Skip to content

Conversation

@valentijnscholten
Copy link
Member

@valentijnscholten valentijnscholten commented Dec 16, 2025

Findings weren't pushed to JIRA during import/reimport when postprocessing was happening in the background (default behaviour, unless block_execution was set to True). Bug was introduced in 2.53.0.

This was not caught by our unit tests as these run in synchronous mode.

During debugging I added some logging helpful for troubleshooting, let's leave that in place for now via this PR.

@dryrunsecurity
Copy link

dryrunsecurity bot commented Dec 16, 2025

DryRun Security

This pull request logs the full DRF serializer context (which includes the request), causing request headers — including sensitive Authorization tokens like API keys or JWTs — to be written to debug logs. This could disclose secrets in logs and should be removed or redacted before logging.

Information Disclosure via Debug Logging in dojo/api_v2/serializers.py
Vulnerability Information Disclosure via Debug Logging
Description The code logs the entire context dictionary at the debug level. In a Django REST Framework (DRF) environment, this context typically contains the DRF request object. When the request object is converted to a string for logging, it includes all request headers, which results in the sensitive Authorization header (containing API keys or JWTs) being written to the application's debug logs.

logger.debug(f"process_scan called with context: {context}")
start_time = time.perf_counter()
importer = self.get_importer(**context)
context["test"], _, _, _, _, _, _ = importer.process_scan(


All finding details can be found in the DryRun Security Dashboard.

Maffooch
Maffooch previously approved these changes Dec 16, 2025
mtesauro
mtesauro previously approved these changes Dec 17, 2025
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro requested review from Jino-T and dogboat December 17, 2025 03:56
dogboat
dogboat previously approved these changes Dec 17, 2025
Jino-T
Jino-T previously approved these changes Dec 17, 2025
@valentijnscholten valentijnscholten changed the title push_to_jira: add logging push_to_jira: fix pushing to JIRA in asynchronous mode Dec 17, 2025
@valentijnscholten valentijnscholten changed the title push_to_jira: fix pushing to JIRA in asynchronous mode push_to_jira: fix pushing to JIRA during import/reimport in asynchronous mode Dec 17, 2025
@valentijnscholten valentijnscholten dismissed stale reviews from Jino-T, dogboat, mtesauro, and Maffooch December 17, 2025 17:07

added significant changes to the PR

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@valentijnscholten valentijnscholten merged commit b3049f9 into DefectDojo:bugfix Dec 17, 2025
277 of 279 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants