Ruff: add PERF

[kiblik]

Add support for https://docs.astral.sh/ruff/rules/#perflint-perf in Ruff

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request focus on improving the functionality and efficiency of various parsers and deduplication mechanisms within the DefectDojo application security platform. The changes aim to enhance the accuracy and reliability of the vulnerability identification and management processes, without introducing any obvious security concerns.

Key changes include:

1. Simplifying and optimizing the parsing of scan results from tools like NPM Audit, Nuclei, Kiuwan, and Veracode SourceClear, using more concise and efficient code.
2. Improving the deduplication process by introducing new algorithms and the ability to configure deduplication based on the engagement settings.
3. Enhancing the handling of vulnerability details, such as extracting CVE IDs, mapping severity levels, and providing more comprehensive vulnerability descriptions.
4. Improving the logging and error handling capabilities to aid in debugging and troubleshooting.

Overall, the changes appear to be focused on improving the performance, maintainability, and security-related functionality of the DefectDojo application, which is an important tool for managing application security vulnerabilities.

Files Changed:

1. dojo/metrics/views.py: Optimized the view_engineer function by replacing for loops with list comprehensions and improving variable naming.
2. dojo/api_v2/serializers.py: Simplified the EngagementToFilesSerializer class by using list comprehensions.
3. docker/install_chrome_dependencies.py: Improved the handling of missing dependencies for the Google Chrome browser in a Docker environment.
4. dojo/models.py: Enhanced the deduplication functionality by allowing for configurable hash code fields and improved logging.
5. dojo/notes/views.py: Optimized the find_available_notetypes function by using a more concise approach.
6. dojo/search/views.py: Improved the handling of vulnerability IDs in search queries.
7. dojo/templatetags/display_tags.py: Simplified the additional_vulnerability_ids function.
8. dojo/tools/cobalt/parser.py: Optimized the performance of the CobaltParser class.
9. dojo/tools/drheader/parser.py: Refactored the get_findings method for improved readability.
10. dojo/tools/jfrog_xray_on_demand_binary_scan/parser.py: Simplified the get_item_set function.
11. dojo/tools/jfrogxray/parser.py: Improved the handling of CVE IDs and CVSS v3 scores.
12. dojo/tools/npm_audit/parser.py: Optimized the get_items function.
13. dojo/tools/factory.py: Optimized the get_scan_types_sorted and get_choices_sorted functions.
14. dojo/tools/npm_audit_7_plus/parser.py: Enhanced the handling of multiple vulnerabilities per item.
15. dojo/tools/nuclei/parser.py: Simplified the parsing of the Nuclei scan report.
16. dojo/tools/kiuwan/parser.py: Optimized the processing of the Kiuwan scan results.
17. dojo/tools/ort/parser.py: Refactored several functions for improved readability.
18. dojo/tools/openscap/parser.py: Implemented a secure and efficient Openscap vulnerability scan parser.
19. dojo/tools/veracode_sca/parser.py: Simplified the conversion of Veracode SourceClear scan data.
20. dojo/tools/solar_appscreener/parser.py: Optimized the processing of Solar Appscreener SAST scan results.
21. dojo/tools/whitehat_sentinel/parser.py: Improved the efficiency of the attack vector to endpoint conversion.
22. ruff.toml: Updated the Ruff linter configuration to include the "PERF" rule.
23. unittests/tools/test_aqua_parser.py: Simplified the unit test code for the AquaParser class.
24. dojo/utils.py: Introduced new deduplication algorithms and improved the deduplication handling.

Powered by DryRun Security

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[dryrunsecurity]

DryRun Security Summary

The pull request includes a wide range of improvements and optimizations across various components of the DefectDojo application, focusing on enhancing the parsing and processing of vulnerability data, improving the deduplication and handling of security findings, and optimizing the performance and readability of the codebase, while also addressing potential security considerations.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of improvements and optimizations across various components of the DefectDojo application. The changes focus on enhancing the parsing and processing of vulnerability data from different security scanning tools, improving the deduplication and handling of security findings, and optimizing the performance and readability of the codebase.

From an application security perspective, the changes do not introduce any obvious security vulnerabilities. The code modifications are primarily focused on improving the functionality, efficiency, and maintainability of the application, which can indirectly contribute to the overall security posture.

However, the review has identified a few areas that should be considered to ensure the continued security of the application:

1. Proper input validation and sanitization for user-provided data, such as CSV files and other external inputs, to prevent potential injection vulnerabilities.
2. Robust error handling and logging mechanisms to ensure that any issues or exceptions are properly reported and addressed.
3. Secure handling of sensitive data, such as personally identifiable information (PII) or confidential information, that may be present in the processed security data.
4. Ongoing monitoring and updating of external dependencies and libraries used by the application to address any known vulnerabilities.

Overall, the changes in this pull request appear to be well-designed and focused on improving the functionality and performance of the DefectDojo application. With the consideration of the security-related recommendations, the changes can be considered a positive contribution to the application's security posture.

Files Changed:

The files changed in this pull request cover a wide range of functionality, including:

1. docker/install_chrome_dependencies.py: Improvements to the handling of Chrome browser dependencies in a Docker environment.
2. dojo/metrics/views.py: Enhancements to the metrics functionality, including more detailed reporting and performance optimizations.
3. dojo/api_v2/serializers.py: Simplification of the EngagementToFilesSerializer class.
4. dojo/models.py: Improvements to the deduplication functionality for findings.
5. dojo/templatetags/display_tags.py: Simplification of the additional_vulnerability_ids function.
6. dojo/tools/*/parser.py: Updates and optimizations to various security tool parsers, such as Cobalt, JFrog Xray, Nuclei, and more.
7. dojo/utils.py: Refactoring and optimization of the deduplication logic.
8. unittests/tools/test_aqua_parser.py: Efficiency improvements to the Aqua parser test case.
9. dojo/notes/views.py: Simplification of the find_available_notetypes function.

Code Analysis

We ran 9 analyzers against 22 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[Maffooch]

It looks like there has not been any activity here for a while. In order to keep the list of pull requests in a manageable state, we are closing this one for now. If we are making a mistake here, please reopen the pull request, and leave us a note 😄