report builder: ensure at least one section is present

[valentijnscholten]

Disable Run button until at least one section is added to the report builder at .../reports/builder

Fixes #8687

[mtesauro]

Very nice addition 👍

[mtesauro]

Approved

[dryrunsecurity]

This pull request relies solely on client-side JavaScript to enforce that at least one report widget is selected before generating a report, but there is no corresponding server-side validation, so an attacker could bypass the client check and invoke the report-generation endpoint with no widgets selected, potentially causing errors, resource exhaustion, or denial of service. Adding server-side validation to verify selected widgets before processing requests is recommended.

Client-Side Enforcement of Security Controls in dojo/templates/dojo/report_builder.html

Vulnerability

Client-Side Enforcement of Security Controls

Description

The application relies solely on client-side JavaScript to ensure that at least one report widget is selected before a report can be generated. This client-side check can be easily bypassed by an attacker, allowing them to submit requests to the server-side report generation endpoint without any selected widgets. Without corresponding server-side validation, the application may process these invalid requests, leading to potential resource consumption, errors, or even denial of service.

django-DefectDojo/dojo/templates/dojo/report_builder.html

Lines 159 to 171 in 245b98e

	function runReport(event) {
	var valid = true;
	// Require at least one content widget (exclude report options)
	if ($('.in-use-widgets ul#sortable2 li').not('.report-options').length === 0) {
	alert('Please add at least one section from "Available Widgets" before running.');
	event.preventDefault();
	return;
	}
	$('.in-use-widgets .form-control').not('#finding-list .form-control')
	.not('#endpoint-list .form-control').not('#wysiwyg-content .form-control')
	.not('.bs-searchbox .form-control').not('div').each(function () {

---

All finding details can be found in the DryRun Security Dashboard.