Duplicate Delete errors: catch IntegrityErrors (A) #11739
Conversation
valentijnscholten
force-pushed
the
duplicate-delete-errors-a
branch
from
9442d09 to
5583027
Compare
DryRun Security SummaryThe PR fixes a typo and adds two safer error-handling methods to the base importer, but introduces security concerns including race conditions, sensitive data logging, overly broad exception handling, and potential system information exposure. Expand for full summaryPR updates a serializer help text typo and adds two new methods in base importer for safer error handling during import processes. Security Findings:
Code AnalysisWe ran |
|
@valentijnscholten option A is the crowd favorite here. Thank you for presenting all three options In this way! It made selecting the winner super straight forward |
dojo/api_v2/serializers.py
Outdated
| @@ -167,7 +167,7 @@ class ImportStatisticsSerializer(serializers.Serializer): | |||
| ) | |||
| delta = DeltaStatisticsSerializer( | |||
| required=False, | |||
| help_text="Finding statistics of modifications made by the reimport. Only available when TRACK_IMPORT_HISTORY hass not disabled.", | |||
| help_text="Finding statistics of modifications made by the reimport. Only available when TRACK_IMPORT_HISTORY has not disabled.", | |||
There was a problem hiding this comment.
Do we still need a word here, or a change to "is"?
There was a problem hiding this comment.
good find, added "been".
valentijnscholten
force-pushed
the
duplicate-delete-errors-a
branch
from
da00cf6 to
1e0de2a
Compare
* option a: catch IntegrityErrors * linting * fix object creation * fix object creation * bugfixing * bugfixing * Update dojo/api_v2/serializers.py
* option a: catch IntegrityErrors * linting * fix object creation * fix object creation * bugfixing * bugfixing * Update dojo/api_v2/serializers.py
Description
Fixes and see: #6217
This PR catches integrity errors that might happen if the background dedupe delete job deletes findings before the import process is fully completed. In the absence of transactions, for now we implement this "fix".
Test results
Manual testing only as creating a unit test / integration test is not feasible within a reasonable timeframe.