Merge pull request #10165 from DefectDojo/release/2.34.2

Release: Merge release into master from: release/2.34.2

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "defectdojo",
-  "version": "2.34.1",
+  "version": "2.34.2",
   "license" : "BSD-3-Clause",
   "private": true,
   "dependencies": {

docs/content/en/contributing/how-to-write-a-parser.md

@@ -157,7 +157,7 @@ Good example:
 
 ```python
    if "mykey" in data:
-       finding.cve = data["mykey"]
+       finding.cwe = data["mykey"]
 ```
 
 ### Do not parse CVSS by hand (vector, score or severity)
@@ -244,7 +244,7 @@ For ex:
             self.assertEqual(True, finding.verified)
             self.assertEqual(False, finding.duplicate)
             self.assertIn(finding.severity, Finding.SEVERITIES)
-            self.assertEqual("CVE-2020-36234", finding.cve)
+            self.assertEqual("CVE-2020-36234", finding.vulnerability_ids[0])
             self.assertEqual(261, finding.cwe)
             self.assertEqual("CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", finding.cvssv3)
             self.assertIn("security", finding.tags)

dojo/__init__.py

@@ -4,6 +4,6 @@
 # Django starts so that shared_task will use this app.
 from .celery import app as celery_app  # noqa: F401
 
-__version__ = '2.34.1'
+__version__ = '2.34.2'
 __url__ = 'https://github.com/DefectDojo/django-DefectDojo'
 __docs__ = 'https://documentation.defectdojo.com'

dojo/product/views.py

@@ -500,6 +500,8 @@ def endpoint_querys(request, prod):
         'finding__cwe'
     ).annotate(
         count=Count('finding__cwe')
+    ).annotate(
+        cwe=F('finding__cwe')
     )
 
     filters['all_vulns'] = endpoints_qs.filter(
@@ -508,6 +510,8 @@ def endpoint_querys(request, prod):
         'finding__cwe'
     ).annotate(
         count=Count('finding__cwe')
+    ).annotate(
+        cwe=F('finding__cwe')
     )
 
     filters['start_date'] = start_date
@@ -610,7 +614,7 @@ def view_product_metrics(request, pid):
             if view == 'Finding':
                 severity = finding.get('severity')
             elif view == 'Endpoint':
-                severity = finding.finding.get('severity')
+                severity = finding.get('severity')
 
             finding_age = calculate_finding_age(finding)
             if open_objs_by_age.get(finding_age, None):

dojo/settings/settings.dist.py

@@ -1692,6 +1692,9 @@ def saml2_attrib_map_format(dict):
     'RUSTSEC': 'https://rustsec.org/advisories/',
     'VNS': 'https://vulners.com/',
     'RHSA': 'https://access.redhat.com/errata/',
+    'RHBA': 'https://access.redhat.com/errata/',
+    'RHEA': 'https://access.redhat.com/errata/',
+    'FEDORA': 'https://bodhi.fedoraproject.org/updates/',
 }
 # List of acceptable file types that can be uploaded to a given object via arbitrary file upload
 FILE_UPLOAD_TYPES = env("DD_FILE_UPLOAD_TYPES")

dojo/tools/redhatsatellite/parser.py

@@ -61,8 +61,10 @@ def get_findings(self, filename, test):
             description += "**hosts_available_count:** " + str(hosts_available_count) + "\n"
             description += "**hosts_applicable_count:** " + str(hosts_applicable_count) + "\n"
             description += "**installable:** " + str(installable) + "\n"
-            description += "**bugs:** " + str(bugs) + "\n"
-            description += "**module_streams:** " + str(module_streams) + "\n"
+            if bugs != []:
+                description += "**bugs:** " + str(bugs) + "\n"
+            if module_streams != []:
+                description += "**module_streams:** " + ', '.join(module_streams) + "\n"
             description += "**packages:** " + ', '.join(packages)
             find = Finding(
                 title=title,

dojo/tools/sonarqube/sonarqube_restapi_json.py

@@ -14,11 +14,11 @@ def get_json_items(self, json_content, test, mode):
                     component = issue.get("component")
                     project = issue.get("project")
                     line = str(issue.get("line"))
-                    textRange = str(issue.get("textRange"))
-                    flows = str(issue.get("flows"))
+                    textRange = issue.get("textRange")
+                    flows = issue.get("flows")
                     status = issue.get("status")
                     message = issue.get("message")
-                    tags = str(issue.get("tags"))
+                    tags = issue.get("tags")
                     type = issue.get("type")
                     scope = issue.get("scope")
                     quickFixAvailable = str(issue.get("quickFixAvailable"))
@@ -29,11 +29,17 @@ def get_json_items(self, json_content, test, mode):
                     description += "**component:** " + component + "\n"
                     description += "**project:** " + project + "\n"
                     description += "**line:** " + line + "\n"
-                    description += "**textRange:** " + textRange + "\n"
-                    description += "**flows:** " + flows + "\n"
+                    if textRange != {}:
+                        res = []
+                        for item in textRange:
+                            res.append(item + ": " + str(textRange[item]))
+                        description += "**textRange:** " + ", ".join(res) + "\n"
+                    if flows != []:
+                        description += "**flows:** " + ", ".join(flows) + "\n"
                     description += "**status:** " + status + "\n"
                     description += "**message:** " + message + "\n"
-                    description += "**tags:** " + tags + "\n"
+                    if tags != []:
+                        description += "**tags:** " + ", ".join(tags) + "\n"
                     description += "**type:** " + type + "\n"
                     description += "**scope:** " + scope + "\n"
                     description += self.returncomponent(json_content, component)
@@ -51,7 +57,7 @@ def get_json_items(self, json_content, test, mode):
                     rule = issue.get("rule")
                     component = issue.get("component")
                     project = issue.get("project")
-                    flows = str(issue.get("flows"))
+                    flows = issue.get("flows")
                     status = issue.get("status")
                     message = issue.get("message")
                     cwe = None
@@ -80,20 +86,23 @@ def get_json_items(self, json_content, test, mode):
                                 component_version = None
                     scope = issue.get("scope")
                     quickFixAvailable = str(issue.get("quickFixAvailable"))
-                    codeVariants = str(issue.get("codeVariants"))
-                    tags = str(issue.get("tags"))
+                    codeVariants = issue.get("codeVariants")
+                    tags = issue.get("tags")
                     description = ""
                     description += "**key:** " + key + "\n"
                     description += "**rule:** " + rule + "\n"
                     description += "**component:** " + component + "\n"
                     description += "**project:** " + project + "\n"
-                    description += "**flows:** " + flows + "\n"
+                    if flows != []:
+                        description += "**flows:** " + ", ".join(flows) + "\n"
                     description += "**status:** " + status + "\n"
                     description += "**message:** " + message + "\n"
                     description += "**scope:** " + scope + "\n"
                     description += "**quickFixAvailable:** " + quickFixAvailable + "\n"
-                    description += "**codeVariants:** " + codeVariants + "\n"
-                    description += "**tags:** " + tags + "\n"
+                    if codeVariants != []:
+                        description += "**codeVariants:** " + ", ".join(codeVariants) + "\n"
+                    if tags != []:
+                        description += "**tags:** " + ", ".join(tags) + "\n"
                     description += self.returncomponent(json_content, component)
                     item = Finding(
                         title=rule + "_" + key,
@@ -138,27 +147,34 @@ def get_json_items(self, json_content, test, mode):
                     component = issue.get("component")
                     project = issue.get("project")
                     line = str(issue.get("line"))
-                    textRange = str(issue.get("textRange"))
-                    flows = str(issue.get("flows"))
+                    textRange = issue.get("textRange")
+                    flows = issue.get("flows")
                     status = issue.get("status")
                     message = issue.get("message")
-                    tags = str(issue.get("tags"))
+                    tags = issue.get("tags")
                     scope = issue.get("scope")
                     quickFixAvailable = str(issue.get("quickFixAvailable"))
-                    codeVariants = str(issue.get("codeVariants"))
+                    codeVariants = issue.get("codeVariants")
                     description = ""
                     description += "**rule:** " + rule + "\n"
                     description += "**component:** " + component + "\n"
                     description += "**project:** " + project + "\n"
                     description += "**line:** " + line + "\n"
-                    description += "**textRange:** " + textRange + "\n"
-                    description += "**flows:** " + flows + "\n"
+                    if textRange != {}:
+                        res = []
+                        for item in textRange:
+                            res.append(item + ": " + str(textRange[item]))
+                        description += "**textRange:** " + ", ".join(res) + "\n"
+                    if flows != []:
+                        description += "**flows:** " + ", ".join(flows) + "\n"
                     description += "**status:** " + status + "\n"
                     description += "**message:** " + message + "\n"
-                    description += "**tags:** " + tags + "\n"
+                    if tags != []:
+                        description += "**tags:** " + ", ".join(tags) + "\n"
                     description += "**scope:** " + scope + "\n"
                     description += "**quickFixAvailable:** " + quickFixAvailable + "\n"
-                    description += "**codeVariants:** " + codeVariants + "\n"
+                    if codeVariants != []:
+                        description += "**codeVariants:** " + ", ".join(codeVariants) + "\n"
                     description += self.returncomponent(json_content, component)
                     item = Finding(
                         title=rule + "_" + key,
@@ -179,10 +195,10 @@ def get_json_items(self, json_content, test, mode):
                 status = hotspot.get("status")
                 line = str(hotspot.get("line"))
                 message = hotspot.get("message")
-                textRange = str(hotspot.get("textRange"))
-                flows = str(hotspot.get("flows"))
+                textRange = hotspot.get("textRange")
+                flows = hotspot.get("flows")
                 ruleKey = hotspot.get("ruleKey")
-                messageFormattings = str(hotspot.get("messageFormattings"))
+                messageFormattings = hotspot.get("messageFormattings")
                 description = ""
                 description += "**key:** " + key + "\n"
                 description += "**component:** " + component + "\n"
@@ -191,10 +207,16 @@ def get_json_items(self, json_content, test, mode):
                 description += "**status:** " + status + "\n"
                 description += "**line:** " + line + "\n"
                 description += "**message:** " + message + "\n"
-                description += "**textRange:** " + textRange + "\n"
-                description += "**flows:** " + flows + "\n"
+                if textRange != {}:
+                    res = []
+                    for item in textRange:
+                        res.append(item + ": " + str(textRange[item]))
+                    description += "**textRange:** " + ", ".join(res) + "\n"
+                if flows != []:
+                    description += "**flows:** " + ", ".join(flows) + "\n"
                 description += "**ruleKey:** " + ruleKey + "\n"
-                description += "**messageFormattings:** " + messageFormattings + "\n"
+                if messageFormattings != []:
+                    description += "**messageFormattings:** " + ", ".join(messageFormattings) + "\n"
                 description += self.returncomponent(json_content, component)
                 item = Finding(
                     title=ruleKey + "_" + key,

dojo/views.py

@@ -27,11 +27,11 @@
 
 
 def custom_error_view(request, exception=None):
-    return render(request, "500.html", {})
+    return render(request, "500.html", {}, status=500)
 
 
 def custom_bad_request_view(request, exception=None):
-    return render(request, "400.html", {})
+    return render(request, "400.html", {}, status=400)
 
 
 def action_history(request, cid, oid):

helm/defectdojo/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: "2.34.1"
+appVersion: "2.34.2"
 description: A Helm chart for Kubernetes to install DefectDojo
 name: defectdojo
-version: 1.6.127
+version: 1.6.128
 icon: https://www.defectdojo.org/img/favicon.ico
 maintainers:
   - name: madchap