Release: Merge back 2.53.2 into dev from: master-into-dev/2.53.2-2.54.0-dev by github-actions[bot] · Pull Request #13904 · DefectDojo/django-DefectDojo

github-actions · 2025-12-15T16:52:50Z

Release triggered by rossops

….54.0-dev Release: Merge back 2.53.1 into bugfix from: master-into-bugfix/2.53.1-2.54.0-dev

* add asset/org info * remove ref to P/PT nestability * change screenshot * add contact email * Update docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> * Update docs/content/en/working_with_findings/organizing_engagements_tests/pro_assets_organizations.md Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> --------- Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com> Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>

* update changelog * update pro_features.md * Update docs/content/en/changelog/changelog.md Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> * Update docs/content/en/changelog/changelog.md Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com> --------- Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com> Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

…13865) Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

* delete_chunk: ensure ordering * delete_chunk: wait for chunk_deletion to complete * delete_chunk: retry on deadlock * ruff --------- Co-authored-by: Valentijn Scholten <valentijn.scholten@iodigital.com>

Clarified release types and added details on dependency updates.

* dedupe: optimize found_by * fix: update expected query counts in performance tests * fix: update expected query counts in performance tests

Release: Merge release into master from: release/2.53.2

dryrunsecurity · 2025-12-15T16:56:29Z

🔴 Risk threshold exceeded.

This pull request includes sensitive edits to multiple core files (dojo/finding/*, dojo/finding_group/views.py, dojo/importers/base_importer.py, dojo/jira_link/helper.py, dojo/models.py, dojo/utils.py) and introduces two security issues: a dynamic module import in reimport_unittest_scan.py that uses unvalidated user-controlled input (risk of arbitrary code execution) and a GitHub Actions workflow that injects an unsafely-escaped pull request title into a shell command allowing command injection via crafted titles.

🔴 Configured Codepaths Edit in dojo/finding/deduplication.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding_group/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/base_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

Arbitrary Module Import in dojo/management/commands/reimport_unittest_scan.py

Vulnerability	Arbitrary Module Import
Description	The `reimport_unittest_scan` management command dynamically imports a Python module based on user input. The `module_name` is extracted from the `scan_file` argument without validation or sanitization before being used in `import_module(f"dojo.tools.{module_name}.parser")`. An attacker who can execute this command and control the `scan_file` argument could specify a path that resolves to a malicious Python file, leading to arbitrary code execution.

django-DefectDojo/dojo/management/commands/reimport_unittest_scan.py

Lines 112 to 115 in 7b73a29

    
           module = import_module(f"dojo.tools.{module_name}.parser") 
        
           # Find the parser class 
        
           parser_class = None

Command Injection in GitHub Action in .github/workflows/test-helm-chart.yml

Vulnerability	Command Injection in GitHub Action
Description	The GitHub Action workflow uses a pull request title (`github.event.pull_request.title`), which is user-controlled input, and embeds it into a shell command executed by `yq`. The sanitization logic is an incomplete blacklist that fails to escape shell metacharacters like single quotes ('). An attacker could craft a pull request title containing a single quote to break out of the string and inject arbitrary shell commands, which would be executed on the GitHub runner.

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 127 to 130 in 7b73a29

    
                     yq -i '.annotations."artifacthub.io/changes" += "- kind: changed\n  description: '$title'\n"' helm/defectdojo/Chart.yaml 
        
                     git add helm/defectdojo/Chart.yaml 
        
                     git commit -m "ci: update Chart annotations from PR #${{ github.event.pull_request.number }}" || echo "No changes to commit"

We've notified @mtesauro.

All finding details can be found in the DryRun Security Dashboard.

….53.2-2.54.0-dev Release: Merge back 2.53.2 into dev from: master-into-dev/2.53.2-2.54.0-dev

DefectDojo release bot and others added 23 commits December 8, 2025 17:28

Update versions in application files

9fc3d88

Merge pull request #13845 from DefectDojo/master-into-bugfix/2.53.1-2…

75d18e5

….54.0-dev Release: Merge back 2.53.1 into bugfix from: master-into-bugfix/2.53.1-2.54.0-dev

update sso docs for group read all permission (#13850)

ee9ee74

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

fix(GHA): Failed in all dependences had not been in latest version (#…

764f071

…13865) Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

fix(HELM): Use renovate-compatible format (#13866)

1d4d0db

Signed-off-by: kiblik <5609770+kiblik@users.noreply.github.com>

💄 Beautify Rubocop json (#13894)

6aa64b9

🎉 Add ICSA vulnid (#13895)

b4771c0

async delete: retry on deadlock (#13863)

efe0f5d

* delete_chunk: ensure ordering * delete_chunk: wait for chunk_deletion to complete * delete_chunk: retry on deadlock * ruff --------- Co-authored-by: Valentijn Scholten <valentijn.scholten@iodigital.com>

feat(releases): Add section for GHA (#13867)

c8cf437

fix(HELM): Improve autogeneration of annotation (#13879)

01b2a16

fix logger NoneType (#13880)

fb35166

Update RELEASING.md with release type clarifications (#13881)

fa8b8a6

Clarified release types and added details on dependency updates.

jira: add none checks in a few places (#13886)

05138f3

foundy_by: optimize for dedupe (#13888)

0f4aad7

* dedupe: optimize found_by * fix: update expected query counts in performance tests * fix: update expected query counts in performance tests

importers: log time spent on parsing (#13892)

f4f0b36

reimport: add management command to reimport sample scans (#13893)

ca91c99

reimport: add test for internal duplicates during matching (#13890)

a15332e

Update versions in application files

da66f9e

Updating helm deps

7e4585d

Merge pull request #13903 from DefectDojo/release/2.53.2

f21b1ff

Release: Merge release into master from: release/2.53.2

Update versions in application files

33a25c8

github-actions Bot requested review from Maffooch and mtesauro as code owners December 15, 2025 16:52

Merge branch 'dev' into master-into-dev/2.53.2-2.54.0-dev

7b73a29

github-actions Bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR docs unittests helm labels Dec 15, 2025

rossops merged commit a4ed58f into dev Dec 15, 2025
92 checks passed

rossops deleted the master-into-dev/2.53.2-2.54.0-dev branch December 15, 2025 17:18

Maffooch pushed a commit to valentijnscholten/django-DefectDojo that referenced this pull request Feb 16, 2026

Merge pull request DefectDojo#13904 from DefectDojo/master-into-dev/2…

ae3dda8

….53.2-2.54.0-dev Release: Merge back 2.53.2 into dev from: master-into-dev/2.53.2-2.54.0-dev

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release: Merge back 2.53.2 into dev from: master-into-dev/2.53.2-2.54.0-dev#13904

Release: Merge back 2.53.2 into dev from: master-into-dev/2.53.2-2.54.0-dev#13904
rossops merged 24 commits intodevfrom
master-into-dev/2.53.2-2.54.0-dev

github-actions Bot commented Dec 15, 2025

Uh oh!

dryrunsecurity Bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

github-actions Bot commented Dec 15, 2025

Uh oh!

dryrunsecurity Bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Risk threshold exceeded.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

dryrunsecurity Bot commented Dec 15, 2025 •

edited

Loading