Release 2.56.0: Merge Bugfix into Dev

[rossops]

No description provided.

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies multiple sensitive codepaths (including dojo/api_v2/serializers.py, dojo/finding/deduplication.py, several importers and managers, and template files like endpoints.html and view_finding.html), and the scanner flags these as sensitive edits that should be reviewed against the configured .dryrunsecurity.yaml allowed paths/authors. None of the findings are marked blocking, but they are flagged at a failing risk threshold and warrant careful review.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py (drs_9b432c84)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py (drs_8d1e0aab)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/deduplication.py (drs_c2deb718)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py (drs_17dc19c8)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py (drs_40420c22)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/deduplication.py (drs_d744c8c7)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/endpoint_manager.py (drs_e8267b5e)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/location_manager.py (drs_185cb599)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/snippets/endpoints.html (drs_c33b5dfb)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html (drs_55125488)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py (drs_53f3ae13)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/endpoint_manager.py (drs_62493d2a)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/location_manager.py (drs_f94c32c4)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/snippets/endpoints.html (drs_d8cb7dea)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html (drs_1f6ba37a)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[Copilot]

Pull request overview

This PR merges a bugfix/security hardening set into dev as part of the 2.56.0 release line, including permission/IDOR fixes, safer ZIP parsing, importer performance tweaks, and documentation/chart version bumps.

Changes:

• Added/updated authorization checks to prevent cross-object IDOR and data exposure (risk acceptance, questionnaires, engagement presets, benchmarks, credential mappings, tool/object parent mismatches).
• Introduced ZIP bomb protections and migrated multiple parsers/importers to use safe ZIP utilities.
• Improved importer behavior/performance (endpoint/location status handling, language bulk writes, query count adjustments) and expanded test coverage + docs updates.

Reviewed changes

Copilot reviewed 54 out of 86 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
unittests/tools/test_trivy_operator_parser.py	Updates/extends Trivy Operator parser tests (severity logic + missing checkID regression).
unittests/test_rest_framework.py	Strengthens cloc import test by validating initial + updated payloads and expected language rows.
unittests/test_permissions_audit.py	Adds a comprehensive permission/IDOR regression test suite across multiple endpoints.
unittests/test_importers_performance.py	Adjusts expected query counts to reflect importer/perf changes.
unittests/test_import_reimport.py	Adds regression tests for endpoint-status reactivation rules and auto_create reimport behavior.
unittests/scans/trivy_operator/configauditreport_missing_checkid.json	New Trivy sample for missing checkID.
unittests/scans/trivy_operator/compliance_severity.json	New Trivy sample to verify check vs result severity precedence.
helm/defectdojo/README.md	Bumps chart/app badges to 2.56.0-dev / 1.9.15-dev.
helm/defectdojo/Chart.yaml	Marks chart prerelease + bumps chart/app versions.
dojo/url/ui/views.py	Refactors finding location bulk update to set a single selected status via set_status.
dojo/tools/utils.py	Adds safe_open_zip / safe_read_all_zip with zip-bomb protection limits.
dojo/tools/trivy_operator/compliance_handler.py	Fixes compliance severity selection logic (check severity preferred, else result severity).
dojo/tools/trivy_operator/checks_handler.py	Ensures missing checkIDs don’t generate bogus references/IDs.
dojo/tools/sonarqube/parser.py	Switches ZIP reading to safe ZIP utility.
dojo/tools/ms_defender/parser.py	Switches ZIP reading to safe ZIP utility.
dojo/tools/fortify/fpr_parser.py	Switches ZIP reading to safe ZIP utility.
dojo/tools/blackduck_component_risk/importer.py	Uses safe ZIP opening for BlackDuck Component Risk reports.
dojo/tools/blackduck/importer.py	Uses safe ZIP opening for BlackDuck reports.
dojo/tool_product/views.py	Prevents cross-product tool setting edits/deletes (403/404 instead of bad request).
dojo/templates/dojo/view_finding.html	Updates bulk edit UI to support Locations (radio-based status selection).
dojo/templates/dojo/snippets/endpoints.html	Displays location status via display name and adjusts header formatting.
dojo/survey/views.py	Scopes Answered_Survey lookups to engagement to prevent cross-engagement access.
dojo/settings/settings.dist.py	Silences polymorphic warnings in default system checks list.
dojo/product/views.py	Scopes Engagement Preset lookups to product to prevent cross-product access.
dojo/object/views.py	Prevents cross-product object edits/deletes (403/404 instead of bad request).
dojo/location/models.py	Changes association helpers to return existing refs early (status update behavior changed).
dojo/importers/location_manager.py	Avoids mitigating special statuses and improves set membership for locations.
dojo/importers/endpoint_manager.py	Uses prefetched non-special endpoint statuses for reimport status updates.
dojo/importers/default_reimporter.py	Uses prefetched non-special endpoint statuses during reactivation.
dojo/finding/views.py	Requires global Finding_Edit for template discovery endpoint.
dojo/finding/helper.py	Truncates finding group names to DB length constraints.
dojo/finding/deduplication.py	Adds optimized Prefetch for non-special endpoint statuses in reimport mode.
dojo/engagement/views.py	Scopes risk acceptance routes to the owning engagement to prevent IDOR.
dojo/cred/views.py	Tightens credential authorization to configuration-level and Cred_Mapping-level checks.
dojo/benchmark/views.py	Scopes benchmark updates and summaries to product to prevent IDOR.
dojo/api_v2/views.py	Fixes permissions for engagement update_jira_epic and enforces parent perms in metadata batch.
dojo/api_v2/serializers.py	Hides accepted_risks if user lacks permission; prevents closing old findings on auto-create reimport; bulk-writes language stats.
docs/layouts/_markup/render-image.html	Adds Hugo image render hook and disables costly WebP conversion in this hook.
docs/content/releases/pro/changelog.md	Updates Pro changelog entries.
docs/content/import_data/pro/connectors/connectors_tool_reference.md	Adds Akamai API Security + JFrog Xray connector docs.
docs/content/import_data/pro/connectors/about_connectors.md	Adds Akamai API Security + JFrog Xray to the supported connectors list.
docs/content/import_data/import_intro/comparison.md	Updates connectors list in import method comparison table.
docs/content/get_started/about/demo.md	Updates Pro demo URL.
docs/content/automation/rules_engine/scheduling.md	Adds Rules Engine scheduling documentation (Pro).
docs/content/automation/rules_engine/about.md	Updates Rules Engine docs to reflect scheduling + expanded actions.
docs/content/asset_modelling/PRO_surveys/_index.md	Adds Pro surveys docs index.
docs/content/asset_modelling/PRO_surveys/PRO__surveys.md	Adds Pro surveys documentation page.
docs/content/asset_modelling/OS_questionnaires/_index.md	Adds Open Source questionnaires docs index.
docs/content/asset_modelling/OS_questionnaires/OS__questionnaires.md	Adds Open Source questionnaires documentation page.
docs/content/admin/user_management/user_permission_chart.md	Updates permission chart with prioritization engines + scheduling permissions.
docs/config/development/params.toml	Adds dev-only docs image processing overrides to reduce OOM risk.
components/package.json	Bumps component version to 2.56.0-dev.
README.md	Simplifies Docker Compose quick start instructions and adds development docs link.
.github/workflows/update-sample-data.yml	Updates workflow to also refresh Locations fixture and uses a fixed PR branch name.

Files not reviewed (1)

• docs/package-lock.json: Language not supported

Comments suppressed due to low confidence (12)

dojo/location/models.py:1

• This changes associate_with_finding semantics: if a reference already exists, the method returns early and will never apply the provided status/auditor/audit_time. Given the signature still accepts status and audit fields, this is likely to break callers that relied on updating status through this helper. A safer approach is to get_or_create the reference (atomically) and, if status (or audit fields) are provided, call the appropriate status/audit update method on the existing/new reference.
  dojo/location/models.py:1
• This exists() + get() sequence is non-atomic and performs two queries; under concurrency it can also race with create/delete. Prefer a single get_or_create() (optionally wrapped in the existing transaction block below) and handle status updates consistently for both 'created' and 'fetched existing' cases.
  dojo/importers/endpoint_manager.py:1
• existing_finding.status_finding_non_special only exists if the queryset was built via the specific Prefetch(..., to_attr='status_finding_non_special') path. If update_endpoint_status is ever called with an existing_finding coming from a different code path, this will raise AttributeError. Consider falling back to the previous queryset expression when the attribute is missing (e.g., getattr(existing_finding, 'status_finding_non_special', existing_finding.status_finding.exclude(...))).
  dojo/importers/default_reimporter.py:1
• Same risk as in endpoint_manager.update_endpoint_status: this assumes status_finding_non_special is always present on existing_finding. If existing_finding wasn’t loaded via the reimport-mode Prefetch(..., to_attr=...), this will crash. Add a defensive fallback to the excluded queryset when the attribute is absent.
  dojo/url/ui/views.py:1
• The guard status in FindingLocationStatus is not reliably correct for all enum/choices types (it may fail for string values), yet the next line casts via FindingLocationStatus(status) which will raise if invalid. Consider validating using the choices values (e.g., status in FindingLocationStatus.values for Django TextChoices) or wrapping the cast in a try/except and treating invalid values as a no-op with an error message. Also, if finding_locations_to_update contains IDs, using location_id__in=... is clearer than location__in=....
  dojo/tools/utils.py:1
• The compression-ratio protection is bypassed when compress_size == 0. A malicious ZIP can report compress_size=0 in metadata (or store entries in ways that defeat this heuristic) while still expanding significantly on read. Consider explicitly handling compress_size == 0 when file_size > 0 as suspicious (either reject or apply a stricter limit), and ensure the ratio calculation can’t be skirted by zero/near-zero compressed sizes.
  dojo/tools/utils.py:1
• New security-critical helpers (safe_open_zip / safe_read_all_zip) were introduced, but this PR doesn’t add focused unit tests covering each rejection path (member count, per-member size, total size, ratio/zero compressed size). Adding targeted tests will help prevent regressions and ensure these limits behave as intended across Python/zipfile edge cases.
  unittests/test_import_reimport.py:1
• Returning early from a test can silently hide failures and makes test reporting less clear. Prefer self.skipTest(...) (or pytest.skip(...) depending on test framework) so the test run explicitly records the case as skipped with a reason.
  unittests/test_import_reimport.py:1
• Typo in variable name related_obects (should be related_objects). Renaming improves readability and avoids propagating the misspelling across the test.
  dojo/tool_product/views.py:1
• Raising PermissionDenied without a message results in a generic 403, which makes troubleshooting harder (and previously this path surfaced a specific mismatch message). Consider raising PermissionDenied(<clear mismatch message>) so logs/UI provide actionable context while still returning 403.
  docs/content/import_data/pro/connectors/connectors_tool_reference.md:1
• This reads as an incomplete instruction ('for example' with no example). Add an explicit example URL format (and/or where to find it in Akamai) to make the setup steps actionable.
  docs/content/asset_modelling/OS_questionnaires/OS__questionnaires.md:1
• Correct spelling of 'Questionaires' to 'Questionnaires'.