Ruff: Add and fix S112, S311

[manuel-sommer]

No description provided.

[dryrunsecurity]

DryRun Security Summary

The pull request primarily focuses on updating the Ruff linter configuration to improve code quality and style, with a particular emphasis on exception handling and logging, and also includes changes to the tag management functionality in the DefectDojo application that warrant further review for potential security implications.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on updating the configuration for the Ruff linter, which is a Python linter that enforces code style and best practices. The key changes include the addition of new Ruff rules related to exception handling and the use of print() statements, as well as the addition of new rules to the ignore list.

From an application security perspective, the changes to the exception handling and logging-related rules are particularly interesting, as improper exception handling and excessive logging of sensitive information can lead to security vulnerabilities. The changes to the tag management functionality in the unittests/test_tags.py file also warrant further review, as the propagation of tags could potentially have security implications if not properly controlled and audited.

Overall, the changes in this pull request appear to be focused on improving the code quality and style of the project, which can indirectly improve the security of the application by reducing the likelihood of common coding errors and vulnerabilities. However, it's important to continue monitoring these changes and address any potential security concerns that may arise.

Files Changed:

1. ruff.toml: The changes in this file update the configuration for the Ruff linter, including the addition of new Ruff rules related to exception handling and the use of print() statements, as well as the addition of new rules to the ignore list.
2. unittests/test_tags.py: The changes in this file are focused on testing the tag management functionality in the DefectDojo application. While the changes do not appear to introduce any obvious security vulnerabilities, there are a few areas that could be worth further review, such as the handling of finding IDs, the handling of tags with special characters, and the propagation of tags from products to associated engagements, tests, and findings.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[manuel-sommer]

@mtesauro , I resolved the merge conflicts. Don't know why the conflict is still there. Could you retrigger the pipeline please?