonnnj

🐛 Summary

Currently if the vulnscan.py will only delete the policy it creates if a job is able to run to successful completion. This can result in a number of orphaned policies for failed jobs on the Nessus server.

To reproduce

You can see that the policy removal logic in

# delete policy
LOGGER.info("Deleting policy id: %s", new_policy_id)
result = controller.policy_delete(new_policy_id)
if not result:
error_exit("No result returned when deleting policy")
LOGGER.info("Policy deleted successfully")
is not duplicated in
def error_exit(message):
print(message, file=sys.stderr)
sys.exit(1)

and so anywhere the job bombs out that uses it will be affected:
if not new_scan.get("scan", {}).get("uuid"):
error_exit("New scan was not created")

if not scan_launch_response.get("scan_uuid"):
error_exit("New scan was not launched")

if not scan_found:
error_exit(f"Scan was never seen. id: {new_scan_id}")

if not report:
error_exit(f"Downloaded report was empty for scan id: {new_scan_id}")

if not result:
error_exit("No result returned when deleting scan")

Expected behavior

The job leaves no orphaned items on the Nessus server.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions