Release: Merge back 2.36.6 into dev from: master-into-dev/2.36.6-2.37.0-dev

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

DryRun Security Summary

This pull request focuses on improving the security and functionality of the DefectDojo application, covering areas such as engagement management, finding handling, credential management, and data import/export processes, with a strong emphasis on maintaining the security and integrity of the application.

Expand for full summary

Summary:

The code changes in this pull request focus on improving the security and functionality of various components in the DefectDojo application. The changes cover a wide range of areas, including engagement management, finding handling, credential management, and data import/export processes.

Key security-related changes include:

1. Proper handling of data deletion, such as deleting associated notes and history when an object is deleted.
2. Implementing robust authorization checks to ensure that only authorized users can perform sensitive actions.
3. Enhancing data export functionality to sanitize and properly format the exported data.
4. Improving the handling of user input and data parsing to prevent potential security vulnerabilities, such as SQL injection or cross-site scripting.
5. Optimizing database queries and data fetching to improve performance and scalability, which can also have a positive impact on the application's security.

Overall, the changes demonstrate a strong focus on maintaining the security and integrity of the DefectDojo application, while also improving the user experience and functionality.

Files Changed:

• dojo/benchmark/signals.py: Handles the deletion of Benchmark_Product instances and their associated notes.
• dojo/benchmark/views.py: Adds authorization checks for updating benchmark information.
• dojo/api_v2/views.py: Introduces a utility function to simplify file download handling.
• dojo/apps.py: Sets up the integration with the Watson search engine and handles configuration deduplication.
• dojo/cred/signals.py: Handles the deletion of Cred_User objects and their associated notes.
• dojo/components/views.py: Adds table-based filtering and sorting functionality.
• dojo/db_migrations/0213_system_settings_enable_ui_table_based_searching.py: Adds a new system setting to enable table-based filtering.
• dojo/cred/views.py: Handles the deletion of credentials and associated notes.
• dojo/engagement/signals.py: Handles the deletion of engagements and associated data.
• dojo/finding/helper.py: Manages the handling of findings, including deduplication and status updates.
• dojo/engagement/views.py: Adds functionality for managing risk acceptances.
• dojo/importers/base_importer.py: Enforces the use of child classes for specific importers.
• dojo/finding/views.py: Includes functionality for bulk updating and deleting findings.
• dojo/importers/default_reimporter.py: Handles the reimport process and deduplication of findings.
• dojo/models.py: Adds a new system setting for enabling table-based filtering.
• dojo/notes/signals.py: Handles the deletion of notes and associated history.
• dojo/notes/helper.py: Provides a function to delete notes associated with an object.
• dojo/notes/views.py: Handles the deletion of notes associated with Cred_User objects.
• dojo/risk_acceptance/helper.py: Manages the deletion of risk acceptances.
• dojo/risk_acceptance/signals.py: Handles the deletion of risk acceptances and associated notes.
• dojo/product/views.py: Adds table-based filtering and improves the performance of product-related functionality.
• dojo/templates/dojo/custom_html_toc.html: Generates a table of contents for HTML reports.
• dojo/templates/dojo/components.html: Implements a data table with security-focused features.
• dojo/templates/dojo/endpoint_pdf_report.html: Generates the table of contents for an endpoint PDF report.
• dojo/templates/dojo/engagement_pdf_report.html: Generates the table of contents for an engagement PDF report.
• dojo/templates/dojo/finding_pdf_report.html: Generates the table of contents for a finding PDF report.
• dojo/templates/dojo/engagements_all.html: Implements a data table with security-focused features.
• dojo/templates/dojo/findings_list_snippet.html: Displays a list of findings with various security-related features.

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	13 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.5% Duplication on New Code

See analysis details on SonarCloud