Fix for Findings count in Dashboard based on wrong date

[hblankenship]

[sc-7804]

Resolves issue 11000

The number of active findings in the last 7 days now uses the correct date instead of the created date.

[dryrunsecurity]

DryRun Security Summary

The code change in the dojo/home/views.py file involves modifying the findings.filter() calls to use the date__range parameter instead of created__date__range, suggesting a more appropriate filtering of findings based on their actual date for the dashboard.

Expand for full summary

Summary:

The code change in the dojo/home/views.py file appears to be a modification to the calculation of finding counts for the dashboard view. The change involves replacing the created__date__range parameter with date__range in the findings.filter() calls, suggesting that the original code was filtering findings based on the created date, which may not have accurately reflected the actual date range of interest for the dashboard. By switching to the date field, the code is now filtering findings based on their actual date, which is likely a more appropriate metric for the dashboard.

From an application security perspective, this change does not seem to introduce any immediate security concerns, as the code is primarily focused on data retrieval and presentation. However, it's important to review the implementation of the get_authorized_findings() function and the overall authorization logic to ensure that the application's access control mechanisms are properly enforced and do not introduce any security vulnerabilities. Additionally, the use of the timezone.now() function to obtain the current date may be susceptible to time-related vulnerabilities, and it's crucial to ensure that the application handles time-related operations securely and consistently across the codebase.

Files Changed:

• dojo/home/views.py: The code change in this file involves modifying the findings.filter() calls to use the date__range parameter instead of created__date__range. This change suggests that the original code was filtering findings based on the created date, which may not have accurately reflected the actual date range of interest for the dashboard. By switching to the date field, the code is now filtering findings based on their actual date, which is likely a more appropriate metric for the dashboard.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Fixes #11000

[mtesauro]

Approved