Release: Merge release into master from: release/2.39.2

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

The GitHub pull request covers a wide range of updates to the DefectDojo application, including improvements to the initialization and setup process, documentation updates, dependency version updates, and enhancements to the import and parsing functionality, with a few areas requiring careful review and consideration, such as the removal of the order placement check, user input sanitization, hardcoded constants and external libraries, and dependency updates.

Expand for full summary

Summary:

The changes in this GitHub pull request cover a wide range of updates to the DefectDojo application, including improvements to the initialization and setup process, documentation updates, dependency version updates, and enhancements to the import and parsing functionality. From an application security perspective, the changes generally do not introduce any obvious security vulnerabilities, but there are a few areas that require careful review and consideration:

1. Removal of Order Placement Check: The changes in the Gift.php and GiftBlanket.php files remove the check for whether the customer has placed an order before. This could potentially allow the post-checkout ad to be displayed to customers who have not yet placed an order, which may have business and user experience implications that should be considered.

2. User Input Sanitization: The changes include updates to the PostCheckoutAd.php file, which uses a raw SQL query with user-supplied input. This could potentially lead to SQL injection vulnerabilities if the input is not properly sanitized. Additionally, the handling of tracking parameters and AB testing functionality should be reviewed to ensure that user input is properly validated.

3. Hardcoded Constants and External Libraries: The changes include the use of hardcoded constants and dependencies on external libraries, such as the JIRA webhook secret and the FpClient, FpEvent\FpEventABSKStore, and Common\FPCustomer libraries. These should be reviewed to ensure that they are properly defined, managed, and up-to-date to prevent potential security vulnerabilities.

4. Dependency Updates: The changes include updates to various dependencies, such as datatables.net, jquery, and pdfmake. It's important to review the release notes or change logs for these dependencies to ensure that any security vulnerabilities have been addressed in the new versions.

Files Changed:

1. docker/entrypoint-initializer.sh: This file has been updated to include the import of additional fixtures, update the JIRA webhook secret, and handle the audit log feature. The changes focus on improving the initialization and setup process, with a strong emphasis on security-related configurations and settings.

2. docs/content/en/getting_started/architecture.md: The documentation has been updated to clarify the use of Redis as the Message Broker for asynchronous task execution, and to provide a link to the Celery documentation.

3. components/package.json: The version of the "defectdojo" project has been updated from "2.39.1" to "2.39.2", which includes updates to several dependencies.

4. docs/content/en/integrations/importing.md: The documentation for the "Importing" feature has been updated, highlighting the auto-creation of entities, the reimport functionality, and the handling of triage-less scanners.

5. dojo/templatetags/display_tags.py: The vulnerability_url function has been updated to handle more complex URL structures defined in the VULNERABILITY_URLS setting.

6. dojo/fixtures/sla_configurations.json: New SLA configurations have been added, including a "Default" configuration and a "No SLA Enforced" configuration.

7. dojo/settings/.settings.dist.py.sha256sum: The SHA-256 hash value in this file has been updated, indicating a change in the settings.dist.py file, which should be reviewed for any potential security implications.

8. dojo/api_v2/serializers.py: The serializers used in the API version 2 have been refactored and updated to include new fields and options for the import process, with a focus on security-related validations.

9. dojo/settings/settings.dist.py: The saml2_attrib_map_format function has been updated to include a new mapping for the "ELSA" vulnerability ID type.

10. helm/defectdojo/Chart.yaml: The Helm chart for the DefectDojo application has been updated to version "1.6.155", reflecting changes to the underlying application.

11. dojo/tools/sonarqube/sonarqube_restapi_json.py: The code changes enhance the processing of the SonarQube API response, adding the file_path field and the cvssv3_score field to the Finding object.

12. dojo/__init__.py: The __version__ attribute has been updated from "2.39.1" to "2.39.

Code Analysis

We ran 9 analyzers against 13 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Configured Codepaths Analyzer	1 finding
Sensitive Files Analyzer	1 finding

Riskiness

🔴 Risk threshold exceeded.

We've notified @mtesauro, @grendel513.

View PR in the DryRun Dashboard.