Release: Merge back 2.55.1 into dev from: master-into-dev/2.55.1-2.56.0-dev#14250
Merged
Release: Merge back 2.55.1 into dev from: master-into-dev/2.55.1-2.56.0-dev#14250
Conversation
….56.0-dev Release: Merge back 2.55.0 into bugfix from: master-into-bugfix/2.55.0-2.56.0-dev
* update robots.txt for indexing * add audience content to algolia indexing * add cache refresh for release notes version
Bumps [django](https://github.com/django/django) from 5.2.9 to 5.2.11. - [Commits](django/django@5.2.9...5.2.11) --- updated-dependencies: - dependency-name: django dependency-version: 5.2.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Set last reviewed date and reviewer for finding Update finding's last reviewed date and reviewer to maintain parity with UI behaviors * Apply suggestion from @Maffooch * Set last reviewed date and author for finding Update finding with last reviewed date and author. * Apply suggestions from code review * Apply suggestion from @Maffooch --------- Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>
Hardened build_count_subquery to explicitly clear ordering and order by group_field before slicing. This prevents Django from adding implicit ORDER BY <pk> which causes GROUP BY to collapse counts to 1. Also updated prefetch_for_product_type to use the hardened helper instead of a local Subquery with the same vulnerability. Added unit tests to verify the fixes work correctly. Co-authored-by: Paul Osinski <42211303+paulOsinski@users.noreply.github.com>
Release: Merge release into master from: release/2.55.1
github-actions
bot
requested review from
Maffooch and
mtesauro
as code owners
🔴 Risk threshold exceeded.This pull request introduces changes to dojo/jira_link/views.py that automatically mark findings as reviewed (setting last_reviewed and last_reviewed_by to a generic 'JIRA' user) when comments are imported from JIRA, allowing any user who can comment on the linked JIRA issue to alter review status and potentially bypass security review controls. Additionally, the scanner flagged this file as a sensitive edit that may require special path/author configuration in .dryrunsecurity.yaml.
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
Authorization Bypass in dojo/jira_link/views.py
| Vulnerability | Authorization Bypass |
|---|---|
| Description | The function check_for_and_create_comment in dojo/jira_link/views.py is updated to automatically set a finding's last_reviewed and last_reviewed_by status whenever a comment is imported from JIRA. This action is triggered by any user who can comment on the linked JIRA issue, regardless of whether they have security review permissions in DefectDojo. Furthermore, the last_reviewed_by field is set to a generic 'JIRA' user, which obscures accountability. Since the last_reviewed field is used for filtering findings and compliance tracking, this allows unauthorized actors to manipulate the security review status, potentially hiding stale or unreviewed findings from security oversight. |
django-DefectDojo/dojo/jira_link/views.py
Lines 288 to 291 in 17d71f3
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
Maffooch