Release: Merge back 2.50.2 into dev from: master-into-dev/2.50.2-2.51.0-dev

[github-actions]

Release triggered by rossops

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies multiple sensitive codepaths (files under dojo/ such as utils.py, forms.py, filters.py, engagement/views.py, finding/views.py, metrics/utils.py, test/views.py) flagged by the configured codepaths scanner, and it contains two concrete risks: a code‑injection vulnerability where the user‑editable System_Settings.product_grade CharField is passed to asteval in calculate_grade, and an unbounded tag‑creation/resource exhaustion risk in the TagField implementation; please review these changes carefully or update .dryrunsecurity.yaml to explicitly allow the edits.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/engagement/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/filters.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/metrics/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/test/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/filters.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/metrics/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Resource Exhaustion via Unbounded Tag Creation in dojo/forms.py

Vulnerability

Resource Exhaustion via Unbounded Tag Creation

Description

The TagField implementation, which uses django-tagulous, lacks explicit limits on the length of individual tags and the total number of unique tags that can be created. While a tag_validator exists to prevent certain characters, it does not address the core issue of resource consumption. This allows a malicious user to create an excessive number of long, unique tags, leading to potential database bloat, performance degradation, and ultimately, resource exhaustion or denial of service.

django-DefectDojo/dojo/forms.py

Lines 343 to 352 in bb35fe8

	product_manager = forms.ModelChoiceField(queryset=Dojo_User.objects.exclude(is_active=False).order_by("first_name", "last_name"), required=False)
	technical_contact = forms.ModelChoiceField(queryset=Dojo_User.objects.exclude(is_active=False).order_by("first_name", "last_name"), required=False)
	team_manager = forms.ModelChoiceField(queryset=Dojo_User.objects.exclude(is_active=False).order_by("first_name", "last_name"), required=False)
	tags = TagField(
	required=False,
	help_text="Add tags that help describe this product. Choose from the list or add new tags. Press Enter key to add.",
	)
	def __init__(self, *args, **kwargs):
	super().__init__(*args, **kwargs)

Code Injection via User-Editable product_grade Field in dojo/utils.py

Vulnerability

Code Injection via User-Editable product_grade Field

Description

The product_grade field, which is directly used in an aeval call within the calculate_grade function, is a user-editable CharField in the System_Settings model. This means an authenticated administrator can input arbitrary Python code into this field. When calculate_grade is executed, this arbitrary code will be evaluated by the asteval interpreter, leading to a code injection vulnerability. The patch itself modifies how the result of this evaluation is used, but does not address the underlying vulnerability of user-controlled input being passed to aeval.

django-DefectDojo/dojo/utils.py

Lines 1596 to 1608 in bb35fe8

	aeval = Interpreter()
	aeval(system_settings.product_grade)
	grade_product = f"grade_product({critical}, {high}, {medium}, {low})"
	prod_numeric_grade = aeval(grade_product)
	if prod_numeric_grade != product.prod_numeric_grade:
	logger.debug("Updating product %s grade from %s to %s", product.id, product.prod_numeric_grade, prod_numeric_grade)
	product.prod_numeric_grade = prod_numeric_grade
	super(Product, product).save()
	else:
	logger.debug("Product %s grade %i is up to date", product.id, prod_numeric_grade)
	def get_celery_worker_status():

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.