Release: Merge release into master from: release/2.51.0

[github-actions]

Release triggered by rossops

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies multiple sensitive backend files (models, serializers, views, importers, and helpers) flagged by configured codepath checks and introduces CI workflow risks including unsanitized workflow input used as an env var (potential command injection), branch-derived interpolation into shell commands (potential command injection), use of a decoded secret in a curl command (possible secret exposure in logs), and a broad failed-logs step that may leak sensitive application data. Please review the sensitive file edits against allowed authors in .dryrunsecurity.yaml and harden the CI workflows by validating/sanitizing inputs, avoiding direct shell interpolation, protecting secret-derived variables, and limiting log dumps.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/endpoint_manager.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/decorators.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/base_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/default_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/endpoint_manager.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Potential Command Injection via Workflow Input in .github/workflows/integration-tests.yml

Vulnerability	Potential Command Injection via Workflow Input
Description	The AUDITLOG_TYPE environment variable is set directly from a workflow input (inputs.auditlog_type) without sanitization. If this variable is used in a shell command later in the job, it could lead to command injection. The workflow_call trigger allows this input to be controlled by external sources, including potentially malicious ones (e.g., pull requests from forks).

django-DefectDojo/.github/workflows/integration-tests.yml

Lines 16 to 19 in f3e1ffb

	AUDITLOG_TYPE: ${{ inputs.auditlog_type }}
	strategy:
	matrix:
	test-case: [

Potential Command Injection in GitHub Actions in .github/workflows/test-helm-chart.yml

Vulnerability	Potential Command Injection in GitHub Actions
Description	The env.ct-branch variable is derived from github.base_ref or github.ref which can be influenced by an attacker through a crafted branch name in a pull request. This variable is then directly interpolated into a shell command without proper sanitization, allowing for potential command injection.

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 79 to 82 in f3e1ffb

	target_annotation=$(git show "${{ env.ct-branch }}:helm/defectdojo/Chart.yaml" | yq e '.annotations."artifacthub.io/changes"' -)
	if [[ "$current_annotation" == "$target_annotation" ]]; then
	echo "::error file=helm/defectdojo/Chart.yaml::The 'artifacthub.io/changes' annotation has not been updated compared to ${{ env.ct-branch }}"

Potential Secret Exposure in CI/CD Logs in .github/workflows/k8s-tests.yml

Vulnerability

Potential Secret Exposure in CI/CD Logs

Description

The DD_ADMIN_PASSWORD is retrieved from a Kubernetes secret, base64 decoded, and assigned to the shell variable ADMIN_PASS. This variable is then used directly in a curl command's --data-raw argument. While GitHub Actions attempts to mask secrets, variables derived from secrets within shell scripts are not always automatically masked. If the curl command fails or if shell tracing were enabled, the password could be exposed in the CI/CD logs.

django-DefectDojo/.github/workflows/k8s-tests.yml

Lines 163 to 166 in f3e1ffb

	ADMIN_PASS=$(kubectl get secret/defectdojo -o jsonpath='{.data.DD_ADMIN_PASSWORD}' | base64 -d)
	echo "Simple API check"
	DJANGO_IP=$(kubectl get svc defectdojo-django -o jsonpath='{.spec.clusterIP}')
	RETRY=0

Information Disclosure via Broad Log Dumping in .github/workflows/k8s-tests.yml

Vulnerability

Information Disclosure via Broad Log Dumping

Description

The new 'Failed Logs' step in the k8s-tests.yml workflow, triggered on any failure, executes kubectl logs deployment/defectdojo-django --all-pods=true --all-containers=true --tail=100. This command broadly dumps the last 100 lines of logs from all containers within the defectdojo-django deployment (e.g., uwsgi, celery components). In a CI/CD environment, these logs are typically accessible to collaborators or potentially publicly. Django applications, especially during error conditions or with verbose logging, can inadvertently log sensitive information such as stack traces (revealing file paths, internal logic, variable values), request/response data (user input, session tokens), or even environment variables (like DD_SECRET_KEY, DD_CREDENTIAL_AES_256_KEY, database URLs) if an error occurs during their processing. This broad log dumping significantly increases the risk of exposing confidential data during test failures.

django-DefectDojo/.github/workflows/k8s-tests.yml

Lines 218 to 220 in f3e1ffb

	kubectl logs deployment/defectdojo-django --all-pods=true --all-containers=true --tail=100
	echo "And all pod status one more time"
	kubectl get pods

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.