Skip to content

Commit a8c5095

Browse files
rossopsrossops
authored
Merge pull request #12033 from DefectDojo/release/2.44.2
Release: Merge release into master from: release/2.44.2
2 parents c61f0a5 + 52d407a commit a8c5095

25 files changed

+2597
-583
lines changed

‎.github/ISSUE_TEMPLATE/feature_request.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ assignees: ''
88
---
99
## :warning: Note on feature completeness :warning:
1010

11-
We are narrowing the scope of acceptable enhancements to DefectDojo in preparation for v3. Learn more here:
11+
We are narrowing the scope of acceptable enhancements to DefectDojo. Learn more here:
1212
https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/CONTRIBUTING.md
1313

1414
**Is your feature request related to a problem? Please describe**

‎README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,8 @@ our channel there, [#defectdojo](https://owasp.slack.com/channels/defectdojo). F
107107

108108
## Contributing
109109

110-
:warning: We have instituted a [feature freeze](https://github.com/DefectDojo/django-DefectDojo/discussions/8002) on v2
111-
of DefectDojo as we begin work on v3. Please see our [contributing guidelines](readme-docs/CONTRIBUTING.md) for more
112-
information. Check out our latest update on v3 [here](https://github.com/DefectDojo/django-DefectDojo/discussions/11199).
110+
Please see our [contributing guidelines](readme-docs/CONTRIBUTING.md) for more
111+
information.
113112

114113
## Pro Edition
115114
[Upgrade to DefectDojo Pro](https://www.defectdojo.com/) today to take your DevSecOps to 11. DefectDojo Pro is

‎components/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "defectdojo",
3-
"version": "2.44.1",
3+
"version": "2.44.2",
44
"license" : "BSD-3-Clause",
55
"private": true,
66
"dependencies": {

‎docker/entrypoint-unit-tests-devDocker.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
# Run available unittests with a setup for local dev:
33
# - Make migrations and apply any needed changes
44
# - Leave container up after running tests to allow debugging, rerunning tests, etc.

‎docker/entrypoint-unit-tests.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22
# Run available unittests with a setup for CI/CD:
33
# - Fail if migrations are not created
44
# - Exit container after running tests to allow exit code to propagate as test result

‎docker/entrypoint-uwsgi-dev.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/bin/sh
1+
#!/bin/bash
22

33
set -e # needed to handle "exit" correctly
44

‎docker/entrypoint-uwsgi.sh

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
#!/bin/sh
2-
1+
#!/bin/bash
32
set -e # needed to handle "exit" correctly
43

54
. /secret-file-loader.sh

‎docs/content/en/open_source/archived_docs/integrations/source-code-repositories.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ For CI/CD Engagement, where user could set commit hash, branch/tag and code line
2929

3030
If user does not set commit hash or branch/tag in appropriate fields of CI/CD Engagement edit form, the URL should look like in Interactive Engagement edit form.
3131

32-
SCM navigation URL is composed from Repo URL using SCM Type. Github/Gitlab SCM type is default, but user could set certain SCM type in Product custom field "scm-type".
32+
SCM navigation URL is composed from Repo URL using SCM Type. A specific SCM type can be set in Product custom field "scm-type". If no "scm-type" is set and the URL contains "https://github.com", a "github" SCM type is assumed.
3333

3434
Product custom fields:
3535

‎docs/content/en/open_source/upgrading/2.42.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ exclude_search: true
99
**Hash Code changes**
1010
A few parsers have been updated to populate more fields. Some of these fields are part of the hash code calculation. To recalculate the hash code please execute the following command:
1111

12-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Horusec Scan" --hash_code_only`
13-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Qualys Hacker Guardian Scan --hash_code_only"`
14-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Red Hat Satellite --hash_code_only"`
12+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Horusec Scan' --hash_code_only"
13+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Qualys Hacker Guardian Scan' --hash_code_only"
14+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Red Hat Satellite' --hash_code_only"
1515

1616
This command has various command line arguments to tweak its behaviour, for example to trigger a run of the deduplication process.
1717
See [dedupe.py](https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/management/commands/dedupe.py) for more information.

‎docs/content/en/open_source/upgrading/2.43.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,11 @@ In the past, when DefectDojo supported different database and message brokers, `
3333

3434
The Rusty Hog parser has been [updated](https://github.com/DefectDojo/django-DefectDojo/pull/11433) to populate more fields. Some of these fields are part of the hash code calculation. To recalculate the hash code and deduplicate existing Rusty Hog findings, please execute the following command:
3535

36-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Essex Hog Scan (Rusty Hog Scan)" --hash_code_only`
37-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Essex Hog Scan (Choctaw Hog)" --hash_code_only`
38-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Essex Hog Scan (Duroc Hog)" --hash_code_only`
39-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Essex Hog Scan (Gottingen Hog)" --hash_code_only`
40-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Essex Hog Scan (Essex Hog)" --hash_code_only`
36+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Essex Hog Scan (Rusty Hog Scan)' --hash_code_only"
37+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Essex Hog Scan (Choctaw Hog)' --hash_code_only"
38+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Essex Hog Scan (Duroc Hog)' --hash_code_only"
39+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Essex Hog Scan (Gottingen Hog)' --hash_code_only"
40+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Essex Hog Scan (Essex Hog)' --hash_code_only"
4141

4242
This command has various command line arguments to tweak its behaviour, for example to trigger a run of the deduplication process.
4343
See [dedupe.py](https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/management/commands/dedupe.py) for more information.

‎docs/content/en/open_source/upgrading/2.44.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: 'Upgrading to DefectDojo Version 2.44.x'
2+
title: 'Upgrading to DefectDojo Version 2.44.0'
33
toc_hide: true
44
weight: -20250203
55
description: No special instructions.
@@ -9,7 +9,7 @@ description: No special instructions.
99

1010
The Burp parser now has a custom deduplication configuration to make deduplication more accurate. To recalculate the hash code and deduplicate existing Burp findings, please execute the following command:
1111

12-
`docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser "Burp Scan" --hash_code_only`
12+
docker compose exec uwsgi /bin/bash -c "python manage.py dedupe.py --parser 'Burp Scan' --hash_code_only"
1313

1414
This command has various command line arguments to tweak its behavior, for example to trigger a run of the deduplication process.
1515
See [dedupe.py](https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/management/commands/dedupe.py) for more information.

‎dojo/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44
# Django starts so that shared_task will use this app.
55
from .celery import app as celery_app # noqa: F401
66

7-
__version__ = "2.44.1"
7+
__version__ = "2.44.2"
88
__url__ = "https://github.com/DefectDojo/django-DefectDojo"
99
__docs__ = "https://documentation.defectdojo.com"

‎dojo/importers/default_reimporter.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,9 @@ def process_scan(
131131
self.test,
132132
updated_count,
133133
new_findings=new_findings,
134+
findings_reactivated=reactivated_findings,
134135
findings_mitigated=closed_findings,
136+
findings_untouched=untouched_findings,
135137
)
136138
# Update the test progress to reflect that the import has completed
137139
logger.debug("REIMPORT_SCAN: Updating Test progress")

‎dojo/settings/settings.dist.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1815,6 +1815,7 @@ def saml2_attrib_map_format(din):
18151815
"ELBA-": "https://linux.oracle.com/errata/&&.html", # e.g. https://linux.oracle.com/errata/ELBA-2024-7457.html
18161816
"ELSA-": "https://linux.oracle.com/errata/&&.html", # e.g. https://linux.oracle.com/errata/ELSA-2024-12714.html
18171817
"FEDORA-": "https://bodhi.fedoraproject.org/updates/", # e.g. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-06aa7dc422
1818+
"FG-IR-": "https://www.fortiguard.com/psirt/", # e.g. https://www.fortiguard.com/psirt/FG-IR-24-373
18181819
"GHSA-": "https://github.com/advisories/", # e.g. https://github.com/advisories/GHSA-58vj-cv5w-v4v6
18191820
"GLSA": "https://security.gentoo.org/", # e.g. https://security.gentoo.org/glsa/202409-32
18201821
"JSDSERVER-": "https://jira.atlassian.com/browse/", # e.g. https://jira.atlassian.com/browse/JSDSERVER-14872

‎dojo/templates/dojo/profile.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ <h3>{% blocktrans with full_name=user.get_full_name %} User Profile - {{ full_na
4646
<div class="clearfix">
4747
<h4 class="pull-left">{% trans "Groups" %}</h4>
4848
&nbsp;
49-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
49+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#group-memberships" target="_blank">
5050
<i class="fa-solid fa-circle-question"></i></a>
5151
{% if request.user.is_superuser %}
5252
<div class="dropdown pull-right">

‎dojo/templates/dojo/view_group.html

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ <h3 class="pull-left">Description</h3>
4545
<div class="clearfix">
4646
<h4 class="pull-left">Members of this Group</h4>
4747
&nbsp;
48-
<a href="https://documentation.defectdojo.com/usage/permissions/#groups" target="_blank">
48+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/create_user_group/#manage-a-groups-users" target="_blank">
4949
<i class="fa-solid fa-circle-question"></i></a>
5050
{% if group|has_object_permission:"Group_Manage_Members" %}
5151
<div class="dropdown pull-right">
@@ -118,7 +118,7 @@ <h4 class="pull-left">Members of this Group</h4>
118118
<div class="clearfix">
119119
<h4 class="pull-left">Product Types this Group can access</h4>
120120
&nbsp;
121-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
121+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/create_user_group/#add-product-roles-or-product-type-roles-for-a-group" target="_blank">
122122
<i class="fa-solid fa-circle-question"></i></a>
123123
{% if request.user.is_superuser %}
124124
<div class="dropdown pull-right">
@@ -192,7 +192,7 @@ <h4 class="pull-left">Product Types this Group can access</h4>
192192
<div class="clearfix">
193193
<h4 class="pull-left">Products this Group can access</h4>
194194
&nbsp;
195-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
195+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/create_user_group/#add-product-roles-or-product-type-roles-for-a-group" target="_blank">
196196
<i class="fa-solid fa-circle-question"></i></a>
197197
{% if request.user.is_superuser %}
198198
<div class="dropdown pull-right">

‎dojo/templates/dojo/view_product_details.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ <h3 class="panel-title"><span class ="fa-solid fa-scale-balanced" aria-hidden="t
277277
<div class="clearfix">
278278
<h4 class="pull-left">{% trans "Members" %}</h4>
279279
&nbsp;
280-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
280+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#productproduct-type-membership--roles" target="_blank">
281281
<i class="fa-solid fa-circle-question"></i></a>
282282
{% if prod|has_object_permission:"Product_Manage_Members" %}
283283
<div class="dropdown pull-right">
@@ -374,7 +374,7 @@ <h4 class="pull-left">{% trans "Members" %}</h4>
374374
<div class="clearfix">
375375
<h4 class="pull-left">{% trans "Groups" %}</h4>
376376
&nbsp;
377-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
377+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#group-memberships" target="_blank">
378378
<i class="fa-solid fa-circle-question"></i></a>
379379
{% if prod|has_object_permission:"Product_Group_Add" %}
380380
<div class="dropdown pull-right">

‎dojo/templates/dojo/view_product_type.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ <h4 class="pull-left">{% trans "Products" %}</h4>
135135
<div class="clearfix">
136136
<h4 class="pull-left">{% trans "Members" %}</h4>
137137
&nbsp;
138-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
138+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#productproduct-type-membership--roles" target="_blank">
139139
<i class="fa-solid fa-circle-question"></i></a>
140140
{% if pt|has_object_permission:"Product_Type_Manage_Members" %}
141141
<div class="dropdown pull-right">
@@ -216,7 +216,7 @@ <h4 class="pull-left">{% trans "Members" %}</h4>
216216
<div class="clearfix">
217217
<h4 class="pull-left">{% trans "Groups" %}</h4>
218218
&nbsp;
219-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
219+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#group-memberships" target="_blank">
220220
<i class="fa-solid fa-circle-question"></i></a>
221221
{% if pt|has_object_permission:"Product_Type_Group_Add" %}
222222
<div class="dropdown pull-right">

‎dojo/templates/dojo/view_user.html

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ <h4 class="pull-left">{% trans "Contact Information" %}</h4>
106106
<div class="clearfix">
107107
<h4 class="pull-left">{% trans "Product Types this User can access" %}</h4>
108108
&nbsp;
109-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
109+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#productproduct-type-membership--roles" target="_blank">
110110
<i class="fa-solid fa-circle-question"></i></a>
111111
{% if request.user.is_superuser %}
112112
<div class="dropdown pull-right">
@@ -179,7 +179,7 @@ <h4 class="pull-left">{% trans "Product Types this User can access" %}</h4>
179179
<div class="clearfix">
180180
<h4 class="pull-left">{% trans "Products this User can access" %}</h4>
181181
&nbsp;
182-
<a href="https://documentation.defectdojo.com/usage/permissions/" target="_blank">
182+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#productproduct-type-membership--roles" target="_blank">
183183
<i class="fa-solid fa-circle-question"></i></a>
184184
{% if request.user.is_superuser %}
185185
<div class="dropdown pull-right">
@@ -253,7 +253,7 @@ <h4 class="pull-left">{% trans "Products this User can access" %}</h4>
253253
<div class="clearfix">
254254
<h4 class="pull-left">{% trans "Groups this User is a member of" %}</h4>
255255
&nbsp;
256-
<a href="https://documentation.defectdojo.com/usage/permissions/#groups" target="_blank">
256+
<a href="https://docs.defectdojo.com/en/customize_dojo/user_management/about_perms_and_roles/#group-memberships" target="_blank">
257257
<i class="fa-solid fa-circle-question"></i></a>
258258
{% if request.user.is_superuser %}
259259
<div class="dropdown pull-right">

‎dojo/tools/openvas/csv_parser.py

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,9 @@ def __init__(self):
118118
def map_column_value(self, finding, column_value):
119119
if not finding.unsaved_endpoints[
120120
0
121-
].host: # process only if host is not already defined (by field hostname)
122-
finding.unsaved_endpoints[0].host = column_value
121+
].host and column_value is not None: # process only if host is not already defined (by field hostname)
122+
# strip due to https://github.com/greenbone/gvmd/issues/2378
123+
finding.unsaved_endpoints[0].host = column_value.strip()
123124

124125

125126
class HostnameColumnMappingStrategy(ColumnMappingStrategy):
@@ -129,7 +130,8 @@ def __init__(self):
129130

130131
def map_column_value(self, finding, column_value):
131132
if column_value: # do not override IP if hostname is empty
132-
finding.unsaved_endpoints[0].host = column_value
133+
# strip due to https://github.com/greenbone/gvmd/issues/2378
134+
finding.unsaved_endpoints[0].host = column_value.strip()
133135

134136

135137
class SeverityColumnMappingStrategy(ColumnMappingStrategy):
@@ -278,13 +280,21 @@ def get_findings(self, filename, test):
278280
finding = Finding(test=test)
279281
finding.unsaved_vulnerability_ids = []
280282
finding.unsaved_endpoints = [Endpoint()]
283+
ip = None
281284
if row_number == 0:
282285
column_names = self.read_column_names(row)
283286
continue
284287
for column_number, column in enumerate(row):
285288
chain.process_column(
286289
column_names[column_number], column, finding,
287290
)
291+
# due to the way this parser is implemented we have to do this stuff to retrieve a value for later use
292+
if column_names[column_number].lower() == "ip":
293+
ip = column
294+
295+
if ip:
296+
finding.description += f"\n**IP**: {ip}"
297+
288298
if finding is not None and row_number > 0:
289299
if finding.title is None:
290300
finding.title = ""

0 commit comments

Comments
 (0)