Bugfix -> Dev for 2.37.0

[Maffooch]

No description provided.

[dryrunsecurity]

DryRun Security Summary

The pull request includes various changes to the OWASP DefectDojo application, such as improvements to the report functionality, user interface, and unit testing, but also raises some security concerns related to potential sensitive information exposure, input sanitization, and the effectiveness of the reporting functionality.

Expand for full summary

Summary:

The code changes in this pull request cover various aspects of the OWASP DefectDojo application, including improvements to the report functionality, user interface, and unit testing. While the changes do not introduce any obvious security vulnerabilities, there are a few areas that warrant further review and consideration from an application security perspective.

1. Pagination and Sensitive Information Exposure: The changes to the report_endpoints.html template introduce pagination functionality, which could potentially expose sensitive information about the endpoints and associated findings if not properly secured.

2. Input Sanitization and CSRF Protection: The changes to the report_builder.html template include the use of jQuery's serializeArray() method to serialize form data, which helps with input sanitization. The inclusion of a CSRF token is also a positive security practice.

3. Sorting and Reporting Effectiveness: The changes to the report_findings.py file remove the sorting of findings by numerical severity, which could impact the effectiveness of the reporting functionality in highlighting the most critical vulnerabilities.

4. Filtering and Sorting Functionality: The changes to the filters.py file introduce new filtering and sorting capabilities, which should be thoroughly reviewed to ensure that the user input is properly sanitized and validated to prevent potential security issues.

5. Cosmetic Changes and Security Implications: The changes to the view_group.html, view_user.html, and bearer_cli_parser.py files are primarily cosmetic in nature and do not appear to introduce any immediate security concerns. However, it's important to ensure that these changes do not have any unintended consequences or impact the overall security of the application.

Files Changed:

1. dojo/templates/dojo/report_endpoints.html: This file has been updated to modify the pagination functionality for the list of endpoints. The changes should be reviewed to ensure that sensitive information is not exposed.

2. dojo/templates/dojo/report_builder.html: The changes in this file focus on improving the user interface and functionality of the report builder, including the use of CSRF protection and input sanitization.

3. dojo/reports/views.py: The changes in this file remove the sorting of findings by numerical severity, which could impact the effectiveness of the reporting functionality.

4. dojo/filters.py: The changes in this file introduce new filtering and sorting capabilities, which should be reviewed for potential security implications.

5. dojo/templates/dojo/report_findings.html: The changes in this file are minor and focused on UI improvements, without any apparent security concerns.

6. dojo/templates/dojo/view_group.html and dojo/templates/dojo/view_user.html: The changes in these files are primarily cosmetic and do not introduce any obvious security risks.

7. unittests/tools/test_bearer_cli_parser.py and dojo/tools/bearer_cli/parser.py: The changes in these files focus on improving the consistency and maintainability of the parser implementation, which is a positive step towards enhancing the overall security of the application.

Code Analysis

We ran 9 analyzers against 10 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.