Restrict JIRA finding-mapping project field to authorized projects - #15355
Open
svader0 wants to merge 2 commits into
Open
Restrict JIRA finding-mapping project field to authorized projects#15355svader0 wants to merge 2 commits into
svader0 wants to merge 2 commits into
Conversation
The project relation on the JIRA finding-mapping API is writable but was resolved from the full manager, so a create or update could reference a project the caller is not authorized for. Scope the field's queryset to the caller's authorized projects and add a regression test for create and update.
|
This pull request contains a critical finding where the file 'dojo/jira/api/serializers.py' was modified by an author not on the allowed list for this sensitive codepath. Although the issue is flagged as failing, it is not currently set to block the merge.
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/jira/api/serializers.py' matches configured sensitive codepath pattern 'dojo/jira/**/*.py' and was modified by '' (commit a95a3e0) who is not in the allowed authors list. |
We've notified @mtesauro.
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
The new test class loaded dojo_testdata.json directly, which fails to install when the locations feature flag is on. Apply the existing versioned_fixtures decorator so it picks the matching fixture, same as the neighbouring JIRA test classes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an authorization scope to the writable project field on the JIRA finding-mapping API so a mapping can only reference a JIRA project the caller is allowed to edit. Previously the field accepted any project id resolved from the full manager. Includes a regression test for create and update. No functional change for correctly-permissioned users.