Ruff: Add and fix N999 #11647

kiblik · 2025-01-25T13:19:11Z

Add rule invalid-module-name (N999) and fix following violations:

dojo/settings/settings.dist.py:1:1: N999 Invalid module name: 'settings.dist'
tests/Import_scanner_test.py:1:1: N999 Invalid module name: 'Import_scanner_test'

This is a bit of radical change as it is renaming a globally used and known setting file. I will be happy for any feedback.

dryrunsecurity · 2025-01-25T13:20:30Z

DryRun Security Summary

The pull request implements comprehensive changes to DefectDojo's configuration file naming, documentation, and security measures, including renaming the default configuration file, addressing security vulnerabilities, improving sensitive information handling, and enhancing deduplication functionality across multiple files.

Expand for full summary

Summary:

This pull request contains a series of changes across multiple files in the DefectDojo application. The changes primarily focus on updating the configuration file naming conventions, improving documentation, and addressing various security-related concerns identified by static code analysis tools.

The key highlights include:

Renaming the default configuration file from settings.dist.py to settings_dist.py to maintain consistency throughout the codebase.
Updating documentation to provide clearer guidance on configuration management, including the use of local_settings.py for custom settings.
Addressing potential security vulnerabilities identified by tools like Bandit and GitLab SAST, such as the use of insecure hashing functions, unsafe XML parsing, and cross-site scripting (XSS) vulnerabilities.
Improving the handling of sensitive information, such as removing hardcoded credentials and URLs with passwords.
Enhancing the deduplication functionality and its associated logging and configuration.
Updating the unit testing configuration and infrastructure to ensure a secure and isolated test environment.

Overall, these changes demonstrate a proactive approach to improving the security and maintainability of the DefectDojo application. As an application security engineer, I would recommend thoroughly reviewing the individual changes and ensuring that they are properly implemented and tested before merging this pull request.

Files Changed:

.github/labeler.yml: Updated the file path for the settings_changes label.
.github/pull_request_template.md: Updated the label for the "settings_changes" category.
.github/release-drafter.yml: Updated the category title for changes to settings_dist.py and local_settings.py.
Dockerfile.django-alpine: Updated the environment variable for the default settings file.
docker/entrypoint-unit-tests.sh: Updated comments to reference the settings_dist.py file.
docker/entrypoint-unit-tests-devDocker.sh: Updated comments to reference the settings_dist.py file.
Dockerfile.django-debian: Updated comments to reference the settings_dist.py file.
docker/extra_settings/README.md: Updated file name references from settings.dist.py to settings_dist.py.
docs/content/en/open_source/contributing/how-to-write-a-parser.md: Updated file name references from settings.dist.py to settings_dist.py.
docs/content/en/open_source/archived_docs/jira.md: Updated the command to increase the logging level for the jira_status_reconciliation management command.
docs/content/en/open_source/archived_docs/usage/features.md: Updated the environment variable and configuration file names for the deduplication feature.
docs/content/en/open_source/integrations/social-authentication.md: Added documentation for various authentication methods, including security-related considerations.
docs/content/en/open_source/upgrading/2.35.md: Added an integrity check for the settings_dist.py file.
docs/content/en/open_source/upgrading/1.10.md: Documented breaking changes and security-related updates in version 1.10.4.
docs/content/en/open_source/installation/configuration.md: Updated file name references from settings.dist.py to settings_dist.py.
docs/content/en/open_source/upgrading/1.7.0.md: Documented changes to the search functionality in version 1.7.0.
dojo/settings/settings.py: Updated the include path for the default settings file.
dojo/settings/settings_dist.py: Updated the file name and comments.
dojo/settings/template-local_settings: Updated comments related to the Django debug toolbar configuration.
dojo/models.py: Updated logging to use the settings_dist.py file.
dojo/settings/unittests.py: Updated the settings file path.
readme-docs/CONTRIBUTING.md: Updated the link to the dojo_settings file.
ruff.toml: Added a new custom Ruff rule to the configuration.
`

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.

github-actions · 2025-01-27T17:22:37Z