Release: Merge back 2.51.1 into dev from: master-into-dev/2.51.1-2.52.0-dev #13422
Conversation
….52.0-dev Release: Merge back 2.51.0 into bugfix from: master-into-bugfix/2.51.0-2.52.0-dev
Bumps [django](https://github.com/django/django) from 5.1.12 to 5.1.13. - [Commits](django/django@5.1.12...5.1.13) --- updated-dependencies: - dependency-name: django dependency-version: 5.1.13 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…n Acunetix XML parser
* watson middleware: skip logging if no instances updated * watson middleware: skip logging if no instances updated
feat(helm): Add support for automountServiceAccountToken
…ttests add unit tests to test importer deduplication
fix: handle broken endpoints when <StartURL> includes a port number in Acunetix XML parser
…mprovements pghistory improvements: backfill and "empty" changes
Release: Merge release into master from: release/2.51.1
github-actions
bot
requested review from
Maffooch and
mtesauro
as code owners
🔴 Risk threshold exceeded.This pull request includes a sensitive edit to dojo/user/views.py that matches configured-sensitive file patterns, and introduces a command-injection vulnerability in .github/workflows/release-x-manual-helm-chart.yml where the user-controlled workflow_dispatch input release_number is interpolated into a shell run step (git commit -m), allowing arbitrary command execution on the Actions runner.
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
Command Injection in .github/workflows/release-x-manual-helm-chart.yml
| Vulnerability | Command Injection |
|---|---|
| Description | The GitHub Actions workflow release-x-manual-helm-chart.yml is vulnerable to command injection. The inputs.release_number value, which is user-controlled via workflow_dispatch, is directly interpolated into a git commit -m command within a run step. This allows an attacker to inject shell metacharacters and execute arbitrary commands on the GitHub Actions runner. |
django-DefectDojo/.github/workflows/release-x-manual-helm-chart.yml
Lines 120 to 121 in e650c0f
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
github-actions
bot
added
conflicts-detected
docs
unittests
ui
parser
helm
and removed
conflicts-detected
labels
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
Release triggered by
rossops