Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release: Merge back 2.39.1 into dev from: master-into-dev/2.39.1-2.40.0-dev #11076

Merged
merged 19 commits into from
Oct 15, 2024
Merged

Release: Merge back 2.39.1 into dev from: master-into-dev/2.39.1-2.40.0-dev #11076

merged 19 commits into from
Oct 15, 2024

Conversation

github-actions[bot]
Copy link
Contributor

Release triggered by rossops

DefectDojo release bot and others added 18 commits October 7, 2024 15:40
Update versions in application files
4728bd4
@Maffooch
Merge pull request #11014 from DefectDojo/master-into-bugfix/2.39.0-2…
43bc215 
….40.0-dev

Release: Merge back 2.39.0 into bugfix from: master-into-bugfix/2.39.0-2.40.0-dev
@dependabot
Bump django from 5.0.8 to 5.0.9 (#11023)
67d87e7 
Bumps [django](https://github.com/django/django) from 5.0.8 to 5.0.9.
- [Commits](django/django@5.0.8...5.0.9)

---
updated-dependencies:
- dependency-name: django
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@Maffooch
Downgrade uwsgi to 2.0.26 (#11033)
5985567 
Hot reloading appears to be broken in. 2.0.27. The linked GitHub issue is the same behavior that I am seeing

unbit/uwsgi#2681
@Maffooch
New Jira Form: Make express the default (#11041)
316d61a 
* New Jira Form: Make express the default

* rename some stuff

* ruff

* correct tests
@Maffooch
AWS Security Hub: Accommodate for reports with missing AccountID (#11034
d56964f 
)
@Maffooch
Netsparker: Attempt to accommodate any date string format (#11047)
51557ec
@Maffooch @cneill
Jira: Add toggle to disable an existing project (#11046)
58aa6ba 
* Jira: Add toggle to disable an existing project

* Add help text

* Add filter for API

* Add new form element to tests

* update fixtures

* Update dojo/jira_link/helper.py

Co-authored-by: Charles Neill <[email protected]>

---------

Co-authored-by: Charles Neill <[email protected]>
@hblankenship
Fix for Findings count in Dashboard based on wrong date (#11040)
f345a4e 
* use correct date for finding last 7 days

* actual date_range
@hblankenship
fix for issue 11010 (#11042)
b58ff49
@hblankenship
remove mods, add Jannik to Hall of Fame (#11043)
409896c
@manuel-sommer
🎉 Add USN notices for vulnids (#11002)
c494b0b
@manuel-sommer
add DLA security advisory (#11058)
728ab1e 
* add DLA security advisory

* ruff linter

* ruff linter
@hblankenship @Maffooch
Update support text and buttons (#11051)
985299d 
* update text and icon for Get Support

* Change Pro options and Meet the Creators button

* re-add text I forgot I removed

* add hyphen

* Update dojo/templates/dojo/support.html

---------

Co-authored-by: Cody Maffucci <[email protected]>
@Maffooch
Parser Tests: add tag to differentiate (#11017)
ac1048e
Update versions in application files
0962bd6
@rossops
Merge pull request #11073 from DefectDojo/release/2.39.1
52e9f16 
Release: Merge release into master from: release/2.39.1
Update versions in application files
309a65f
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented Oct 15, 2024 •
edited
Loading

DryRun Security Summary

This pull request introduces a range of updates and improvements to the DefectDojo application, focusing on enhancing the JIRA integration functionality, addressing potential security concerns, and improving the overall security and reliability of the application.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates and improvements to the DefectDojo application, with a focus on enhancing the JIRA integration functionality and addressing potential security concerns.

The key changes include:

  1. Introducing a new "enabled" field for JIRA projects, allowing users to disable the JIRA integration for specific products without losing previously pushed findings.
  2. Improving the handling of JIRA-related errors and edge cases, such as missing account IDs and invalid JIRA configurations.
  3. Expanding the JIRA integration configuration options, including the ability to customize the JIRA issue template directory and handle different JIRA project inheritance scenarios.
  4. Updating the Netsparker parser to improve date parsing and the handling of false positives and accepted risks.
  5. Enhancing the unit tests for the JIRA integration, parser functionality, and other security-related components of the application.

From an application security perspective, these changes demonstrate a focus on improving the overall security and reliability of the DefectDojo application. The introduction of the "enabled" field for JIRA projects, the robust error handling, and the comprehensive unit testing all contribute to a more secure and maintainable application.

Files Changed:

  1. dojo/db_migrations/0217_jira_project_enabled.py: Adds a new "enabled" field to the JIRA_Project model, allowing users to disable the JIRA integration for specific products.
  2. dojo/home/views.py: Updates the filtering of the "findings" queryset to use the "date" field instead of the "created" field.
  3. dojo/api_v2/views.py: Adds the "enabled" field as a filterable field in the JiraProjectViewSet.
  4. dojo/forms.py: Introduces new JIRA integration forms, including the ability to customize the JIRA issue template directory.
  5. dojo/jira_link/helper.py: Enhances the JIRA integration functionality, including handling disabled JIRA projects, updating issue status, and preventing pushing findings to disabled JIRA projects.
  6. dojo/jira_link/views.py: Reorganizes the JIRA configuration views and updates the webhook handling logic.
  7. dojo/jira_link/urls.py: Adds a new URL route for the "advanced" JIRA integration functionality.
  8. dojo/models.py: Adds the "enabled" field to the JIRA_Project model.
  9. dojo/tools/awssecurityhub/parser.py: Improves the handling of missing account IDs and different Security Hub report formats.
  10. dojo/tools/netsparker/parser.py: Enhances the date parsing and the handling of false positives and accepted risks for the Netsparker parser.
  11. Other files related to unit tests, documentation, and configuration updates.

Code Analysis

We ran 9 analyzers against 30 files and 3 analyzers had findings. 6 analyzers had no findings.

Analyzer Findings
Configured Codepaths Analyzer 16 findings
Authn/Authz Analyzer 5 findings
Sensitive Files Analyzer 2 findings

Riskiness

🔴 Risk threshold exceeded.

We've notified @mtesauro, @grendel513.

View PR in the DryRun Dashboard.

@github-actions GitHub Actions
Copy link
Contributor Author

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@github-actions GitHub Actions
Copy link
Contributor Author

Conflicts have been resolved. A maintainer will review the pull request shortly.

@github-actions github-actions bot added New Migration Adding a new migration file. Take care when merging. settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 unittests ui parser labels Oct 15, 2024
@github-actions github-actions bot added the helm label Oct 15, 2024
@rossops rossops merged commit aae3e7a into dev Oct 15, 2024
73 of 74 checks passed
@rossops rossops deleted the master-into-dev/2.39.1-2.40.0-dev branch October 15, 2024 16:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
apiv2 helm New Migration Adding a new migration file. Take care when merging. parser settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR ui unittests
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@rossops @Maffooch @hblankenship @manuel-sommer