Ruff: add and fix COM

[kiblik]

Fix COM rule violations

https://docs.astral.sh/ruff/rules/#flake8-commas-com

https://pypi.org/project/flake8-commas/

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 finding
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	❕	106 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request focus on improving various security-related features and functionality within the Defect Dojo application. The changes span across multiple modules, including authorization, permissions, serializers, views, and utility functions.

Key security-focused improvements include:

1. Enhancing the authorization and access control mechanisms to ensure that users can only perform actions they are authorized to do, based on their roles and group memberships.
2. Improving the handling and validation of user input, such as in the FindingFilter, EndpointFilter, and various API filter classes, to prevent potential injection attacks.
3. Implementing secure credential management, including encryption of passwords and centralized mapping of credentials to various entities.
4. Strengthening the endpoint management functionality, including validation, migration, and cleanup of endpoint data to maintain data integrity.
5. Introducing logging and monitoring capabilities to track security-related events and changes, such as the deletion of engagements and endpoints.
6. Ensuring that sensitive information, such as API tokens, is properly hidden or sanitized before being displayed or transmitted.

Overall, the changes in this pull request demonstrate a strong focus on improving the security posture of the Defect Dojo application, with a particular emphasis on access control, input validation, and secure data handling. While the changes do not appear to introduce any obvious security vulnerabilities, it is essential to thoroughly review the implementation and test the application's security under various scenarios to identify and address any potential issues.

Files Changed:

1. dojo/admin.py: The changes involve adding a new ChoiceQuestion model to the QuestionParentAdmin class, which is a common administrative functionality and does not raise any immediate security concerns.
2. docker/install_chrome_dependencies.py: The changes focus on improving the robustness and reliability of the Chrome dependency installation process within a Docker environment, with a consideration for potential security implications related to external command execution and input sanitization.
3. dojo/announcement/signals.py: The changes handle the association of users with new announcements, which does not appear to introduce any obvious security vulnerabilities, but it's important to ensure proper input validation and access control.
4. dojo/api_v2/exception_handler.py: The changes improve the exception handling and error reporting in the application's API, which is an important aspect of application security and overall application quality.
5. dojo/announcement/views.py: The changes are focused on the management of announcements, including creating, updating, and dismissing them. The implementation follows security best practices, such as using authorization decorators and input validation.
6. dojo/api_v2/mixins.py: The changes introduce a DeletePreviewModelMixin class, which provides a preview of the objects that will be deleted when a specific object is deleted. The implementation appears to be secure, with considerations for sensitive information exposure and access control.
7. dojo/api_v2/prefetch/prefetcher.py and dojo/api_v2/prefetch/schema.py: The changes focus on implementing a prefetching mechanism to optimize the performance of the API responses, with considerations for input validation and secure data handling.
8. dojo/api_v2/permissions.py: The changes involve the implementation of various permission classes that control access to different parts of the application based on user roles and permissions, which is a crucial aspect of secure application design.
9. dojo/api_v2/views.py: The changes enhance the functionality and security-related features of the API, including managing endpoint statuses, engagements, and findings.
10. dojo/apps.py: The changes involve the registration of various models with the Watson search engine, with considerations for potential security implications, such as the exposure of sensitive information.
11. dojo/authorization/authorization.py and dojo/authorization/authorization_decorators.py: The changes focus on the implementation of the authorization system, including decorators for enforcing user permissions and global permissions.
12. dojo/banner/views.py and dojo/banner/urls.py: The changes are related to the management of the application's banner, with a focus on input validation and authorization.
13. dojo/checks.py: The changes involve the implementation of a configuration deduplication check, which is a good security practice to ensure that the application is properly configured.
14. dojo/components/sql_group_concat.py: The changes focus on the implementation of a custom Django Aggregate class for performing the GROUP_CONCAT operation, with considerations for input validation

Powered by DryRun Security

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.