Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ruff: Add and fix N999 #11647

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Ruff: Add and fix N999 #11647

wants to merge 1 commit into from

Conversation

kiblik
Copy link
Contributor

@kiblik kiblik commented Jan 25, 2025

Add rule invalid-module-name (N999) and fix following violations:

dojo/settings/settings.dist.py:1:1: N999 Invalid module name: 'settings.dist'
tests/Import_scanner_test.py:1:1: N999 Invalid module name: 'Import_scanner_test'

This is a bit of radical change as it is renaming a globally used and known setting file. I will be happy for any feedback.

Copy link

dryrunsecurity bot commented Jan 25, 2025

DryRun Security Summary

This pull request encompasses comprehensive updates to DefectDojo, including documentation improvements, configuration changes, security vulnerability fixes, and enhancements to Docker deployment, LDAP authentication, and overall application settings.

Expand for full summary

Summary:

The changes in this pull request cover a wide range of updates, including documentation improvements, configuration changes, and security vulnerability fixes. The key focus areas are:

  1. Documentation Updates: The documentation has been updated to reflect changes in file naming conventions, such as renaming settings.dist.py to settings_dist.py. These changes help ensure consistency and clarity in the application's configuration management.

  2. Configuration Improvements: The changes include updates to the Docker-based deployment configuration, LDAP authentication integration, and Celery worker settings. These improvements help enhance the overall security and reliability of the application's deployment and operation.

  3. Security Vulnerability Remediation: Several security vulnerabilities, such as hardcoded passwords, insecure function calls, and potential SQL injection issues, have been identified and addressed through these changes. This is a crucial aspect of maintaining the application's security posture.

Files Changed:

  • .github/release-drafter.yml, .github/labeler.yml: Updates to the configuration files for the Release Drafter and Labeler GitHub Actions, which help manage the release process and categorize pull requests.
  • Dockerfile.django-alpine, Dockerfile.django-debian: Changes to the Docker configuration files, including updates to environment variables and Celery worker settings.
  • .github/pull_request_template.md: Updates to the pull request template, reflecting changes in the file naming convention for settings files.
  • docker/extra_settings/README.md: Documentation changes related to the settings file naming convention.
  • docker/entrypoint-unit-tests.sh, docker/entrypoint-unit-tests-devDocker.sh: Updates to the unit test entrypoint scripts, including changes to environment variable handling.
  • docs/content/en/open_source/archived_docs/jira.md, docs/content/en/open_source/contributing/how-to-write-a-parser.md, docs/content/en/open_source/integrations/social-authentication.md, docs/content/en/open_source/features.md, docs/content/en/open_source/installation/configuration.md, docs/content/en/open_source/upgrading/1.7.0.md, docs/content/en/open_source/upgrading/1.10.md, docs/content/en/open_source/upgrading/2.35.md, docs/content/en/open_source/ldap-authentication.md: Documentation updates across various aspects of the DefectDojo application, including JIRA integration, parser development, social authentication, features, configuration, and upgrade processes.
  • dojo/settings/settings.py, dojo/settings/template-local_settings, dojo/models.py, dojo/settings/settings_dist.py, dojo/settings/unittests.py: Code changes related to the application's settings and configuration management.
  • readme-docs/CONTRIBUTING.md, readme-docs/DOCKER.md: Documentation updates in the project's contribution guidelines and Docker-related instructions.
  • ruff.toml: Configuration changes for the Ruff linter, including the addition of various security-related linting rules.
  • unittests/scans/bandit/dd2.json, unittests/scans/bandit/many_vulns.json, unittests/scans/gitlab_sast/gl-sast-report-many-vuln_v14.json, unittests/scans/gitlab_sast/gl-sast-report-many-vuln_v15.json: Updates to the test scan reports, including the identification and remediation of security vulnerabilities.

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 1 finding

View PR in the DryRun Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant