Ruff: Fix issues via "target-version"

[kiblik]

Set "target-version" and auto-fix related parts

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the functionality and security of various components within the DefectDojo application, including finding management, risk acceptance, report generation, remote user authentication, and the handling of security scan results from various tools.

Expand for full summary

Summary:

The code changes in this pull request focus on improving the functionality and security of various components within the DefectDojo application. The changes cover a wide range of areas, including finding management, risk acceptance, report generation, remote user authentication, and the handling of security scan results from various tools.

From an application security perspective, the key improvements include:

1. Enhancing the handling of findings, such as better tracking of accepted risks, improved JIRA integration, and more robust deduplication and processing of scan results.
2. Strengthening the security of the risk acceptance functionality, including better validation and authorization controls.
3. Improving the security and reliability of the report generation process, with better input validation and character limit handling.
4. Implementing a secure remote user authentication mechanism that only allows access from trusted proxy servers.
5. Ensuring that the parsing and processing of security scan results, such as from Checkmarx One, Nmap, and SARIF, is done in a secure and robust manner.

Overall, the changes in this pull request demonstrate a strong focus on improving the application's security posture, maintainability, and reliability. The application security engineer should continue to review the entire codebase and monitor for any potential security vulnerabilities or areas for further improvement.

Files Changed:

1. dojo/api_v2/serializers.py: The changes introduce a new function to ensure that findings being added to a risk acceptance have the same engagement, which helps maintain the integrity of the risk acceptance process.
2. dojo/apps.py: The changes update the condition for selecting default fields to be indexed by the Watson search engine, which does not introduce any direct security concerns.
3. dojo/engagement/views.py: The changes enhance the engagement management functionality, including the handling of risk acceptance, threat models, and JIRA integration, with a focus on security-related aspects such as permissions and authorization.
4. dojo/home/views.py: The changes in this file are minor and do not introduce any significant security concerns.
5. dojo/finding/views.py: The changes improve the finding management functionality, including the handling of accepted risks, JIRA and GitHub integration, and bulk updates, with a strong emphasis on security-related aspects.
6. dojo/importers/auto_create_context.py: The changes enhance the handling of resources during the import and reimport processes, with a focus on input validation, transaction management, and access control.
7. dojo/importers/default_importer.py: The changes improve the processing of findings during the import process, including the handling of deduplication, closing of old findings, and asynchronous processing.
8. dojo/importers/endpoint_manager.py: The changes enhance the management of endpoints associated with findings, including the use of asynchronous processing and endpoint status updates.
9. dojo/importers/default_reimporter.py: The changes improve the reimport process, including the handling of deduplication, finding status updates, and asynchronous processing.
10. dojo/metrics/utils.py: The changes improve the functionality and maintainability of the metrics-related code, without introducing any obvious security concerns.
11. dojo/importers/options.py: The changes enhance the handling of data types and compression/decompression of model objects within the ImporterOptions class, which can have indirect security benefits.
12. dojo/models.py: The changes improve the performance and efficiency of the components property in the Finding model, without introducing any security concerns.
13. dojo/remote_user.py: The changes implement a secure remote user authentication mechanism, with appropriate checks and configurations to ensure that the authentication process is only performed for trusted sources.
14. dojo/risk_acceptance/api.py: The changes enhance the risk acceptance functionality, including better tracking of accepted risks and the handling of inactive and risk-accepted findings.
15. dojo/reports/views.py: The changes improve the report generation process, including better URL handling and character limit management, which can help mitigate potential security issues.
16. dojo/system_settings/views.py: The changes enhance the validation logic for the system settings form, helping to prevent potential security issues or unexpected behavior.
17. dojo/tools/appcheck_web_application_scanner/engines/appcheck.py: The changes improve the handling of request and response data in the AppCheck scanning engine parser.
18. dojo/test/views.py: The changes are mostly related to refactoring and improving the type annotations, without

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	7 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

@kiblik We got the 4 approvals for this one - just the merge conflicts and we're good to go 👍

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.