Release: Merge back 2.45.3 into dev from: master-into-dev/2.45.3-2.46.0-dev #12325

github-actions · 2025-04-28T15:25:58Z

Release triggered by rossops

….46.0-dev Release: Merge back 2.45.2 into bugfix from: master-into-bugfix/2.45.2-2.46.0-dev

* add examples_of_use content * reweight sidebar --------- Co-authored-by: Paul Osinski <[email protected]>

* Reimport: Special statuses should be respected from reports * Fixing ruff * Update unittests/tools/test_checkmarx_one_parser.py Co-authored-by: Charles Neill <[email protected]> * Use the correct dict for statuses --------- Co-authored-by: Charles Neill <[email protected]>

Co-authored-by: Paul Osinski <[email protected]>

* sla: parse finding.date implicitly * add comment * move import * add unit test

* fortify: handle suppressed findings * ruff * fortify: handle suppressed findings docs * fortify: handle suppressed findings docs

* 2.45.2 pro changelog * add nextgen finding enhancements documentation * Correcting messy conflict resolution * Update docs/content/en/changelog/changelog.md Co-authored-by: Charles Neill <[email protected]> * Update docs/content/en/working_with_findings/finding_priority.md Co-authored-by: Charles Neill <[email protected]> * Update finding_priority.md --------- Co-authored-by: Paul Osinski <[email protected]> Co-authored-by: Cody Maffucci <[email protected]> Co-authored-by: Charles Neill <[email protected]>

Release: Merge release into master from: release/2.45.3

dryrunsecurity · 2025-04-28T15:27:43Z

🔴 Risk threshold exceeded.

This pull request contains multiple sensitive file edits across various components of the Dojo security tracking system, with potential risks including mass assignment vulnerabilities, JSON injection, cross-site scripting, and unsafe date parsing that could compromise system security if not carefully reviewed and validated.

⚠️ Configured Codepaths Edit in dojo/templatetags/display_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/templatetags/as_json.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/templatetags/display_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/templatetags/display_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Configured Codepaths Edit in dojo/importers/base_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

⚠️ Potential Mass Assignment Vulnerability in dojo/tools/checkmarx_one/parser.py

Vulnerability	Potential Mass Assignment Vulnerability
Description	The code uses the `**instance_details` syntax to pass multiple attributes to the Finding model constructor, which could potentially allow mass assignment if `instance_details` contains user-controlled or unvalidated data

django-DefectDojo/dojo/tools/checkmarx_one/parser.py

Lines 175 to 189 in 23d98ee

    
               date = self._parse_date(instance.get("firstFoundDate")) 
        
           else: 
        
               date = self._parse_date(instance.get("foundDate")) 
        
           instance_details = self.determine_state(instance) 
        
           instance_details.update(base_finding_details) 
        
           # Create the finding object 
        
           finding = Finding( 
        
               severity=instance.get("severity").title(), 
        
               date=date, 
        
               file_path=instance.get("destinationFileName"), 
        
               line=instance.get("destinationLine"), 
        
               **instance_details, 
        
           ) 
        
           # Add some details to the description 
        
           if node_snippet := get_node_snippet(instance.get("nodes", [])):

💭 Unconfirmed Findings (5)

Vulnerability	Potential JSON Injection Risk
Description	Identified in multiple webhook template files, the introduction of `as_json_no_html_esc` filter could change how special characters and potentially malicious content are handled during JSON serialization, potentially allowing injection of harmful content.

Vulnerability	Potential Cross-Site Scripting (XSS) Risk
Description	Located in `dojo/templatetags/as_json.py`, the `as_json_no_html_esc` function uses `mark_safe()` to bypass HTML escaping, which could allow malicious JSON content to be rendered directly in templates if input is user-controlled.

Vulnerability	Potential Unsafe Date Parsing
Description	Found in `dojo/models.py`, the introduction of `dateutil.parser.parse()` could potentially be exploited if an attacker provides maliciously crafted date strings, leading to potential parsing vulnerabilities.

Vulnerability	Potential Information Exposure
Description	Discovered in `dojo/settings/settings.dist.py`, adding new vulnerability URL mappings could potentially expose internal versioning or naming conventions of the security tracking system.

Vulnerability	Commented Validation Code Risk
Description	Located in `dojo/models.py`, commented-out validation check suggests potential inconsistent date validation, which might indicate bypassing of type checking for critical fields.

We've notified @mtesauro.

All finding details can be found in the DryRun Security Dashboard.

DefectDojo release bot and others added 16 commits April 22, 2025 02:44

Update versions in application files

18613df

Merge pull request #12288 from DefectDojo/master-into-bugfix/2.45.2-2…

ae199cb

….46.0-dev Release: Merge back 2.45.2 into bugfix from: master-into-bugfix/2.45.2-2.46.0-dev

🐛 Differentiate between slackware and siemens vulnid (#12251)

a0c4895

[docs] Add Example Cases to docs (#12265)

c8a50b0

* add examples_of_use content * reweight sidebar --------- Co-authored-by: Paul Osinski <[email protected]>

saml: provide link to saml-tracer browser add-on (#12274)

6d412dd

tenable: check mandatory columns before importing (#12273)

f763df3

2.45.2 pro changelog (#12292)

84383b2

Co-authored-by: Paul Osinski <[email protected]>

sla: parse finding.date implicitly (#12301)

b413437

* sla: parse finding.date implicitly * add comment * move import * add unit test

Fortify: Handle suppressed findings as false positives (#12293)

76c63d3

* fortify: handle suppressed findings * ruff * fortify: handle suppressed findings docs * fortify: handle suppressed findings docs

Quotes (#12226)

a53fcef

Implement Albibaba Linux vulnids (#12304)

48a7a73

Update versions in application files

0bab9ec

Merge pull request #12324 from DefectDojo/release/2.45.3

477583e

Release: Merge release into master from: release/2.45.3

Update versions in application files

72b373a

github-actions bot requested review from Maffooch and mtesauro as code owners April 28, 2025 15:25

Merge branch 'dev' into master-into-dev/2.45.3-2.46.0-dev

26e6f44

github-actions bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR docs unittests ui parser helm labels Apr 28, 2025

rossops added 2 commits April 28, 2025 11:14

Fixing linter issues

c0a1e1c

Fixing keyword space

23d98ee

rossops merged commit 0b732f0 into dev Apr 28, 2025
78 of 79 checks passed

rossops deleted the master-into-dev/2.45.3-2.46.0-dev branch April 28, 2025 16:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release: Merge back 2.45.3 into dev from: master-into-dev/2.45.3-2.46.0-dev #12325

Release: Merge back 2.45.3 into dev from: master-into-dev/2.45.3-2.46.0-dev #12325

github-actions bot commented Apr 28, 2025

dryrunsecurity bot commented Apr 28, 2025 •

edited

Loading

Release: Merge back 2.45.3 into dev from: master-into-dev/2.45.3-2.46.0-dev #12325

Release: Merge back 2.45.3 into dev from: master-into-dev/2.45.3-2.46.0-dev #12325

Conversation

github-actions bot commented Apr 28, 2025

dryrunsecurity bot commented Apr 28, 2025 • edited Loading

🔴 Risk threshold exceeded.

dryrunsecurity bot commented Apr 28, 2025 •

edited

Loading