Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Return Feedback about wrong File Format in ZAP #11772

Merged
merged 2 commits into from
Feb 19, 2025
Merged

Return Feedback about wrong File Format in ZAP #11772

merged 2 commits into from
Feb 19, 2025

Conversation

manuel-sommer
Copy link
Contributor

@github-actions github-actions bot added the parser label Feb 8, 2025
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented Feb 8, 2025 •
edited
Loading

DryRun Security Summary

The pull request enhances security by adding XML file extension validation to ZapParser's get_findings method, including input validation, specific error handling, and basic file processing controls.

Expand for full summary

This PR adds file extension validation to the ZapParser's get_findings method, implementing a basic XML file input check. Security findings include:

  1. Input validation improvement that prevents parsing non-XML files, mitigating potential XML parsing risks (dojo/tools/zap/parser.py, lines 28-30)
  2. Specific error handling with a ValueError that provides clear error messaging
  3. Lightweight security control that helps prevent unintended file processing, though not a comprehensive XML validation mechanism

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

mtesauro
mtesauro approved these changes Feb 10, 2025
View reviewed changes
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro merged commit 3b32f3e into DefectDojo:bugfix Feb 19, 2025
73 checks passed
@manuel-sommer manuel-sommer deleted the fix11754 branch February 20, 2025 06:49
Maffooch added a commit that referenced this pull request Feb 24, 2025
@Maffooch @manuel-sommer
@paulOsinski @rossops
Release: Merge back 2.43.4 into dev from: master-into-dev/2.43.4-2.44…
5d484e4 
….0-dev (#11888)

* Update versions in application files

* Return Feedback about wrong File Format in ZAP (#11772)

* Return Feedback about wrong File Format in ZAP

* ruff

* Surveys: Correct Question 404 (#11862)

* Surveys: Correct Question 404

When editing a survey question, a 404 is presented for a valid object. At some point, the content type for Questions changed to `Defect Dojo` (the verbose name of the app) rather than `dojo` (the common name)

There is only one place where the name of the content type is accessed, so adding some backward compatible checks corrected the issue

[sc-10195]

* Update views.py

* API Tags: Add filter for `AND` expressions (#11743)

* API Tags: Add filter for `AND` expressions

* Fix some ruff stuff

* Small corrections

* Update dojo/filters.py

* Release Notes: 2.43.3 (#11857)

* add 2.43.0 changelog

* add 2.43.1

* v2.43.2

* 2.43.3

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

* Docs Updates: Feb (#11791)

* exclude archived docs from search

* rm index files from search results

* fix typo - CWE to CVE

* update external_tools.md with additional windows options

* remove outdated github.io links

* specify that EPSS sync is pro-only

* add universal parser documentation

* add beta notice to Universal Parser

* Update universal_parser.md

* add back defectdojo.com/pricing links

* add scss change to fix 'central column' issue

* add rules engine Pro documentation

* change casing for screenshots

* create pro features list, add to header

* Rename Enabling_Deduplication_within_an_Engagement.png to enabling_deduplication_within_an_engagement.png

* Rename Enabling_Deduplication_within_an_Engagement_2.png to enabling_deduplication_within_an_engagement_2.png

* Rename Enabling_Deduplication_within_an_Engagement_3.png to enabling_deduplication_within_an_engagement_3.png

* Rename Enabling_Deduplication_within_an_Engagement_4.png to enabling_deduplication_within_an_engagement_4.png

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

* Feb docs hotfix (#11870)

* Rename Enabling_Product-Level_Deduplication.png to enabling_product-level_deduplication.png

* Rename Enabling_Product-Level_Deduplication_2.png to enabling_product-level_ceduplication_2.png

* Rename enabling_product-level_ceduplication_2.png to enabling_product-level_deduplication_2.png

* Update versions in application files

* Update versions in application files

* Fixing flake 8

---------

Co-authored-by: DefectDojo release bot <dojo-release-bot@users.noreply.github.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Co-authored-by: manuelsommer <47991713+manuel-sommer@users.noreply.github.com>
Co-authored-by: Paul Osinski <42211303+paulOsinski@users.noreply.github.com>
Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
Co-authored-by: Ross E Esposito <ross@defectdojo.com>
quirinziessler pushed a commit to quirinziessler/django-DefectDojo that referenced this pull request Feb 26, 2025
@manuel-sommer @quirinziessler
Return Feedback about wrong File Format in ZAP (DefectDojo#11772)
0daa421 
* Return Feedback about wrong File Format in ZAP

* ruff
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mtesauro mtesauro mtesauro approved these changes

@dogboat dogboat dogboat approved these changes

@hblankenship hblankenship hblankenship approved these changes

@Maffooch Maffooch Maffooch approved these changes

Assignees
No one assigned
Labels
parser
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@manuel-sommer @mtesauro @dogboat @hblankenship @Maffooch