fix(parsers): DeprecationWarning: Testing an element's truth ...

[kiblik]

I noticed quite a few DeprecationWarning in the test logs.

/app/dojo/tools/dependency_check/parser.py:108: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:111: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:169: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:184: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:202: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:207: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:283: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:435: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:444: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:459: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:482: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/dependency_check/parser.py:90: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/fortify/xml_parser.py:118: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/fortify/xml_parser.py:122: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/fortify/xml_parser.py:89: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.
/app/dojo/tools/nmap/parser.py:99: DeprecationWarning: Testing an element's truth value will always return True in future versions.  Use specific 'len(elem)' or 'elem is not None' test instead.

[dryrunsecurity]

This pull request modifies the Dependency Check XML parser to add defensive if node is not None checks that prevent crashes but can silently skip entire sections (e.g., missing ), causing incomplete and potentially misleading reports without logging or error alerts. This lack of notification or error reporting increases the risk of unnoticed missing data in security assessments.

Incomplete Data Processing in Parser in dojo/tools/dependency_check/parser.py

Vulnerability

Incomplete Data Processing in Parser

Description

The parser for Dependency Check XML reports now includes if node is not None checks to prevent crashes. However, these checks, particularly for critical elements like <dependencies>, lead to silent skipping of entire sections of the report if the corresponding XML elements are missing. There is no logging or error reporting mechanism to alert the user that parts of the report were not processed, resulting in an incomplete and potentially misleading security assessment.

django-DefectDojo/dojo/tools/dependency_check/parser.py

Lines 435 to 438 in 32e4e0f

	if dependencies is not None:
	for dependency in dependencies.findall(namespace + "dependency"):
	vulnerabilities = dependency.find(
	namespace + "vulnerabilities",

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved