Add notes management to RiskAcceptanceViewSet

[Maffooch]

Implement notes management for the RiskAcceptanceViewSet, allowing users to retrieve and add notes associated with risk acceptance entries. This enhancement includes GET and POST actions for managing notes effectively.

[dryrunsecurity]

This pull request introduces a race condition in RiskAcceptanceViewSet: the notes action uses a check-then-act pattern to enforce a single-note-per-type rule without using transactions or locks, so concurrent requests can both pass the check and create duplicate 'single' type notes, violating the intended business restriction.

Race Condition in dojo/api_v2/views.py

Vulnerability

Race Condition

Description

The notes action in RiskAcceptanceViewSet implements a check-then-act pattern to enforce that only one note of a specific 'single' type can be added to a risk acceptance. However, this check is performed without database transactions or locking. Concurrent requests can both pass the initial check before either has created the new note, leading to multiple notes of the same 'single' type being associated with the risk acceptance, bypassing the intended business logic restriction.

django-DefectDojo/dojo/api_v2/views.py

Lines 793 to 796 in 2d87740

	if notes and note_type and note_type.is_single:
	return Response("Only one instance of this note_type allowed on a risk acceptance.", status=status.HTTP_400_BAD_REQUEST)
	author = request.user

---

All finding details can be found in the DryRun Security Dashboard.