Merge branch 'bugfix' into docs-hierarchy

paulOsinski · web-flow · commit 265b296845be · 2025-12-08T13:12:58.000-05:00
diff --git a/.github/workflows/test-helm-chart.yml b/.github/workflows/test-helm-chart.yml
@@ -47,26 +47,26 @@ jobs:
           fi
 
       - name: Run chart-testing (list-changed)
-        id: list-changed
+        id: list_changed
         run: |
           changed=$(ct list-changed --config ct.yaml --target-branch ${{ env.ct-branch}})
           if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_ENV
+            echo "changed=true" >> $GITHUB_OUTPUT
           fi
 
       # run version check only if not dev as in dev we have a `x.y.z-dev` version
       # x.y.z gets bumped automatically when doing a release
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml --target-branch ${{ env.ct-branch }} --check-version-increment=true
-        if: ${{ env.changed == 'true' && env.ct-branch != 'dev' && env.ct-branch != 'bugfix' }}
+        if: ${{ steps.list_changed.outputs.changed == 'true' && env.ct-branch != 'dev' && env.ct-branch != 'bugfix' }}
 
       # run all checks but version increment always when something changed
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml --target-branch ${{ env.ct-branch }} --check-version-increment=false
-        if: env.changed == 'true'
+        if: steps.list_changed.outputs.changed == 'true'
 
       - name: Check update of "artifacthub.io/changes" HELM annotation
-        if: ${{ env.changed == 'true' && !(startsWith(github.head_ref, 'master-into-dev/') || startsWith(github.head_ref, 'master-into-bugfix/')) }}
+        if: ${{ steps.list_changed.outputs.changed == 'true' && !(startsWith(github.head_ref, 'master-into-dev/') || startsWith(github.head_ref, 'master-into-bugfix/')) }}
         run: |
           # fast fail if `git show` fails
           set -e
@@ -95,11 +95,11 @@ jobs:
 
       # - name: Create kind cluster
       #  uses: helm/kind-action@v1.1.0
-      #  if: env.changed == 'true'
+      #  if: steps.list_changed.outputs.changed == 'true'
 
       # - name: Run chart-testing (install)
       #   run: ct install --config ct.yaml --target-branch ${{ env.ct-branch }} --helm-extra-args '--set createSecret=true --set createRabbitMqSecret=true --set createPostgresqlSecret=true --set timeout=900'
-      #  if: env.changed == 'true'
+      #  if: steps.list_changed.outputs.changed == 'true'
 
   docs_generation:
     name: Update documentation
diff --git a/dojo/__init__.py b/dojo/__init__.py
@@ -4,6 +4,6 @@
 # Django starts so that shared_task will use this app.
 from .celery import app as celery_app  # noqa: F401
 
-__version__ = "2.53.0"
+__version__ = "2.53.1"
 __url__ = "https://github.com/DefectDojo/django-DefectDojo"
 __docs__ = "https://documentation.defectdojo.com"
diff --git a/dojo/authorization/authorization.py b/dojo/authorization/authorization.py
@@ -100,7 +100,9 @@ def user_has_permission(user, obj, permission):
         isinstance(obj, Risk_Acceptance)
         and permission == Permissions.Risk_Acceptance
     ):
-        return user_has_permission(user, obj.engagement.product, permission)
+        if obj.engagement is not None:
+            return user_has_permission(user, obj.engagement.product, permission)
+        return user_has_global_permission(user, permission)
     if ((
         isinstance(obj, Finding | Stub_Finding)
     ) and permission in Permissions.get_finding_permissions()) or (
diff --git a/dojo/templates/dojo/findings_list_snippet.html b/dojo/templates/dojo/findings_list_snippet.html
@@ -913,6 +913,7 @@ <h3 class="has-filters">
                         );
                     },
                     colReorder: true,
+                    autoWidth: false,
                     "columns": columns,
                     ordering: true,
                     order: [],
diff --git a/dojo/tools/legitify/parser.py b/dojo/tools/legitify/parser.py
@@ -53,16 +53,21 @@ def get_findings(self, file, test):
                         endpoints.add(Endpoint.from_uri(url))
 
             if is_finding:
+                remediation_steps = policy_info.get("remediationSteps", [])
+                fix_available = False
+                if remediation_steps:
+                    fix_available = True
                 finding = Finding(
                     description=policy_info.get("description", ""),
                     dynamic_finding=False,
                     impact="\n".join(policy_info.get("threat", [])),
-                    mitigation="\n".join(policy_info.get("remediationSteps", [])),
+                    mitigation="\n".join(remediation_steps),
                     references="\n".join(references),
                     severity=self.severity_mapper(policy_info.get("severity", "LOW")),
                     static_finding=True,
                     title=f'{policy_info.get("namespace", "").capitalize()} | {policy_info.get("title", "")}',
                     vuln_id_from_tool=policy_info.get("policyName", None),
+                    fix_available=fix_available,
                 )
                 finding.unsaved_endpoints = list(endpoints)
                 findings.append(finding)
diff --git a/helm/defectdojo/Chart.yaml b/helm/defectdojo/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 appVersion: "2.54.0-dev"
 description: A Helm chart for Kubernetes to install DefectDojo
 name: defectdojo
-version: 1.9.1-dev
+version: 1.9.2-dev
 icon: https://defectdojo.com/hubfs/DefectDojo_favicon.png
 maintainers:
   - name: madchap
diff --git a/helm/defectdojo/README.md b/helm/defectdojo/README.md
@@ -511,7 +511,7 @@ The HELM schema will be generated for you.
 
 # General information about chart values
 
-![Version: 1.9.1-dev](https://img.shields.io/badge/Version-1.9.1--dev-informational?style=flat-square) ![AppVersion: 2.54.0-dev](https://img.shields.io/badge/AppVersion-2.54.0--dev-informational?style=flat-square)
+![Version: 1.9.2-dev](https://img.shields.io/badge/Version-1.9.2--dev-informational?style=flat-square) ![AppVersion: 2.54.0-dev](https://img.shields.io/badge/AppVersion-2.54.0--dev-informational?style=flat-square)
 
 A Helm chart for Kubernetes to install DefectDojo
 
@@ -623,7 +623,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | django.ingress.enabled | bool | `true` |  |
 | django.ingress.ingressClassName | string | `""` |  |
 | django.ingress.secretName | string | `"defectdojo-tls"` |  |
-| django.mediaPersistentVolume | object | `{"enabled":true,"fsGroup":1001,"name":"media","persistentVolumeClaim":{"accessModes":["ReadWriteMany"],"create":false,"name":"","size":"5Gi","storageClassName":""},"type":"emptyDir"}` | This feature needs more preparation before can be enabled, please visit KUBERNETES.md#media-persistent-volume |
+| django.mediaPersistentVolume | object | `{"enabled":true,"name":"media","persistentVolumeClaim":{"accessModes":["ReadWriteMany"],"create":false,"name":"","size":"5Gi","storageClassName":""},"type":"emptyDir"}` | This feature needs more preparation before can be enabled, please visit KUBERNETES.md#media-persistent-volume |
 | django.mediaPersistentVolume.name | string | `"media"` | any name |
 | django.mediaPersistentVolume.persistentVolumeClaim | object | `{"accessModes":["ReadWriteMany"],"create":false,"name":"","size":"5Gi","storageClassName":""}` | in case if pvc specified, should point to the already existing pvc |
 | django.mediaPersistentVolume.persistentVolumeClaim.accessModes | list | `["ReadWriteMany"]` | check KUBERNETES.md doc first for option to choose |
diff --git a/helm/defectdojo/values.schema.json b/helm/defectdojo/values.schema.json
@@ -539,9 +539,6 @@
                         "enabled": {
                             "type": "boolean"
                         },
-                        "fsGroup": {
-                            "type": "integer"
-                        },
                         "name": {
                             "description": "any name",
                             "type": "string"
diff --git a/helm/defectdojo/values.yaml b/helm/defectdojo/values.yaml
@@ -495,7 +495,6 @@ django:
   # -- This feature needs more preparation before can be enabled, please visit KUBERNETES.md#media-persistent-volume
   mediaPersistentVolume:
     enabled: true
-    fsGroup: 1001
     # -- any name
     name: media
     # -- could be emptyDir (not for production) or pvc
diff --git a/requirements.txt b/requirements.txt
@@ -18,7 +18,7 @@ django_extensions==4.1
 django-slack==5.19.0
 django-watson==1.6.3
 django-prometheus==2.4.1
-Django==5.1.14
+Django==5.1.15
 django-single-session==0.2.0
 djangorestframework==3.16.1
 html2text==2025.4.15
@@ -35,7 +35,7 @@ python-dateutil==2.9.0.post0
 redis==7.1.0
 requests==2.32.5
 sqlalchemy==2.0.44  # Required by Celery broker transport
-urllib3==2.5.0
+urllib3==2.6.0
 uWSGI==2.0.31
 vobject==0.9.9
 whitenoise==5.2.0
diff --git a/unittests/scans/whispers/empty_with_error.json b/unittests/scans/whispers/empty_with_error.json
@@ -1 +1 @@
-[]
+[]
diff --git a/unittests/scans/whispers/whispers_many_vul.json b/unittests/scans/whispers/whispers_many_vul.json
@@ -1 +1,47 @@
-[{"key": "01_static_password", "value": "hardcoded0", "file": "src/config.yml", "line": 12, "rule_id": "password", "message": "Password", "severity": "CRITICAL"}, {"key": "02_static_passwords", "value": "Hardcoded1", "file": "src/config.yml", "line": 14, "rule_id": "password", "message": "Password", "severity": "CRITICAL"}, {"key": "02_static_passwords", "value": "hardCoded2", "file": "src/config.yml", "line": 15, "rule_id": "password", "message": "Password", "severity": "CRITICAL"}, {"key": "02_static_passwords", "value": "haRdcOded3", "file": "src/config.yml", "line": 16, "rule_id": "password", "message": "Password", "severity": "CRITICAL"}, {"key": "password", "value": "hardcodEd", "file": "src/config.yml", "line": 19, "rule_id": "password", "message": "Password", "severity": "CRITICAL"}]
+[
+  {
+    "key": "01_static_password",
+    "value": "hardcoded0",
+    "file": "src/config.yml",
+    "line": 12,
+    "rule_id": "password",
+    "message": "Password",
+    "severity": "CRITICAL"
+  },
+  {
+    "key": "02_static_passwords",
+    "value": "Hardcoded1",
+    "file": "src/config.yml",
+    "line": 14,
+    "rule_id": "password",
+    "message": "Password",
+    "severity": "CRITICAL"
+  },
+  {
+    "key": "02_static_passwords",
+    "value": "hardCoded2",
+    "file": "src/config.yml",
+    "line": 15,
+    "rule_id": "password",
+    "message": "Password",
+    "severity": "CRITICAL"
+  },
+  {
+    "key": "02_static_passwords",
+    "value": "haRdcOded3",
+    "file": "src/config.yml",
+    "line": 16,
+    "rule_id": "password",
+    "message": "Password",
+    "severity": "CRITICAL"
+  },
+  {
+    "key": "password",
+    "value": "hardcodEd",
+    "file": "src/config.yml",
+    "line": 19,
+    "rule_id": "password",
+    "message": "Password",
+    "severity": "CRITICAL"
+  }
+]
diff --git a/unittests/scans/whispers/whispers_one_vul.json b/unittests/scans/whispers/whispers_one_vul.json
@@ -1 +1,11 @@
-[{"key": "pip password", "value": "hardcoded", "file": "src/pip.conf", "line": 2, "rule_id": "pip", "message": "pip.conf Password", "severity": "CRITICAL"}]
+[
+  {
+    "key": "pip password",
+    "value": "hardcoded",
+    "file": "src/pip.conf",
+    "line": 2,
+    "rule_id": "pip",
+    "message": "pip.conf Password",
+    "severity": "CRITICAL"
+  }
+]
diff --git a/unittests/scans/whispers/whispers_one_vul_v2.2.json b/unittests/scans/whispers/whispers_one_vul_v2.2.json
@@ -1 +1,11 @@
-[{"key": "pip password", "value": "hardcoded", "file": "src/pip.conf", "line": 2, "rule_id": "pip", "message": "pip.conf Password", "severity": "High"}]
+[
+  {
+    "key": "pip password",
+    "value": "hardcoded",
+    "file": "src/pip.conf",
+    "line": 2,
+    "rule_id": "pip",
+    "message": "pip.conf Password",
+    "severity": "High"
+  }
+]
diff --git a/unittests/scans/whispers/whispers_zero_vul.json b/unittests/scans/whispers/whispers_zero_vul.json
@@ -1 +1 @@
-[]
+[]
diff --git a/unittests/tools/test_legitify_parser.py b/unittests/tools/test_legitify_parser.py
@@ -16,6 +16,7 @@ def test_parse_file_with_many_findings(self):
                 self.assertEqual("Repository | Default Branch Should Require Code Review", finding.title)
                 self.assertFalse(finding.dynamic_finding)
                 self.assertTrue(finding.static_finding)
+                self.assertTrue(finding.fix_available)
             for finding in findings:
                 for endpoint in finding.unsaved_endpoints:
                     endpoint.clean()
@@ -32,6 +33,7 @@ def test_parse_file_with_one_finding(self):
                 self.assertEqual("Repository | Default Branch Should Require Code Review", finding.title)
                 self.assertFalse(finding.dynamic_finding)
                 self.assertTrue(finding.static_finding)
+                self.assertTrue(finding.fix_available)
             for finding in findings:
                 for endpoint in finding.unsaved_endpoints:
                     endpoint.clean()
