Release: Merge release into master from: release/2.36.6

[github-actions]

Release triggered by Maffooch

[dryrunsecurity]

DryRun Security Summary

This pull request covers a wide range of updates to the DefectDojo application, including improvements to finding management, engagement handling, and various other modules, with a focus on enhancing the functionality, performance, and security of the application.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates to the DefectDojo application, including improvements to the finding management, engagement handling, and various other modules. The changes demonstrate a focus on enhancing the functionality, performance, and security of the application.

Key security-related improvements include:

1. Proper handling of note and history deletion to maintain data integrity.
2. Enhancements to the finding deduplication and merging functionality.
3. Improvements to the import and reimport processes to handle different types of scan reports.
4. Strengthening of the authorization and access control mechanisms.
5. Logging and monitoring improvements for better security visibility.

While the changes do not introduce any obvious security vulnerabilities, it's important to continue reviewing the entire codebase and the application's security posture to identify and address any potential issues. Ongoing security testing, dependency management, and security-focused code reviews are crucial to maintaining the overall security of the DefectDojo application.

Files Changed:

1. components/package.json: Update to the defectdojo package version from 2.36.5 to 2.36.6.
2. dojo/__init__.py: Update to the __version__ attribute to '2.36.6'.
3. dojo/benchmark/signals.py: Addition of a benchmark_product_pre_delete signal handler to delete associated notes when a Benchmark_Product is deleted.
4. dojo/api_v2/views.py: Refactoring of the download_file action to use a new generate_file_response utility function.
5. dojo/apps.py: Addition of new signal imports and setup of the Watson search engine integration.
6. dojo/components/views.py: Addition of a new "enable_table_filtering" context variable.
7. dojo/benchmark/views.py: Various updates to the benchmark-related functionality, including authorization checks and scoring calculations.
8. dojo/cred/signals.py: Addition of a cred_user_pre_delete signal handler to delete associated notes when a Cred_User is deleted.
9. dojo/db_migrations/0213_system_settings_enable_ui_table_based_searching.py: Addition of a new enable_ui_table_based_searching system setting.
10. dojo/cred/views.py: Updates to the credential management functionality, including the deletion of credentials.
11. dojo/engagement/signals.py: Addition of an engagement_pre_delete signal handler to delete associated notes.
12. dojo/engagement/views.py: Updates to the engagement-related functionality, including filtering and risk acceptance download.
13. dojo/finding/helper.py: Improvements to the finding deletion and duplicate management processes.
14. dojo/finding/views.py: Updates to the finding-related functionality, including JIRA integration, CWE template application, and bulk actions.
15. dojo/importers/default_importer.py and dojo/importers/base_importer.py: Enhancements to the import and reimport processes, including support for dynamic test types and asynchronous processing.
16. dojo/notes/signals.py: Addition of a note_pre_delete signal handler to delete associated note history.
17. dojo/notes/helper.py: Addition of a delete_related_notes function to handle the deletion of notes associated with an object.
18. dojo/risk_acceptance/helper.py: Removal of the code that deletes notes associated with a risk_acceptance object.
19. dojo/notes/views.py: Updates to the note management functionality, including the handling of Cred_User associated notes.
20. dojo/product/views.py: Addition of the "enable_table_filtering" context variable to various product-related views.
21. dojo/risk_acceptance/signals.py: Addition of a risk_acceptance_pre_delete signal handler to delete associated notes.
22. dojo/templates/dojo/engagement_pdf_report.html, dojo/templates/dojo/endpoint_pdf_report.html, and dojo/templates/dojo/custom_html_toc.html: Minor updates to the anchor generation logic in the PDF report templates.

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding
Authn/Authz Analyzer	13 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.5% Duplication on New Code

See analysis details on SonarCloud