Ruff: Add and fix Q000 #10095

kiblik · 2024-05-02T11:10:17Z

PEP8 was fixed last year but there was not linter checking new findings.
This should fix and help for the future.

https://docs.astral.sh/ruff/rules/#flake8-quotes-q

github-actions · 2024-05-02T22:24:02Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-05-03T06:45:55Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dryrunsecurity · 2024-05-03T06:46:58Z

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	5 findings
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	❕	48 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code changes cover a wide range of functionality within the Defect Dojo application, a web-based application vulnerability management tool. The changes span multiple modules, including the API, endpoint management, credential management, engagement management, finding management, and various utility functions.

Overall, the code changes demonstrate a strong focus on security, with a emphasis on implementing robust authorization and access control mechanisms, secure data handling, and performance optimizations. The use of Django's built-in security features, such as input validation and sanitization, as well as the extensive use of authorization decorators and custom permission checks, suggest that security is a key priority in the development of this application.

While the changes do not directly introduce any obvious security vulnerabilities, it is important to review the implementation details and the broader context of the application to ensure that there are no potential security risks or unintended consequences. This includes verifying the proper handling of sensitive data, the secure integration with external systems (e.g., JIRA), and the overall adherence to security best practices throughout the codebase.

Files Changed:

dojo/__init__.py: This file has been updated to reflect the latest version, project URL, and documentation URL for the Defect Dojo application.
.github/workflows/release-1-create-pr.yml: This GitHub Actions workflow is responsible for creating a pull request to merge a new release branch into the master branch, ensuring that the version numbers are consistently updated across the project.
dojo/admin.py: The changes update the admin interface for the AnswerParentAdmin model, modifying the display of certain fields.
.github/workflows/release-3-master-into-dev.yml: This workflow is responsible for creating pull requests to merge the changes from the master branch into the dev and bugfix branches, ensuring that the version numbers are properly updated.
dojo/api_v2/prefetch/schema.py: The changes in this file are related to the implementation of a prefetch functionality in the API version 2 of the Defect Dojo application.
dojo/apps.py: The changes in this file are focused on the integration of the Watson search engine and the configuration of various models for indexing and searching.
dojo/api_v2/views.py: The changes in this file are related to the configuration of the API documentation and the use of a custom renderer for the API responses.
dojo/api_v2/serializers.py: This file contains various serializers used throughout the Defect Dojo application, handling the serialization and deserialization of different models and data structures.
dojo/celery.py: The changes in this file are related to the configuration and setup of the Celery task queue system within the Django project.
dojo/components/views.py: The changes in this file are focused on the handling and display of software components within the application.
dojo/cred/queries.py: The changes in this file are related to the authorization and access control mechanisms for credential mappings in the application.
dojo/cred/urls.py: The changes in this file are a refactoring of the URL patterns for the credential management functionality.
dojo/development_environment/urls.py: The changes in this file are related to the URL patterns for the development environment management functionality.
dojo/decorators.py: The changes in this file introduce various decorator functions, including those related to asynchronous task handling, model conversion, exception handling, and rate limiting.
dojo/development_environment/views.py: The changes in this file are focused on the authorization and error handling aspects of the development environment management functionality.
dojo/cred/views.py: The changes in this file are related to the management of credentials, including their creation, editing, viewing, and deletion, as well as their association with various entities.
dojo/endpoint/queries.py: The changes in this file are focused on the authorization and access control mechanisms for retrieving authorized endpoints and endpoint statuses.
dojo/endpoint/urls.py: The changes in this file are primarily formatting and style updates to the URL patterns for the endpoint-related functionality.
dojo/endpoint/signals.py: The changes in this file are related to the handling of the post-delete signal for the Endpoint model, including audit logging and notification creation.
dojo/endpoint/utils.py:

Powered by DryRun Security

github-actions · 2024-05-04T00:44:52Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-05-04T08:55:32Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2024-05-06T17:22:31Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-05-06T18:02:11Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2024-05-07T07:48:24Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-07-08T17:02:12Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-07-08T17:19:15Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dryrunsecurity · 2024-07-08T18:48:55Z

DryRun Security Summary

The provided code changes cover a wide range of functionality within the Defect Dojo application, including updates to security, reliability, and maintainability, with a focus on improving authorization, input validation, logging, and management of findings, credentials, endpoints, and engagements.

Expand for full summary

Summary:

The provided code changes cover a wide range of functionality within the Defect Dojo application, including updates to the credential management, endpoint management, engagement management, finding management, and various other components. Overall, the changes appear to be focused on improving the security, reliability, and maintainability of the application.

Key security-related enhancements include:

Improved authorization and access control mechanisms to ensure that users can only perform actions they are authorized to do.
Enhanced input validation and sanitization to prevent common web application vulnerabilities, such as SQL injection and cross-site scripting (XSS).
Strengthened logging, auditing, and notification capabilities to improve security monitoring and incident response.
Careful handling of sensitive data, such as credentials and vulnerability IDs, to prevent unauthorized access or exposure.
Enhancements to the management of findings, including duplicate finding handling, vulnerability ID tracking, and integration with external systems like JIRA.

While the code changes do not appear to introduce any obvious security vulnerabilities, it's important to review the entire codebase and the application's architecture to ensure that there are no other potential security risks. Regular security assessments, penetration testing, and security monitoring are recommended to maintain the application's overall security posture.

Files Changed:

dojo/__init__.py: Minor updates to version numbers and project URLs.
.github/workflows/release-1-create-pr.yml: Workflow for creating a new release pull request.
.github/workflows/release-3-master-into-dev.yml: Workflow for merging the master branch into the dev and bugfix branches after a new release.
dojo/admin.py: Updates to the Django admin interface for the Engagement Surveys.
dojo/api_v2/prefetch/schema.py: Improvements to the API documentation generation process.
dojo/apps.py: Changes to the application configuration, including Watson search integration and configuration deduplication checks.
dojo/components/views.py: Updates to the components page functionality.
dojo/api_v2/serializers.py: Enhancements to the API serializers, including validation and handling of findings, vulnerability IDs, reimports, endpoints, questionnaires, and announcements.
dojo/cred/queries.py: Improvements to the authorized credential mappings retrieval.
dojo/cred/urls.py: Refactoring of the credential management URL patterns.
dojo/api_v2/views.py: Updates to the API version 2 views, including custom renderers, role management, group management, and various other functionality.
dojo/celery.py: Changes to the Celery configuration, including asynchronous task handling and rate limiting.
dojo/development_environment/urls.py: Minor updates to the development environment URL patterns.
dojo/cred/views.py: Enhancements to the credential management functionality, including encryption, authorization checks, and note management.
dojo/decorators.py: Implementation of asynchronous task handling and rate limiting.
dojo/endpoint/queries.py: Improvements to the authorized endpoints and endpoint statuses retrieval.
dojo/development_environment/views.py: Updates to the development environment management functionality, including authorization checks and input validation.
dojo/endpoint/urls.py: Minor formatting changes to the endpoint management URL patterns.
dojo/endpoint/signals.py: Addition of logging and notification functionality for endpoint deletion events.
dojo/endpoint/utils.py: Enhancements to the Endpoint management, including filtering, deduplication, and metadata import.
dojo/engagement/services.py: Updates to the engagement closing and reopening functionality.
dojo/engagement/queries.py: Improvements to the authorized engagements retrieval.
dojo/endpoint/views.py: Updates to the endpoint management functionality, including authorization checks, filtering, and bulk operations.
dojo/engagement/urls.py: Refactoring of the engagement-related URL patterns.
dojo/engagement/signals.py: Handling of engagement creation, status changes, and deletion events.
dojo/finding/helper.py: Enhancements to the finding management, including duplicate finding handling an

Code Analysis

We ran 7 analyzers against 30 files and 2 analyzers had findings. 5 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	5 findings
Authn/Authz Analyzer	52 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

github-actions · 2024-07-08T20:16:02Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-07-08T21:05:24Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2024-07-09T19:42:35Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-07-09T19:54:14Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

… kiuwan-sca # By dependabot[bot] (13) and others # Via GitHub * 'kiuwan-sca' of github.com:mwager/django-DefectDojo: (39 commits) Deprecate Python-jose and migrate okta to python_social_auth (DefectDojo#10117) fix: dockerfile warnings (DefectDojo#10505) Ruff: Add and fix Q000 (DefectDojo#10095) Fix(django): Upgrade of 4.2 (DefectDojo#10553) fix(deps): build python psycopg3 dependency instead of use the pre-build binary (DefectDojo#10491) Bump coverage from 7.5.4 to 7.6.0 (DefectDojo#10560) Bump asteval from 1.0.0 to 1.0.1 (DefectDojo#10561) Bump djangorestframework from 3.14.0 to 3.15.2 (DefectDojo#10431) Bump boto3 from 1.34.142 to 1.34.143 (DefectDojo#10558) Bump django-debug-toolbar from 4.4.5 to 4.4.6 (DefectDojo#10557) Bump boto3 from 1.34.141 to 1.34.142 (DefectDojo#10551) Bump packageurl-python from 0.15.2 to 0.15.3 (DefectDojo#10541) Bump boto3 from 1.34.140 to 1.34.141 (DefectDojo#10542) Update helm lock file Update versions in application files Update versions in application files API: Convert get_filterset calls to get_queryset (DefectDojo#10543) Bump django-debug-toolbar from 4.4.4 to 4.4.5 (DefectDojo#10527) Fix ruff Ruff fix ... # Conflicts: # dojo/settings/.settings.dist.py.sha256sum

github-actions bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 unittests integration_tests ui parser labels May 2, 2024

kiblik marked this pull request as ready for review May 2, 2024 14:29

github-actions bot added the conflicts-detected label May 2, 2024

kiblik force-pushed the ruff_q000 branch from 6b6aa8c to 8a9cdfa Compare May 3, 2024 06:45

github-actions bot removed the conflicts-detected label May 3, 2024

kiblik closed this May 3, 2024

kiblik reopened this May 3, 2024

github-actions bot added the conflicts-detected label May 4, 2024

kiblik force-pushed the ruff_q000 branch from 8a9cdfa to c4802f1 Compare May 4, 2024 08:55

github-actions bot removed the conflicts-detected label May 4, 2024

kiblik closed this May 4, 2024

kiblik reopened this May 4, 2024

github-actions bot added the conflicts-detected label May 6, 2024

kiblik force-pushed the ruff_q000 branch from c4802f1 to 72eaf6c Compare May 6, 2024 18:01

github-actions bot removed the conflicts-detected label May 6, 2024

github-actions bot added the conflicts-detected label May 7, 2024

kiblik force-pushed the ruff_q000 branch from 72eaf6c to dc18ab7 Compare May 7, 2024 19:59

kiblik force-pushed the ruff_q000 branch from fa6e1cf to a7dab27 Compare July 8, 2024 17:11

github-actions bot removed the conflicts-detected label Jul 8, 2024

kiblik closed this Jul 8, 2024

kiblik reopened this Jul 8, 2024

github-actions bot added the conflicts-detected label Jul 8, 2024

kiblik force-pushed the ruff_q000 branch from a7dab27 to 97ddee8 Compare July 8, 2024 20:41

github-actions bot added conflicts-detected and removed conflicts-detected labels Jul 8, 2024

kiblik added 4 commits July 9, 2024 21:53

Ruff: add Q000

acc9f07

Ruff: fix Q000

1051780

Adopt update script as wellAdopt update script as well

232fbb5

Update .settings.dist.py.sha256sum

edf2af3

kiblik force-pushed the ruff_q000 branch from 97ddee8 to edf2af3 Compare July 9, 2024 19:54

github-actions bot removed the conflicts-detected label Jul 9, 2024

kiblik closed this Jul 9, 2024

kiblik reopened this Jul 9, 2024

Maffooch approved these changes Jul 12, 2024

View reviewed changes

cneill approved these changes Jul 12, 2024

View reviewed changes

grendel513 approved these changes Jul 12, 2024

View reviewed changes

blakeaowens approved these changes Jul 12, 2024

View reviewed changes

mtesauro merged commit df280a6 into DefectDojo:dev Jul 12, 2024
236 of 237 checks passed

kiblik deleted the ruff_q000 branch July 12, 2024 22:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ruff: Add and fix Q000 #10095

Ruff: Add and fix Q000 #10095

kiblik commented May 2, 2024

github-actions bot commented May 2, 2024

github-actions bot commented May 3, 2024

dryrunsecurity bot commented May 3, 2024 •

edited

Loading

github-actions bot commented May 4, 2024

github-actions bot commented May 4, 2024

github-actions bot commented May 6, 2024

github-actions bot commented May 6, 2024

github-actions bot commented May 7, 2024

github-actions bot commented Jul 8, 2024

github-actions bot commented Jul 8, 2024

dryrunsecurity bot commented Jul 8, 2024 •

edited

Loading

github-actions bot commented Jul 8, 2024

github-actions bot commented Jul 8, 2024

github-actions bot commented Jul 9, 2024

github-actions bot commented Jul 9, 2024

Ruff: Add and fix Q000 #10095

Ruff: Add and fix Q000 #10095

Conversation

kiblik commented May 2, 2024

github-actions bot commented May 2, 2024

github-actions bot commented May 3, 2024

dryrunsecurity bot commented May 3, 2024 • edited Loading

github-actions bot commented May 4, 2024

github-actions bot commented May 4, 2024

github-actions bot commented May 6, 2024

github-actions bot commented May 6, 2024

github-actions bot commented May 7, 2024

github-actions bot commented Jul 8, 2024

github-actions bot commented Jul 8, 2024

dryrunsecurity bot commented Jul 8, 2024 • edited Loading

DryRun Security Summary

Code Analysis

Riskiness

github-actions bot commented Jul 8, 2024

github-actions bot commented Jul 8, 2024

github-actions bot commented Jul 9, 2024

github-actions bot commented Jul 9, 2024

dryrunsecurity bot commented May 3, 2024 •

edited

Loading

dryrunsecurity bot commented Jul 8, 2024 •

edited

Loading