Release: Merge release into master from: release/3.1.300 - #15361
Merged
Conversation
…3.2.0-dev Release: Merge back 3.1.200 into bugfix from: master-into-bugfix/3.1.200-3.2.0-dev
july 17 docs maintenance
* docs(sensei): add Sensei chapter as its own top-level tab Document DefectDojo Pro's Sensei (AI scan-and-fix) feature as a new top-level docs tab with a multi-page chapter: - content/sensei/: About, Set Up, Fixing Findings, Reference (audience: pro) plus an Open Source "Pro-only feature" explainer (OS__sensei.md). - menus.en.toml: Sensei top-level tab + sidebar_sensei section menu. - params.toml: add "sensei" to doks.sectionNav so the chapter renders a left sidebar. - custom.js: generalize the edition-aware top-nav so the Sensei tab swaps between the OS explainer and the Pro guide (mirrors "Model Your Assets"). - pro_features.md: add a Sensei entry linking to the guide. - Screenshots captured from a DefectDojo-org demo repo (no internal repos). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(sensei): document GitLab connectivity and clean prose Add the GitLab portion of the Sensei docs alongside the existing GitHub content: a "Connect GitLab" section (access-token scopes/role, base URL, webhook setup), a provider note in About, and a "GitLab specifics" reference section (merge requests, commit-status gate, self-managed). Also remove em dashes and tidy phrasing across the Sensei chapter for a consistent, plain style. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: add Pro changelog entry for 3.1.200 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs: add Pro changelog entry for 3.1.202 Add a 3.1.202 entry above 3.1.200, covering only the changes not already documented in the 3.1.200 entry. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…se fields, push filters) (#15298) * docs(integrators): refresh ServiceNow guide — OAuth (Zurich + legacy), close fields, push filters [sc-13803] - Instance Setup now covers both auth paths: ServiceNow Zurich+ (New Inbound Integration Experience -> OAuth client-credentials grant, with an OAuth Application User) and earlier releases (the legacy App Registry + refresh token). ServiceNow deprecated the classic 'Create an OAuth API endpoint for external clients' option our guide relied on. Also fixes the duplicated 'Client ID' field label (the second one is the Client Secret). - New 'Close and resolution fields' section documenting the apply_on custom field recipe for instances whose data policy makes the Resolution code mandatory on close (the 403 'Data Policy Exception'), with a worked example and the reserved-field / sys_id notes. - integrations.md documents the new per-assignment push filters (minimum severity, active-only) and the one-assignment-per-asset guidance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(servicenow): document custom numeric state values in the status mapping Customized instances (and non-incident tables) use state values outside the standard set. Documents that numeric values pass through as configured, and that the built-in Resolution-code default only accompanies standard resolved/closed states - custom values pair with the close/resolution field mappings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(servicenow): transition timing, JSON value coercion, and custom-table state caveats Documents when transition mappings actually fire (state changes only - one journal entry per transition), the JSON typing of mapping values including the null-clears-field behavior and quoting escape, and the Incident-semantics caveat for standard state values on non-incident tables. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…r API (#15296) Assigning or changing a user's configuration permissions through the user API is now limited to superusers, matching how the serializer already treats the other privilege-bearing fields (staff and superuser status). Adds a regression test. No functional change for superusers. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a Sonatype IQ (Nexus Lifecycle) section to the connectors tool reference: prerequisites (View IQ Elements permission, user token, on-prem/SaaS base URLs) and connector mappings (Location, Username, User Token, Stage, Minimum Severity). Pairs with connector DefectDojo-Inc/connectors#712 and DD Pro registration DefectDojo-Inc/dojo-pro#1905. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Document the new Kubescape connector on the Pro connectors reference: it reads the Kubescape operator's in-cluster posture results (WorkloadConfigurationScan objects, spdx.softwarecomposition.kubescape.io) via the Kubernetes API — no ARMO SaaS account required — mapping each namespace to a Product and each failed control to a Finding. Adds it to the tool reference and the supported-connectors list. Story: sc-13764
Document the new Intruder.io connector on the Pro connectors reference: it uses the Intruder REST API (Bearer access token) to pull the whole account's posture — targets -> issues -> occurrences — mapping each target to a Product and each occurrence to a Finding. Add it to the tool reference and the supported-connectors list. Story: sc-13768
Document the runZero asset / attack-surface connector: prerequisites (XT Export Token, community tier), the Location/Secret/Import-Vulnerabilities/ Minimum-Severity mappings, the whole-org asset -> Record model (site becomes Product Type), and the optional vulnerability -> finding import. Companion to connectors#732 and dojo-pro#1939. sc-13774 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The open-source "Go Pro" promo banner (data-source="os") renders from identical markup in both the classic (Bootstrap) and Tailwind base templates, but the classic stylesheet was missing the OS-banner-specific CSS the Tailwind stylesheet already had. As a result the dismiss control fell back to a bulky default browser button and the banner row was not laid out consistently. Port the same OS-banner block into classic/dojo.css so both UIs render the banner identically: a single centered row (dismiss ×, headline, expand caret) with a compact bordered dismiss button, and the expanded message dropping to its own full-width row. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
) These are live in the production Pro connector/integration catalog but had no reference docs. Adds a Bugcrowd finding-connector section and a ServiceNow CMDB asset-connector section to the connectors tool reference, and a Linear section to the downstream integrators reference (plus the two integrations.md index lists). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Setup and usage for the Sysdig Secure connector: API token from Settings, region/base URL Location, connector field mappings (scopes + runtime product grouping), and import behavior (whole-account sync; runtime findings dynamic + k8s-tagged, registry/pipeline static; NEGLIGIBLE -> Info). Placed alphabetically between Snyk and Tenable. Story: sc-13726
Setup and usage for the Acunetix 360 connector: API User ID + API Token (HTTP Basic) from the account API Settings page, the cloud Location, connector field mappings, and import behavior (one Record per scanned website; findings from the latest completed scan; accepted-risk / false-positive imported but flagged inactive). Distinguishes the cloud product from the on-prem Acunetix Standard scanner. Placed first (alphabetical). Story: sc-13709
…#15195) In every *_pdf_report.html template the Executive-Summary charts render from a jQuery ready handler, while the table-of-contents builder runs on window.onload and reassigns #contents.innerHTML. The chart containers live inside #contents, so whenever the charts paint before the TOC rebuild, the innerHTML round-trip re-parses the subtree and silently discards the painted canvases (Chart.js instances in the new UI, Flot canvases in the classic UI), leaving blank chart boxes with no console error. The two orderings race each other: on a warm local cache the async ready callback can land after onload and the charts survive, but with realistic network latency the charts paint first and are destroyed. The symptom was reported as far back as #2294 and #3253 (2020, Flot era) and never fixed - both were auto-closed by the stale bot. Wrap the chart rendering in renderReportCharts() in all seven report templates (engagement, product, product type, test, endpoint, finding, product endpoint) in both template trees (dojo/templates and dojo/templates_classic) and invoke it after the TOC builder has finished (or on a ready handler when the TOC is disabled), so the charts are always created into the final DOM. In five of the seven templates (product, test, endpoint, finding, product endpoint) the window.onload TOC builder was also missing the {% if include_table_of_contents %} guard the other templates have, so it ran even with the table of contents disabled. Because the #contents wrapper is itself rendered only when the TOC is enabled, the ungated handler dereferences a null #contents on its first line and throws an uncaught TypeError before it can rewrite anything (the finding template null-checks #contents and stays silent) - so the charts survive in that configuration, but every such report logs a console error. Those five now carry the same guard as their siblings, so the handler is not emitted when the TOC is off. In the test template the chart code was split between a ready handler and top-level script code; both pieces are consolidated into renderReportCharts() preserving their order, and its call sites stay inside {% if include_executive_summary %} because the function definition is only rendered with the executive summary. Add a regression assertion to the Selenium report tests that the summary charts end up painted when executive summary and table of contents are enabled together (factored into a helper and applied to the product type, product, engagement, test, and product-endpoint report tests). The check is chart-library agnostic (painted canvas pixels), so it holds on both the Chart.js and classic Flot report pages. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…15300) Hardening to object-level authorization on several API and UI write paths that associate locations and endpoints with findings and products. These paths now restrict the selectable references to the objects the requesting user is authorized for, matching the scoping the UI forms and dedicated viewsets already apply. Adds regression tests. No functional change for correctly-permissioned users.
The bundled PostgreSQL server is 18.x, but the client tools shipped in the images lagged behind (Debian: 17, Alpine/nginx: 16). pg_dump refuses to dump a server newer than itself, so `manage.py dbbackup` failed with "aborting because of server version mismatch". Align the client to the server (v18): - Alpine images: bump base to alpine3.23 and use postgresql18-client (18 is not available in the alpine3.22 repos). - Debian image: add the PostgreSQL APT (PGDG) repository and install postgresql-client-18 (Debian trixie only ships v17). Fixes #15301
* change fortify parser to prefer true line * create v2 scan
Notes get added to a test through the notes endpoint, not when you create the test. The finding create serializer already keeps notes read-only, so this does the same for tests. Added a regression test.
Document the Quay container-registry connector: prerequisites (OAuth token, Clair enabled), the Location/Secret/Namespace/Minimum-Severity mappings, and the repository -> Record + Clair-report -> finding model (manifest dedupe, skip-unscanned, Negligible/Unknown -> Informational). Companion to connectors#729 and dojo-pro#1936. sc-13766 Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
* perf(migration): batch endpoint tags and restore inheritance * test(migration): avoid relying on endpoint row order
…ty_id (#15218) Index UPPER(vulnerability_id), finding_id on dojo_vulnerability_id so CVE-keyed lookups (enrichment, exploit/threat-intel matching, dedupe helpers) stop sequentially scanning the table; scanner-supplied ids are not case-normalized, so the index and any query both fold with UPPER(). finding_id is included so changed-CVE -> finding fan-out is an index-only scan. Built CONCURRENTLY IF NOT EXISTS (non-atomic migration) via SeparateDatabaseAndState so it does not lock the table on large instances and is idempotent. Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Setup and usage for the Black Duck SCA connector: API token (exchanged for a short-lived bearer) from My Access Tokens, the hub Location, connector field mappings, and import behavior (one Record per project; findings from the project's released version's vulnerable BOM components). Placed alphabetically between Backstage and Bitbucket. Story: sc-13723
… connections (#15349) Extend the Sensei docs for the new self-hosted-scanning SCM providers: - setup_sensei.md: "Choose a source-control provider" section + the four per-provider connect flows (GitHub / GitHub Enterprise Server / GitLab / Bitbucket / Azure DevOps) in the existing Step-1/2/3 style, with per-provider specifics. Refreshed the Connections-table description (Installs column removed; multi-provider). - sensei_reference.md: per-provider auth/webhook specifics blocks and generalized troubleshooting. - about_sensei.md: intro/prerequisites updated for the broader provider set. - images: refreshed connections.png (multi-provider table) and added setup_providers.png (the source-control chooser + GitHub host / GHES field).
Document the NeuVector connector: the controller username/password prerequisite, the Location/Username/Password/Skip-TLS/Minimum-Severity mappings, and the whole-controller image -> Record + CVE -> finding model (severity, package/version, CVSSv3, fix, dedupe key). Companion to connectors#757 and dojo-pro#2007. sc-13905 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Adds a tool-reference entry for the GitHub asset connector, which imports GitHub repositories as Assets via the GitHub GraphQL API (repository metadata only). Distinguishes it from the existing GitHub Advanced Security connector, which imports security alerts as findings. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…5191) Only superusers may change the username or email of another account. Prevents account takeover via changing a victim's email then triggering password reset. Users may still edit their own identity fields. Config-permission guards already landed via #15296; this adds the remaining identity-field guard PR #15191 intended. Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DefectDojo Pro can now build roles from individual permissions, with the five built-in roles becoming locked, clonable presets. Document that, and correct the existing role docs that describe the five roles as the whole model. - Add admin/user_management/PRO__custom_rbac_roles.md: enabling the feature, who can manage roles, the Roles table, cloning vs starting from scratch, all four permission groups, the grid legend and the View/Manage gate rule, assignment surfaces, how custom global roles map onto the built-in tiers, role history, and the API. - Reframe the built-in roles as locked presets in the permissions overview and the permission charts, and document the union rule for a user holding more than one role on the same object. - Link the new page from the User Management section index.
…behavior (#15347) Documents the opt-in artifact-level record granularity (one record per first-level entry under a repository), automatic parent/child asset-hierarchy relationships, the mode-switch runbook in both directions, and corrects the sync description: every sync generates a complete per-repository report (the previous text described incremental delta reports, which the connector does not do). Co-authored-by: devGregA <greg-agent-2@defectdojo.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…#15360) The v3_relabel feature moved from environment-driven to DB-backed and self-serve, but the docs still described the old behavior. Three places were stale: * The Feature availability table listed relabeling as controlled by "Deployment configuration: DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL". That table exists to list exceptions to the self-serve rule, and relabeling is no longer one, so the row is removed. Its facts (on by default, plus which surfaces the toggle governs) move into a new "Organization / Asset Relabeling" subsection next to the toggle instructions. * The "Managed by deployment" example used relabeling, which is no longer env-managed. Swapped to DD_V3_FEATURE_LOCATIONS, which is genuinely source=env with a restart-required warning. The DD_ prefix matches what the Feature Flags page renders. * The asset hierarchy page told on-premise users to set the env var and restart, and Cloud users to email Support. It now documents both controls and what each one covers. The toggle governs the Pro UI only. The Classic UI labels, its URLs, and generated reports read DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL at process start, and no restart makes the toggle reach them: those branches live in dojo/asset/labels.py, dojo/organization/labels.py, dojo/asset/urls.py, dojo/organization/urls.py, dojo/metrics/urls.py, dojo/system_settings/labels.py, and dojo/reports/ui/urls.py, and the setting is only ever assigned from the environment in settings.dist.py. Verified by forcing the env var and the DB flag to disagree in a running instance: OSS labels followed the environment while only Pro's overlay followed the database. Also corrects two adjacent stale claims on the hierarchy page: the name change is on by default as of 3.0 rather than opt-in, and the two hierarchy pieces are still enabled by different means. Co-authored-by: Claude <noreply@anthropic.com>
github-actions
Bot
added
docker
New Migration
|
This pull request contains critical security findings because multiple sensitive codepaths in the
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/api_v2/serializers.py' matches configured sensitive codepath pattern 'dojo/api_v2/*.py' and was modified by 'svader0' (commit 3f2ebcf) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/product_endpoint_pdf_report.html (drs_915c790f)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/product_endpoint_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/endpoint_pdf_report.html (drs_af020da9)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/endpoint_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/engagement_pdf_report.html (drs_b762ff1d)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/engagement_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/finding_pdf_report.html (drs_c1d3718d)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/finding_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/test_pdf_report.html (drs_c43a8ec7)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/test_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/product_pdf_report.html (drs_e58d20d8)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/product_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/product_type_pdf_report.html (drs_fa8c8231)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/product_type_pdf_report.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'stevewallone' (commit e67e8fa) who is not in the allowed authors list. |
We've notified @mtesauro.
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release triggered by
rossops