- 
-
+
+
+
+
+
+
+
+
+
+
+
|
-
- |
-
-
|
-
|---|---|
|
+
+
+
+ |
+
+
+
+ |
+
](https://owasp-slack.herokuapp.com/)
+[](https://owasp.org/slack/invite)
[
](https://www.linkedin.com/company/defectdojo)
[
](https://twitter.com/defectdojo)
[
](https://www.youtube.com/channel/UCWw9qzqptiIvTqSqhOFuCuQ)
-[Join the slack community](https://owasp.org/slack/invite) and discussion! Realtime discussion is done in the OWASP Slack Channel, #defectdojo.
-Follow DefectDojo on [Twitter](https://twitter.com/defectdojo), [Linkedin](https://www.linkedin.com/company/defectdojo), and [YouTube](https://www.youtube.com/channel/UCWw9qzqptiIvTqSqhOFuCuQ) for project updates!
+[Join the OWASP Slack community](https://owasp.org/slack/invite) and participate in the discussion! You can find us in
+our channel there, [#defectdojo](https://owasp.slack.com/channels/defectdojo). Follow DefectDojo on
+[Twitter](https://twitter.com/defectdojo), [LinkedIn](https://www.linkedin.com/company/defectdojo), and
+[YouTube](https://www.youtube.com/channel/UCWw9qzqptiIvTqSqhOFuCuQ) for project updates!
## Contributing
-:warning: Please note that DefectDojo will soon stop accepting new features to stabilize the API and data model for a
-forthcoming v3 release. See the contributing guidelines below for more details. :warning:
+:warning: We have instituted a [feature freeze](https://github.com/DefectDojo/django-DefectDojo/discussions/8002) on v2
+of DefectDojo as we begin work on v3. Please see our [contributing guidelines](readme-docs/CONTRIBUTING.md) for more
+information. Check out our latest update on v3 [here](https://github.com/DefectDojo/django-DefectDojo/discussions/8974).
-See our [Contributing guidelines](readme-docs/CONTRIBUTING.md)
+## Pro Edition
+[Upgrade to DefectDojo Pro](https://www.defectdojo.com/pricing) today to take your DevSecOps to 11. DefectDojo Pro is
+designed to meet you wherever you are on your security journey and help you scale, with enhanced dashboards, additional
+smart features, tunable deduplication, and support from DevSecOps experts.
-## Commercial Support and Training
-[Commercial support and training is availaible.](https://www.defectdojo.com/) For information please email info@defectdojo.com.
+Alternatively, for information please email info@defectdojo.com
## About Us
DefectDojo is maintained by:
-* Greg Anderson ([@devGregA](https://github.com/devgrega) | [linkedin](https://www.linkedin.com/in/g-anderson/))
-* Matt Tesauro ([@mtesauro](https://github.com/mtesauro) | [linkedin](https://www.linkedin.com/in/matttesauro/) | [@matt_tesauro](https://twitter.com/matt_tesauro))
+* Greg Anderson ([@devGregA](https://github.com/devgrega) | [LinkedIn](https://www.linkedin.com/in/g-anderson/))
+* Matt Tesauro ([@mtesauro](https://github.com/mtesauro) | [LinkedIn](https://www.linkedin.com/in/matttesauro/) |
+ [@matt_tesauro](https://twitter.com/matt_tesauro))
Core Moderators can help you with pull requests or feedback on dev ideas:
-* Cody Maffucci ([@Maffooch](https://github.com/maffooch) | [linkedin](https://www.linkedin.com/in/cody-maffucci))
+* Cody Maffucci ([@Maffooch](https://github.com/maffooch) | [LinkedIn](https://www.linkedin.com/in/cody-maffucci))
Moderators can help you with pull requests or feedback on dev ideas:
-* Damien Carol ([@damnielcarol](https://github.com/damiencarol) | [linkedin](https://www.linkedin.com/in/damien-carol/))
+* Damien Carol ([@damiencarol](https://github.com/damiencarol) | [LinkedIn](https://www.linkedin.com/in/damien-carol/))
* Jannik Jürgens ([@alles-klar](https://github.com/alles-klar))
* Dubravko Sever ([@dsever](https://github.com/dsever))
-
+* Charles Neill ([@cneill](https://github.com/cneill) | [@ccneill](https://twitter.com/ccneill))
+* Jay Paz ([@jjpaz](https://twitter.com/jjpaz))
+* Blake Owens ([@blakeaowens](https://github.com/blakeaowens))
## Hall of Fame
-* Valentijn Scholten ([@valentijnscholten](https://github.com/valentijnscholten) | [sponsor](https://github.com/sponsors/valentijnscholten) | [linkedin](https://www.linkedin.com/in/valentijn-scholten/)) - Valentijn served as a core moderator for 3 years. Valentijn’s contributions were numerous and extensive. He overhauled, improved, and optimized many parts of the codebase. He consistently fielded questions, provided feedback on pull requests, and provided a helping hand wherever it was needed.
-* Fred Blaise ([@madchap](https://github.com/madchap) | [linkedin](https://www.linkedin.com/in/fredblaise/)) - Fred served as a core moderator during a critical time for DefectDojo. He contributed code, helped the team stay organized, and architected important policies and procedures.
-* Charles Neill ([@ccneill](https://twitter.com/ccneill)) – Charles served as a
- DefectDojo Maintainer for years and wrote some of Dojo's core functionality.
-* Jay Paz ([@jjpaz](https://twitter.com/jjpaz)) – Jay was a DefectDojo
- maintainer for years. He performed Dojo's first UI overhaul, optimized code structure/features, and added numerous enhancements.
+* Valentijn Scholten ([@valentijnscholten](https://github.com/valentijnscholten) |
+ [Sponsor](https://github.com/sponsors/valentijnscholten) |
+ [LinkedIn](https://www.linkedin.com/in/valentijn-scholten/)) - Valentijn served as a core moderator for 3 years.
+ Valentijn’s contributions were numerous and extensive. He overhauled, improved, and optimized many parts of the
+ codebase. He consistently fielded questions, provided feedback on pull requests, and provided a helping hand wherever
+ it was needed.
+* Fred Blaise ([@madchap](https://github.com/madchap) | [LinkedIn](https://www.linkedin.com/in/fredblaise/)) - Fred
+ served as a core moderator during a critical time for DefectDojo. He contributed code, helped the team stay organized,
+ and architected important policies and procedures.
+* Aaron Weaver ([@aaronweaver](https://github.com/aaronweaver) | [LinkedIn](https://www.linkedin.com/in/aweaver/)) -
+ Aaron has been a long time contributor and user of DefectDojo. He did the second major UI overhaul and his
+ contributions include automation enhancements, CI/CD engagements, increased metadata at the product level, and many
+ more.
## Security
@@ -139,4 +161,4 @@ Please report Security issues via our [disclosure policy](readme-docs/SECURITY.m
## License
-DefectDojo is licensed under the [BSD-3-Clause License](LICENSE.md)
+DefectDojo is licensed under the [BSD 3-Clause License](LICENSE.md)
diff --git a/docker-compose.yml b/docker-compose.yml
index 8f1d7606c3..8da8ddf250 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -149,7 +149,7 @@ services:
volumes:
- defectdojo_postgres:/var/lib/postgresql/data
rabbitmq:
- image: rabbitmq:3.12.8-alpine@sha256:f1a169ec5763caccdd05c35499c1441a7eacf0c8f442618ca15df4c2da96a735
+ image: rabbitmq:3.12.9-alpine@sha256:801dbe7ad31edd693418cfd6adf5294773b140a76ac43fa27637b702b51b98a5
profiles:
- mysql-rabbitmq
- postgres-rabbitmq
diff --git a/docs/content/en/getting_started/upgrading.md b/docs/content/en/getting_started/upgrading.md
deleted file mode 100644
index 5e566a5998..0000000000
--- a/docs/content/en/getting_started/upgrading.md
+++ /dev/null
@@ -1,864 +0,0 @@
----
-title: "Upgrading"
-description: "Release specific upgrading instructions"
-draft: false
-weight: 5
----
-
-Docker-compose
---------------
-
-When you deploy a vanilla docker-compose, it will create a persistent
-volume for your MySQL database. As long as your volume is there, you
-should not lose any data.
-
-### Using docker images provided in DockerHub
-
-{{% alert title="Information" color="info" %}}
-If you\'re using `latest`, then you need to pre pull the `latest` from
-DockerHub to update.
-{{% /alert %}}
-
-
-The generic upgrade method for docker-compose are as follows:
-- Pull the latest version
-
- ``` {.sourceCode .bash}
- docker pull defectdojo/defectdojo-django:latest
- docker pull defectdojo/defectdojo-nginx:latest
- ```
-
-- If you would like to use a version other than the latest, specify the version (tag) you want to upgrade to:
-
- ``` {.sourceCode .bash}
- docker pull defectdojo/defectdojo-django:1.10.2
- docker pull defectdojo/defectdojo-nginx:1.10.2
- ```
-
-- If you would like to use alpine based images, you specify the version (tag) you want to upgrade to:
-
- ``` {.sourceCode .bash}
- docker pull defectdojo/defectdojo-django:1.10.2-alpine
- docker pull defectdojo/defectdojo-nginx:1.10.2-alpine
- ```
-
-- Go to the directory where your docker-compose.yml file lives
-- Stop DefectDojo: `./dc-stop.sh`
-- Re-start DefectDojo, allowing for container recreation:
- `./dc-up-d.sh`
-- Database migrations will be run automatically by the initializer.
- Check the output via `docker-compose logs initializer` or relevant k8s command
-- If you have the initializer disabled (or if you want to be on the
- safe side), run the migration command:
- `docker-compose exec uwsgi /bin/bash -c "python manage.py migrate"`
-
-### Building your local images
-
-If you build your images locally and do not use the ones from DockerHub,
-the instructions are the same, with the caveat that you must build your images
-first.
-- Pull the latest DefectDojo changes
-
- ``` {.sourceCode .bash}
- git fetch
- git pull
- git merge origin/master
- ```
-
-Then replace the first step of the above generic upgrade method for docker-compose with: `docker-compose build`
-
-godojo installations
---------------------
-
-If you have installed DefectDojo on "iron" and wish to upgrade the installation, please see the [instructions in the repo](https://github.com/DefectDojo/godojo/blob/master/docs-and-scripts/upgrading.md).
-
-## Upgrading to DefectDojo Version 2.28.x.
-
-There are no special instruction for upgrading to 2.28.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.28.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.27.x.
-
-There are no special instruction for upgrading to 2.27.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.27.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.26.x.
-
-There are no special instruction for upgrading to 2.26.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.26.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.25.x.
-
-There are no special instruction for upgrading to 2.25.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.25.0) for the contents of the release.
-
-A few query parameters related to filtering object via API related to a products tags have been renamed to be more consistent with the other "related object tags":
-
-**Breaking Change**
-
- - Engagement
- - `product__tags__name` -> `product__tags`
- - `not_product__tags__name` -> `not_product__tags`
- - Test
- - `engagement__product__tags__name` -> `engagement__product__tags`
- - `not_engagement__product__tags__name` -> `not_engagement__product__tags`
- - Finding
- - `test__engagement__product__tags__name` -> `test__engagement__product__tags`
- - `not_test__engagement__product__tags__name` -> `not_test__engagement__product__tags`
-
-**Deprecation**
-
-The OpenAPI 2.0 Swagger API documentation is being deprecated in favor of the existing
-OpenAPI 3.0 API documentation page. The OpenAPI 2.0 Swagger API documentation page is
-slated for removal in version 2.30.0
-
-*Note*: The API has not changed in any way and behaves the same between OAPI2 and OAPI3
-
-For all other changes, check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.25.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.24.x.
-
-There are no special instruction for upgrading to 2.24.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.24.0) for the contents of the release.
-
-
-## Upgrading to DefectDojo Version 2.23.x.
-
-There is a migration from the legacy Nessus and Nessus WAS parsers to a single Tenable parser. The updated Tenable parser simply merges existing support for Nessus and Nessus WAS without introducing new functionality that could create instability
-
-There is a migration process built into the upgrade that will automatically convert exiting Nessus and Nessus WAS findings and tests into Tenable findings and tests
-
-**Breaking Change**
-
- - If there is any use of the Nessus or Nessus WAS in automated fashion via the import and reimport API endpoints, the `scan-type` parameter needs to be updated to `Tenable Scan`
- - The default containerized database will now be [PostgreSQL](https://www.postgresql.org/) rather than [MySQL](https://dev.mysql.com/) due to the use of case insensitivity on fields by default
- - It is recommended to update the [database character set and collation](https://dev.mysql.com/doc/refman/5.7/en/charset-database.html) to use UTF encoding
- - If your deployment uses the MySQL containerized database, please see the following updates to run DefectDojo:
- - Use of the helper script "dc-up": `./dc-up.sh mysql-rabbitmq` or `./dc-up.sh mysql-redis`
- - Use of the helper script "dc-up-d": `./dc-up-d.sh mysql-rabbitmq` or `./dc-up-d.sh mysql-redis`
- - Use of Docker Compose directly: `docker-compose --profile mysql-rabbitmq --env-file ./docker/environments/mysql-rabbitmq.env up` or `docker-compose --profile mysql-redis --env-file ./docker/environments/mysql-redis.env up`
-
-For all other changes, check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.23.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.22.x.
-
-There are no special instruction for upgrading to 2.22.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.22.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.21.x.
-
-There are no special instruction for upgrading to 2.21.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.21.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.20.x.
-
-There are no special instruction for upgrading to 2.20.0. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.20.0) for the contents of the release.
-
-## Upgrading to DefectDojo Version 2.19.x
-
-There are new docker images based on alpine with fewer third party dependencies. Related to the new images the current docker files had to be renamed and have a "-debian" or the new images a "-alpine" at the end. Furthermore there are new docker tags [DefectdojoVersion]-[OS]. For example 2.19.0-alpine or 2.19.0-debian. The currend tags (latest and [DefectdojoVersion]) are still based on the "old" images. Be aware that the new alpine images are not heavily tested and may contain bugs.
-
-**Breaking Change**
-
-In version 2.19.3, the GitHub OAuth integration has been removed to prevent configurations that may allow more access than intended.
-
-[DefectDojo Security Advisory: Severity Medium | Potential GitHub Authentication Misconfiguration](https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-hfp4-q5pg-2p7r)
-
-## Upgrading to DefectDojo Version 2.18.x
-
-**Upgrade instructions for helm chart with rabbitMQ enabled**: The rabbitMQ uses a statefulset by default. Before upgrading the helm chart we have to ensure that all queues are empty:
-
-```bash
-kubectl exec -i | + | Severity | +Number of Issues | +
|---|---|---|
| + | BLOCKER | ++ 0 + | +
| + | CRITICAL | ++ 2 + | +
| + | MAJOR | ++ 0 + | +
| + | MINOR | ++ 5 + | +
| Rule | +Severity | +Component | +Line | +Description | +Message | +Key | +Status | +
|---|---|---|---|---|---|---|---|
| + squid:S2975 + | ++ BLOCKER + | ++ java/org/apache/catalina/util/URLEncoder.java + | ++ 190 + | ++ "clone" should not be overridden + | ++ Remove this "clone" implementation; use a copy constructor or copy factory instead. + | ++ AWK40IMu-pl6AHs22MnV + | +TO_REVIEW | +
| Rule | +Description | +||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| squid:S864 + | +
+
+
+ The rules of operator precedence are complicated and can lead to errors. For this reason, + parentheses should be used for clarification in complex + statements. However, this does not mean that parentheses should be gratuitously added around + every operation. +This rule raises issues when
Noncompliant Code Example+
+x = a + b - c;
+x = a + 1 << b; // Noncompliant
+
+if ( a > b || c < d || a == d) {...}
+if ( a > b && c < d || a == b) {...} // Noncompliant
+if (a = f(b,c) == 1) { ... } // Noncompliant; == evaluated first
+
+ Compliant Solution+
+x = a + b - c;
+x = (a + 1) << b;
+
+if ( a > b || c < d || a == d) {...}
+if ( (a > b && c < d) || a == b) {...}
+if ( (a = f(b,c)) == 1) { ... }
+
+ See+
|
+ ||||||||||||||||||||||||||||||||||||
| squid:S2115 + | +
+
+
+ Failure to password-protect a database is so careless or naive as to be almost negligent. + Databases should always be password protected, but the + use of a database connection with an empty password is a clear indication of a database that + is not protected. +This rule flags database connections with empty passwords. +Noncompliant Code Example+
+Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "AppLogin", "");
+Connection conn2 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&password=");
+
+ Compliant Solution+
+DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&password=password");
+
+DriverManager.getConnection("jdbc:mysql://address=(host=myhost1)(port=1111)(key1=value1)(user=sandy)(password=secret),address=(host=myhost2)(port=2222)(key2=value2)(user=sandy)(password=secret)/db");
+
+DriverManager.getConnection("jdbc:mysql://sandy:secret@[myhost1:1111,myhost2:2222]/db");
+
+String url = "jdbc:postgresql://localhost/test";
+Properties props = new Properties();
+props.setProperty("user", "fred");
+props.setProperty("password", "secret");
+DriverManager.getConnection(url, props);
+
+ See+
|
+ ||||||||||||||||||||||||||||||||||||
| squid:S1148 + | +
+
+
+
Loggers should be used instead to print
This rule raises an issue when Noncompliant Code Example+
+try {
+ /* ... */
+} catch(Exception e) {
+ e.printStackTrace(); // Noncompliant
+}
+
+ Compliant Solution+
+try {
+ /* ... */
+} catch(Exception e) {
+ LOGGER.log("context", e);
+}
+
+ See+
|
+ ||||||||||||||||||||||||||||||||||||
| squid:S2975 + | +
+
+
+ Many consider + Object's clone method is very tricky. It's based on field copies, and it's "extra-linguistic." It creates an object without calling a constructor. + There are no guarantees that it preserves the invariants established by the constructors. There have been lots of bugs over the years, both in and + outside Sun, stemming from the fact that if you just call super.clone repeatedly up the chain until you have cloned an object, you have a shallow + copy of the object. The clone generally shares state with the object being cloned. If that state is mutable, you don't have two independent objects. + If you modify one, the other changes as well. And all of a sudden, you get random behavior. ++ A copy constructor or copy factory should be used instead. +This rule raises an issue when Noncompliant Code Example+
+public class MyClass {
+ // ...
+
+ public Object clone() { // Noncompliant
+ //...
+ }
+}
+
+Compliant Solution+
+public class MyClass {
+ // ...
+
+ MyClass (MyClass source) {
+ //...
+ }
+}
+
+ See+ +See Also+ + |
+