feat(k8s-test): Try login and obtain API token

[kiblik]

Simple "give me login page" is not enough. It should be possible to log in to the working application.

This PR add test for:

• simple login
• simple API test - get token

Added based on #10490

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code changes focus on improving the administration and deployment of the Defect Dojo application, with a specific emphasis on the Engagement Surveys feature and the Kubernetes deployment process.

The changes in the admin.py file set up the administration of the Engagement Surveys models, including Question, Answer, Engagement_Survey, and Answered_Survey, using Django's polymorphic admin functionality. This allows the admin interface to handle different types of questions and answers seamlessly. From a security perspective, these changes do not introduce any obvious vulnerabilities, but it's important to ensure that the underlying data models and business logic are properly secured and validated.

The changes in the .github/workflows/k8s-tests.yml file focus on improving the Kubernetes deployment process by adding checks for login and API functionality, handling errors and retries, and securely retrieving sensitive information. These changes help ensure the core functionality of the application is working as expected after deployment and address potential security concerns related to sensitive information handling.

Files Changed:

1. dojo/admin.py:

   • Unregisters the LogEntry model from the Django admin interface.
   • Sets up the administration of the Engagement Surveys models, including Question, Answer, Engagement_Survey, and Answered_Survey, using Django's polymorphic admin functionality.
   • Registers the QuestionParentAdmin and AnswerParentAdmin classes, along with the individual child model admins.
   • Registers the Engagement_Survey and Answered_Survey models with the Django admin interface.

2. .github/workflows/k8s-tests.yml:

   • Adds checks to ensure the login page is accessible and the admin user can authenticate successfully.
   • Checks the API endpoint for token authentication.
   • Checks for any pods in an error state and dumps the logs for those pods.
   • Includes a retry mechanism for the login check.
   • Retrieves the admin password from a Kubernetes secret.
   • Includes a sample curl request to demonstrate how to log in to the DefectDojo application using the admin credentials.

Powered by DryRun Security

[dryrunsecurity]

DryRun Security Summary

The changes in this pull request focus on enhancing the GitHub Actions workflow for deploying the DefectDojo application on a Kubernetes cluster, introducing several important security checks and validations to ensure the successful deployment and proper functioning of the application.

Expand for full summary

Summary:

The changes in this pull request are focused on enhancing the GitHub Actions workflow for deploying the DefectDojo application on a Kubernetes cluster. From an application security perspective, these changes introduce several important checks and validations to ensure the successful deployment and proper functioning of the application.

The key security-related aspects of the changes include:

1. Login and API Checks: The workflow now includes checks to verify the login functionality and the API token authentication are working correctly. These checks help identify any issues with the application's authentication and authorization mechanisms, which are critical for maintaining the overall security of the application.

2. Kubernetes Secret Management: The code securely retrieves the admin password from a Kubernetes secret, which is a best practice for handling sensitive information without exposing it in the codebase.

3. Error Handling: The workflow includes error handling and logging mechanisms to capture any issues that may arise during the deployment process. This helps with troubleshooting and identifying potential security-related problems, such as misconfigured components or runtime errors.

Overall, these changes demonstrate a security-conscious approach to the application's deployment and operation, which is essential for maintaining the security and integrity of the DefectDojo application.

Files Changed:

• .github/workflows/k8s-tests.yml: This file contains the GitHub Actions workflow for deploying the DefectDojo application on a Kubernetes cluster. The changes include:
  • Addition of a "Simple Login check" section to verify the login functionality by attempting to log in with the admin credentials retrieved from the Kubernetes secret.
  • Addition of a "Simple API check" section to verify the API token authentication by attempting to authenticate using the API token endpoint with the admin credentials.
  • Secure retrieval of the admin password from the Kubernetes secret named "defectdojo" using the kubectl get secret command.
  • Inclusion of error handling and logging mechanisms to capture any issues that may arise during the deployment process, such as pods in an error state.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[Maffooch]

It looks like there has not been any activity here for a while. In order to keep the list of pull requests in a manageable state, we are closing this one for now. If we are making a mistake here, please reopen the pull request, and leave us a note 😄