Feature/asvs 5.0 benchmark#12669
Merged
valentijnscholten merged 4 commits intoDefectDojo:devfrom Jun 25, 2025
Merged
Conversation
added 2 commits
June 21, 2025 15:07
…duct view Previously, only one Benchmark Type (e.g., ASVS) appeared in the product view dropdown, even if more were in the database. Now, the view passes all enabled Benchmark Types to the template, so the dropdown correctly lists every available type. No template changes were needed; just the view logic was updated.
…ents) - Added OWASP ASVS 5.0 as a new Benchmark Type to fixtures. - Added all categories and requirements from ASVS 5.0. - All ASVS 5.0 controls are now available for selection and mapping in DefectDojo. No code changes, only updated fixture data.
🔴 Risk threshold exceeded.This pull request contains multiple sensitive edits to critical files in the dojo/product directory, including views.py and product.html, which may require additional review and configuration in the .dryrunsecurity.yaml file to manage access and changes.
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
🔴 Configured Codepaths Edit in dojo/product/views.py
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
🔴 Configured Codepaths Edit in dojo/product/views.py
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
🔴 Configured Codepaths Edit in dojo/templates/dojo/product.html
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
product(): use plural `benchmark_types` to reflect that we pass a list product.html: iterate over `benchmark_types`
Maffooch
approved these changes
Jun 23, 2025
hblankenship
approved these changes
Jun 25, 2025
valentijnscholten
approved these changes
Jun 25, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description 📋
🐞 Bug fix
Benchmark_Typerecords to the template.dojo/product/views.pynow fetchesBenchmark_Type.objects.filter(enabled=True)and exposes it in the context → the dropdown lists all enabled benchmarks.✨ Feature / Enhancement
Includes the latest ASVS 5.0 as a selectable benchmark, with new categories and initial requirements.
Previously, only the old ASVS 3.1 was visible in the dropdown, even though 4.0.1 was already in the database. ASVS 3.1 is quite outdated, so it’s nice to have more up-to-date standards available.
The dropdown now shows all available ASVS versions (including 5.0), so you can map findings to the most current requirements.
Screenshots 🖼️
Additional screenshots of the new ASVS 5.0 benchmark page:
References 🔗
Place any external links here (PDF, CSV, official page, etc.):
Test results
manage.py loaddata …).