Finding Open/Close/Review: Enforce more status standardization

[Maffooch]

• Allow for closing a finding when clearing a review
• Enforces the under_review flag is set to False when reopening or closing a finding

[sc-3366]

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the functionality of the Defect Dojo application, specifically related to the handling of finding review and closure, without introducing any obvious security concerns, and aims to enhance the application's workflow and data integrity.

Expand for full summary

Summary:

The code changes in this pull request are focused on improving the functionality of the Defect Dojo application, specifically related to the handling of finding review and closure. The changes do not introduce any obvious security concerns and instead aim to enhance the application's workflow and data integrity.

The first change adds a new field called "is_mitigated" to the ClearFindingReviewForm, allowing users to update the mitigation status of a finding when clearing its review status. This is a minor update that does not raise any significant security red flags.

The second set of changes is related to the close_finding function in the dojo/finding/views.py file. These changes ensure that the finding's review status, last reviewed information, risk acceptance, and JIRA integration are properly handled when a finding is closed. This helps maintain the integrity and traceability of the findings within the application, which is crucial for effective vulnerability management and security posture.

Files Changed:

1. dojo/forms.py: This file has been updated to add a new field called "is_mitigated" to the ClearFindingReviewForm. This change allows users to update the mitigation status of a finding when clearing its review status.

2. dojo/finding/views.py: The changes in this file are focused on the close_finding function, ensuring that the finding's review status, last reviewed information, risk acceptance, and JIRA integration are properly handled when a finding is closed. These changes help maintain the integrity and traceability of the findings within the application.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[mtesauro]

Approved