Release: Merge release into master from: release/2.39.1

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

The pull request includes a wide range of updates to the DefectDojo application, primarily focused on improving the JIRA integration, enhancing the user interface, and addressing minor bug fixes or improvements, without introducing any obvious security vulnerabilities.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates to the DefectDojo application, primarily focused on improving the JIRA integration functionality, enhancing the user interface, and addressing minor bug fixes or improvements.

The key changes include:

1. Updating the JIRA integration to allow disabling the JIRA project connection, improving the handling of JIRA webhooks and comments, and introducing a more advanced JIRA configuration option.
2. Modifying the user interface, such as updating the "Get Support" link to "Upgrade" and enhancing the display of JIRA-related information.
3. Addressing minor issues, such as improving the date parsing in the Netsparker parser and handling missing fields in the AWS Security Hub parser.

From an application security perspective, the changes do not introduce any obvious security vulnerabilities. However, it is important to ensure that the JIRA integration is properly implemented and secured, that user input is thoroughly validated, and that the application's overall security posture is regularly reviewed and maintained.

Files Changed:

• common/classes/Common/PostUpsell/PCA/GiftBlanket.php, common/classes/Common/PostUpsell/PCA/PostCheckoutAd.php, and common/classes/Common/PostUpsell/PCA/Gift.php: These files contain changes related to the post-checkout upsell functionality, including the removal of a check for whether the customer has placed an order before, handling of AB testing, and tracking parameters. The changes should be reviewed to ensure that they do not introduce any security vulnerabilities.
• dojo/__init__.py, dojo/api_v2/views.py, dojo/db_migrations/0217_jira_project_enabled.py, dojo/home/views.py, dojo/jira_link/urls.py, dojo/jira_link/helper.py, dojo/forms.py, and dojo/jira_link/views.py: These files contain changes related to the JIRA integration functionality, including the addition of an "enabled" field, handling of JIRA webhooks and comments, and updates to the JIRA configuration forms. These changes should be reviewed to ensure that the JIRA integration is properly implemented and secured.
• dojo/settings/settings.dist.py: This file contains updates to the list of acceptable vulnerability URLs, which is a positive security enhancement.
• dojo/templates/base.html and dojo/templates/dojo/new_jira.html: These template files contain UI-related changes, which do not directly impact security but should be reviewed for proper input validation and CSRF protection.
• dojo/models.py and dojo/templates/dojo/view_test.html: These files contain changes related to the addition of a risk acceptance feature, which should be reviewed to ensure that it is properly implemented and secured.
• dojo/tools/awssecurityhub/parser.py and dojo/tools/netsparker/parser.py: These files contain changes to the parsers for AWS Security Hub and Netsparker, respectively, which improve the handling of unexpected data and should help enhance the overall security and reliability of the application.
• Various test-related files, such as unittests/dojo_test_case.py, unittests/test_jira_config_engagement.py, and unittests/test_jira_config_engagement_epic.py: These changes are focused on improving the test coverage and robustness of the JIRA integration functionality, which is a positive security practice.

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	5 findings
Sensitive Files Analyzer	3 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.