Updates Decorators with Certain Permission Models

[devGregA]

• Updates permission decorators to be more explicit
• Add comments for specific permission choices made
• Add unit test for verifying permissions

[dryrunsecurity]

🟡 Please give this pull request extra attention during review.

This pull request introduces a change to dojo/benchmark/views.py but leaves the update_benchmark view retrieving a Product by user-supplied pid without any authorization check or scoping to the current user, creating a potential IDOR where an authenticated attacker could access or modify benchmarks for arbitrary products; the view is missing the @user_is_authorized decorator present on similar endpoints.

🟡 Potential IDOR Vulnerability in dojo/benchmark/views.py (drs_f515c4be)

Vulnerability

Potential IDOR Vulnerability

Description

The 'update_benchmark' view in 'dojo/benchmark/views.py' retrieves a 'Product' object using a user-supplied 'pid' without any authorization check or scoping to the current user. While the patch adds a filter to ensure the 'Benchmark_Product' belongs to the retrieved 'Product', it fails to verify that the user has permission to access that 'Product'. This allows an authenticated attacker to access or modify benchmarks for any product by providing the appropriate 'pid'. Unlike other views in the same file (e.g., 'update_benchmark_summary') and other files in the patch, 'update_benchmark' is missing the '@user_is_authorized' decorator that would normally enforce these permissions.

django-DefectDojo/dojo/benchmark/views.py

Lines 49 to 52 in acce7bf

	product = get_object_or_404(Product, id=pid)
	bench = get_object_or_404(Benchmark_Product.objects.filter(product=product), id=bench_id)
	if field in {

---

All finding details can be found in the DryRun Security Dashboard.

[valentijnscholten]

Are there some lines that describe what this PR does? I can see it exposes some extra data depending on users permissions. But it also changes some existing permission checks?

[Maffooch]

@valentijnscholten I have added a description to the PR