Skip to content

Commit 28275d6

Browse files
rossopsrossops
authored
Merge pull request #14165 from DefectDojo/release/2.54.3
Release: Merge release into master from: release/2.54.3
2 parents 98f659b + 99f2846 commit 28275d6

File tree

13 files changed

+211
-34
lines changed

13 files changed

+211
-34
lines changed

‎components/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "defectdojo",
3-
"version": "2.54.2",
3+
"version": "2.54.3",
44
"license" : "BSD-3-Clause",
55
"private": true,
66
"dependencies": {

‎docs/content/en/changelog/changelog.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ For Open Source release notes, please see the [Releases page on GitHub](https://
1010

1111
## Jan 2025: v2.54
1212

13+
### Jan 20, 2025: v2.54.2
14+
15+
* **(Pro UI)** corrected a bug where unordered lists would display as ordered lists in editor forms.
16+
* **(Smart Upload)** introduced severity filtering to the Smart Importer to skip findings below a specified severity level. Added detailed logging throughout the findings processing to improve traceability and debugging.
17+
18+
### Jan 12, 2025: v2.54.1
19+
20+
* **(AI Tools)** added Risk Scores to schema for MCP processing.
21+
1322
### Jan 5, 2025: v2.54.0
1423

1524
No significant UX changes.

‎docs/content/en/open_source/upgrading/2.54.3.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: 'Upgrading to DefectDojo Version 2.54.3'
3+
toc_hide: true
4+
weight: -20250602
5+
description: Trivy parser deduplication
6+
---
7+
8+
## Trivy parser deduplication
9+
Deduplication of Trivy misconfiguration findings is improved for newly imported findings, but existing findings may no longer match because they don’t contain the new vulnerability_id or file_path fields.

‎dojo/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44
# Django starts so that shared_task will use this app.
55
from .celery import app as celery_app # noqa: F401
66

7-
__version__ = "2.54.2"
7+
__version__ = "2.54.3"
88
__url__ = "https://github.com/DefectDojo/django-DefectDojo" # noqa: RUF067
99
__docs__ = "https://documentation.defectdojo.com" # noqa: RUF067

‎dojo/forms.py‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -891,7 +891,7 @@ class EditRiskAcceptanceForm(forms.ModelForm):
891891
recommendation = forms.ChoiceField(choices=Risk_Acceptance.TREATMENT_CHOICES, initial=Risk_Acceptance.TREATMENT_ACCEPT, widget=forms.RadioSelect, label="Security Recommendation")
892892
decision = forms.ChoiceField(choices=Risk_Acceptance.TREATMENT_CHOICES, initial=Risk_Acceptance.TREATMENT_ACCEPT, widget=forms.RadioSelect)
893893

894-
path = forms.FileField(label="Proof", required=False, widget=forms.widgets.FileInput(attrs={"accept": ".jpg,.png,.pdf"}))
894+
path = forms.FileField(label="Proof", required=False, widget=forms.widgets.FileInput(attrs={"accept": ", ".join(settings.FILE_IMPORT_TYPES)}))
895895
expiration_date = forms.DateTimeField(required=False, widget=forms.TextInput(attrs={"class": "datepicker"}))
896896

897897
class Meta:
@@ -904,10 +904,20 @@ def __init__(self, *args, **kwargs):
904904
self.fields["expiration_date_warned"].disabled = True
905905
self.fields["expiration_date_handled"].disabled = True
906906

907+
def clean_path(self):
908+
if (data := self.cleaned_data.get("path")) is not None:
909+
ext = Path(data.name).suffix # [0] returns path+filename
910+
valid_extensions = settings.FILE_UPLOAD_TYPES
911+
if ext.lower() not in valid_extensions:
912+
if accepted_extensions := f"{', '.join(valid_extensions)}":
913+
msg = f"Unsupported extension. Supported extensions are as follows: {accepted_extensions}"
914+
else:
915+
msg = "File uploads are prohibited due to the list of acceptable file extensions being empty"
916+
raise ValidationError(msg)
917+
return data
918+
907919

908920
class RiskAcceptanceForm(EditRiskAcceptanceForm):
909-
# path = forms.FileField(label="Proof", required=False, widget=forms.widgets.FileInput(attrs={"accept": ".jpg,.png,.pdf"}))
910-
# expiration_date = forms.DateTimeField(required=False, widget=forms.TextInput(attrs={'class': 'datepicker'}))
911921
accepted_findings = forms.ModelMultipleChoiceField(
912922
queryset=Finding.objects.none(), required=True,
913923
widget=forms.widgets.SelectMultiple(attrs={"size": 10}),

‎dojo/settings/settings.dist.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -817,6 +817,25 @@ def generate_url(scheme, double_slashes, user, password, host, port, path, param
817817
SESSION_EXPIRE_AT_BROWSER_CLOSE = env("DD_SESSION_EXPIRE_AT_BROWSER_CLOSE")
818818
SESSION_EXPIRE_WARNING = env("DD_SESSION_EXPIRE_WARNING")
819819
SESSION_COOKIE_AGE = env("DD_SESSION_COOKIE_AGE")
820+
# Permission-Policy header settings
821+
# See docs at https://pypi.org/project/django-permissions-policy/
822+
PERMISSIONS_POLICY = {
823+
"accelerometer": [],
824+
"ambient-light-sensor": [],
825+
"autoplay": [],
826+
"camera": [],
827+
"display-capture": [],
828+
"encrypted-media": [],
829+
"fullscreen": [],
830+
"geolocation": [],
831+
"gyroscope": [],
832+
"interest-cohort": [],
833+
"magnetometer": [],
834+
"microphone": [],
835+
"midi": [],
836+
"payment": [],
837+
"usb": [],
838+
}
820839

821840
# ------------------------------------------------------------------------------
822841
# DEFECTDOJO SPECIFIC
@@ -966,6 +985,7 @@ def generate_url(scheme, double_slashes, user, password, host, port, path, param
966985
"django.contrib.sessions.middleware.SessionMiddleware",
967986
"django.middleware.csrf.CsrfViewMiddleware",
968987
"django.middleware.security.SecurityMiddleware",
988+
"django_permissions_policy.PermissionsPolicyMiddleware",
969989
"django.contrib.auth.middleware.AuthenticationMiddleware",
970990
"django.contrib.messages.middleware.MessageMiddleware",
971991
"django.middleware.clickjacking.XFrameOptionsMiddleware",

‎dojo/tools/trivy/parser.py‎

Lines changed: 25 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -335,52 +335,53 @@ def get_result_items(self, test, results, service_name=None, artifact_name=""):
335335

336336
misconfigurations = target_data.get("Misconfigurations", [])
337337
for misconfiguration in misconfigurations:
338+
misc_id = misconfiguration.get("ID", None)
339+
misc_avdid = misconfiguration.get("AVDID", misc_id)
340+
misc_title = misconfiguration.get("Title", "Unknown Misconfiguration")
338341
misc_type = misconfiguration.get("Type")
339-
misc_id = misconfiguration.get("ID")
340-
misc_title = misconfiguration.get("Title")
341-
misc_description = misconfiguration.get("Description")
342-
misc_message = misconfiguration.get("Message")
342+
misc_description = misconfiguration.get("Description", "")
343+
misc_message = misconfiguration.get("Message", "")
343344
misc_resolution = misconfiguration.get("Resolution")
344-
misc_severity = misconfiguration.get("Severity")
345+
misc_severity = misconfiguration.get("Severity", "Low")
345346
misc_primary_url = misconfiguration.get("PrimaryURL")
346347
misc_references = misconfiguration.get("References", [])
347-
misc_causemetadata = misconfiguration.get("CauseMetadata", {})
348-
misc_cause_code = misc_causemetadata.get("Code", {})
349-
misc_cause_lines = misc_cause_code.get("Lines", [])
350-
string_lines_table = self.get_lines_as_string_table(misc_cause_lines)
348+
causemeta = misconfiguration.get("CauseMetadata", {})
349+
cause_code = causemeta.get("Code", {})
350+
cause_lines = cause_code.get("Lines", [])
351+
string_lines_table = self.get_lines_as_string_table(cause_lines)
351352
if string_lines_table:
352-
misc_message += ("\n" + string_lines_table)
353-
354-
title = f"{misc_id} - {misc_title}"
353+
misc_message += "\n" + string_lines_table
355354
description = MISC_DESCRIPTION_TEMPLATE.format(
356355
target=target_target,
357356
type=misc_type,
358357
description=misc_description,
359358
message=misc_message,
360359
)
361-
severity = TRIVY_SEVERITIES[misc_severity]
362-
references = None
360+
refs = []
363361
if misc_primary_url:
364-
references = f"{misc_primary_url}\n"
365-
if misc_primary_url in misc_references:
366-
misc_references.remove(misc_primary_url)
367-
if references:
368-
references += "\n".join(misc_references)
369-
else:
370-
references = "\n".join(misc_references)
371-
362+
refs.append(misc_primary_url)
363+
refs.extend(r for r in misc_references if r != misc_primary_url)
364+
references = "\n".join(refs) if refs else None
365+
severity = TRIVY_SEVERITIES.get(misc_severity, "Info")
366+
file_path = target_target
372367
finding = Finding(
373368
test=test,
374-
title=title,
369+
title=f"{misc_id} - {misc_title}",
375370
severity=severity,
376-
references=references,
377371
description=description,
378372
mitigation=misc_resolution,
373+
references=references,
374+
url=misc_primary_url,
375+
file_path=file_path,
376+
impact=misc_description,
379377
fix_available=True,
380378
static_finding=True,
381379
dynamic_finding=False,
382380
service=service_name,
383381
)
382+
if misc_avdid:
383+
finding.unsaved_vulnerability_ids = []
384+
finding.unsaved_vulnerability_ids.append(misc_avdid)
384385
finding.unsaved_tags = [target_type, target_class]
385386
items.append(finding)
386387

‎helm/defectdojo/Chart.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v2
2-
appVersion: "2.54.2"
2+
appVersion: "2.54.3"
33
description: A Helm chart for Kubernetes to install DefectDojo
44
name: defectdojo
5-
version: 1.9.8
5+
version: 1.9.9
66
icon: https://defectdojo.com/hubfs/DefectDojo_favicon.png
77
maintainers:
88
- name: madchap
@@ -34,4 +34,4 @@ dependencies:
3434
# description: Critical bug
3535
annotations:
3636
artifacthub.io/prerelease: "false"
37-
artifacthub.io/changes: "- kind: changed\n description: Bump DefectDojo to 2.54.2\n"
37+
artifacthub.io/changes: "- kind: changed\n description: Bump DefectDojo to 2.54.3\n"

‎helm/defectdojo/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -511,7 +511,7 @@ The HELM schema will be generated for you.
511511
512512
# General information about chart values
513513
514-
![Version: 1.9.8](https://img.shields.io/badge/Version-1.9.8-informational?style=flat-square) ![AppVersion: 2.54.2](https://img.shields.io/badge/AppVersion-2.54.2-informational?style=flat-square)
514+
![Version: 1.9.9](https://img.shields.io/badge/Version-1.9.9-informational?style=flat-square) ![AppVersion: 2.54.3](https://img.shields.io/badge/AppVersion-2.54.3-informational?style=flat-square)
515515
516516
A Helm chart for Kubernetes to install DefectDojo
517517

‎requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ django-crispy-forms==2.5
1616
django_extensions==4.1
1717
django-slack==5.19.0
1818
django-watson==1.6.3
19+
django-permissions-policy==4.28.0
1920
django-prometheus==2.4.1
2021
Django==5.2.9
2122
django-single-session==0.2.0

0 commit comments

Comments
 (0)