feat(docker): Use Python 3.12 in docker images #10473

kiblik · 2024-06-28T18:53:59Z

Next try for #10333

dryrunsecurity · 2024-06-28T18:54:25Z

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code changes are related to updating the base Docker images used in the deployment of a Django-based application. The key changes include:

Upgrading the base Python image from version 3.11.9 to 3.12.4 across multiple Dockerfiles, which is a good security practice to ensure the application is running on the latest version with the latest security patches and bug fixes.
Ensuring the necessary dependencies are installed, such as system-level libraries, web server configurations (Nginx), and testing-specific tools (Chrome, ChromeDriver, OpenAPI Generator), to provide a complete and consistent environment for the application.
Implementing security best practices, such as running the application as a non-root user, using environment variables to manage sensitive information, and verifying the integrity of downloaded packages.
Addressing deprecation warnings and improving the user interface by updating the Django form renderer configuration.

From an application security perspective, the changes appear to be focused on maintaining the security and stability of the application's deployment environment. The updates to the base Python image, dependency management, and security-related configurations are all positive steps towards ensuring the overall security posture of the application.

Files Changed:

Dockerfile.django-debian: Updates the base Python image from 3.11.9 to 3.12.4, following security best practices such as using a slim-based image, installing only necessary dependencies, and running the application as a non-root user.
Dockerfile.django-alpine: Similar to the changes in Dockerfile.django-debian, this file updates the base Python image and installs the necessary dependencies for the Django application, also following security best practices.
Dockerfile.integration-tests-debian: Updates the base Python image and installs additional dependencies required for running integration tests with Selenium and Google Chrome, ensuring a secure and consistent testing environment.
Dockerfile.nginx-alpine: Updates the base Python image and includes the configuration for the Nginx web server, including TLS/SSL settings and metrics monitoring, which should be carefully reviewed for security implications.
Dockerfile.nginx-debian: Similar to the changes in Dockerfile.nginx-alpine, this file updates the base Python image and includes the Nginx web server configuration.
dojo/settings/settings.dist.py: Addresses a deprecation warning related to the pkg_resources module and updates the default renderer for Django forms, improving the user interface.

Powered by DryRun Security

github-actions · 2024-07-08T16:44:46Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-07-08T17:19:16Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dryrunsecurity · 2024-07-08T18:59:10Z

DryRun Security Summary

This pull request updates various Dockerfiles and configuration files for the DefectDojo application, focusing on updating dependencies, improving build processes, and enhancing security-related settings to ensure the latest security patches are applied and secure practices are implemented.

Expand for full summary

Summary:

The code changes in this pull request cover various Dockerfiles and configuration files for the DefectDojo application, with a focus on updating dependencies, improving build processes, and enhancing security-related settings.

The key security-related changes include:

Updating base image versions, such as Python and nginx, to ensure the latest security patches are applied.
Installing necessary system dependencies and managing their versions to mitigate potential security vulnerabilities.
Implementing secure practices, such as using dedicated user accounts, managing permissions, and caching dependencies to improve build reproducibility.
Reviewing and updating security-related settings in the Django configuration file, including CSRF protection, session cookies, HTTPS redirection, authentication methods, and file upload restrictions.
Ensuring the integrity of the Django configuration file by updating the checksum file.

While the changes generally appear to be focused on improving the application's security and stability, it is important to thoroughly review the actual code changes, test the application's functionality, and monitor the deployed environment for any potential security issues.

Files Changed:

Dockerfile.integration-tests-debian: Updates the base Python image and installs dependencies for running integration tests, including Google Chrome and ChromeDriver. The use of hardcoded version URLs should be reviewed for potential security implications.
Dockerfile.django-alpine: Updates the base Python image and installs various system dependencies for the Django-based application running on Alpine Linux. The changes focus on improving the build process and managing user/permission settings.
Dockerfile.nginx-alpine: Updates the base images and dependencies for the nginx-based Docker image, including Python, Node.js, Yarn, and nginx itself. The changes also update the nginx configuration files, which should be reviewed for security best practices.
Dockerfile.django-debian: Updates the base Python image and installs system dependencies for the Django-based application running on Debian. The changes focus on improving the build process and managing user/permission settings.
Dockerfile.nginx-debian: Updates the base Python image used for the NGINX-Debian deployment, which may introduce changes in the language, standard library, and third-party dependencies.
dojo/settings/.settings.dist.py.sha256sum: The checksum file for the Django settings file has been updated, indicating that the actual settings file has been modified. The changes to the settings file should be reviewed to ensure that no security vulnerabilities have been introduced.
dojo/settings/settings.dist.py: The Django settings file has been updated with various changes, including security-related settings, authentication configurations, and Defect Dojo-specific settings. These changes should be carefully reviewed to ensure that the application's security posture is maintained.

Code Analysis

We ran 9 analyzers against 7 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

github-actions · 2024-07-12T22:25:50Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2024-08-30T07:57:41Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2024-09-10T14:33:04Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

Maffooch · 2025-01-29T21:10:04Z

Hey @kiblik I'm closing this one out for now until are ready to make this move

github-actions · 2025-08-26T05:01:14Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2025-08-26T06:44:28Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

kiblik · 2025-08-27T13:06:25Z

@mtesauro, @Maffooch 🙏

kiblik · 2025-08-27T17:04:20Z

@valentijnscholten, can we target this PR to 2.50.0 as well?

mtesauro · 2025-08-27T17:04:29Z

We have a bunch of changes landing in 2.50.0 so I wonder if it makes sense to hold off till 2.51.0 for this change.

github-actions · 2025-09-02T17:16:38Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2025-09-03T20:00:40Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

dryrunsecurity · 2025-09-03T20:01:43Z

🟡 Please give this pull request extra attention during review.

This pull request introduces notification descriptions in dojo/jira_link/views.py that directly interpolate user-controlled values (jform.cleaned_data['configuration_name'] and request.user) into f-strings without any escaping or encoding, creating a stored/reflected XSS risk when those descriptions are later rendered. The unsafe interpolations appear in multiple places (around the post method and edit flows) and could allow attackers to inject HTML/JS into notifications or pages.

🟡 Potential Cross-Site Scripting in dojo/jira_link/views.py

Vulnerability	Potential Cross-Site Scripting
Description	In dojo/jira_link/views.py (post method, around the change at line ~387) the patch interpolates user-controlled data directly into a notification description: description=f'JIRA "{jform.cleaned_data.get('configuration_name')}" was added by {request.user}'. The value returned from jform.cleaned_data['configuration_name'] comes from form input (user-supplied) and request.user (e.g. username) can also contain attacker-controlled content. Those values are passed into create_notification without any escaping or sanitization. If create_notification stores and later renders the description into an HTML response without proper output encoding, an attacker could supply markup or script in the configuration_name or user fields to produce stored XSS (malicious script executed in other users' browsers).

django-DefectDojo/dojo/jira_link/views.py

Lines 387 to 393 in 64ad8e9

    
           create_notification( 
        
               event="jira_config_added", 
        
               title=f"New addition of JIRA: {jform.cleaned_data.get('configuration_name')}", 
        
               description=f'JIRA "{jform.cleaned_data.get('configuration_name')}" was added by {request.user}', 
        
               url=request.build_absolute_uri(reverse("jira"))) 
        
           return HttpResponseRedirect(reverse("jira"))

🟡 Potential Cross-Site Scripting in dojo/jira_link/views.py

Vulnerability	Potential Cross-Site Scripting
Description	In dojo/jira_link/views.py the patch adds the following interpolation in post(): description=f'JIRA "{jform.cleaned_data.get('configuration_name')}" was added by {request.user}', This inserts user-controlled data (jform.cleaned_data.get('configuration_name')) directly into a notification description without any escaping or encoding. jform.cleaned_data is populated from form input and can contain attacker-controlled values; interpolating it into a string that is likely stored and later rendered in HTML (notifications UI, pages, or JS-driven popups) creates a vector for stored or reflected XSS if that description is rendered into responses without proper output encoding. Additionally, {request.user} is interpolated and may include attacker-controllable display names. Because the change introduces raw user-supplied content into a field that will be shown to users, it can lead to cross-site scripting when rendered in an HTML/JS context.

django-DefectDojo/dojo/jira_link/views.py

Lines 432 to 438 in 64ad8e9

    
           create_notification( 
        
               event="jira_config_added", 
        
               title=f"New addition of JIRA: {jform.cleaned_data.get('configuration_name')}", 
        
               description=f'JIRA "{jform.cleaned_data.get('configuration_name')}" was added by {request.user}', 
        
               url=request.build_absolute_uri(reverse("jira"))) 
        
           return HttpResponseRedirect(reverse("jira"))

🟡 Potential Cross-Site Scripting in dojo/jira_link/views.py

Vulnerability	Potential Cross-Site Scripting
Description	In dojo/jira_link/views.py (hunk around line 486) the patch adds a notification description constructed with an f-string that directly interpolates potentially attacker-controlled values: description=f'JIRA "{jform.cleaned_data.get("configuration_name")}" was edited by {request.user}'. The interpolated values are: - jform.cleaned_data.get('configuration_name'): comes from form input (user-supplied configuration name). - request.user: its string representation (username) can be controlled by a user account. Those values are concatenated into the notification description with no escaping or encoding at the point of construction. If create_notification persists this description and it is later rendered into an HTML response or notification UI without proper output-encoding/escaping, an attacker could include HTML or JavaScript in the configuration_name or username and cause stored XSS. The change therefore introduces a direct flow of unsanitized user input into content that is likely to be rendered to users, which can lead to cross-site scripting.

django-DefectDojo/dojo/jira_link/views.py

Lines 486 to 492 in 64ad8e9

    
           create_notification( 
        
               event="jira_config_edited", 
        
               title=f"Edit of JIRA: {jform.cleaned_data.get('configuration_name')}", 
        
               description=f'JIRA "{jform.cleaned_data.get('configuration_name')}" was edited by {request.user}', 
        
               url=request.build_absolute_uri(reverse("jira"))) 
        
           return HttpResponseRedirect(reverse("jira"))

All finding details can be found in the DryRun Security Dashboard.

Try to exclude pkg_resources warning Exclude datetime.datetime.utcnow Apply regex Fix regex Be more specific for filterwarnings Correct module name Try to exclude only based on module

kiblik · 2025-09-05T13:40:40Z

I believe, this might be reviewed and merged.

mtesauro

Approved

github-actions · 2025-09-10T20:16:13Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

github-actions · 2025-09-10T20:36:01Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions bot added the docker label Jun 28, 2024

kiblik closed this Jun 28, 2024

kiblik reopened this Jun 28, 2024

kiblik force-pushed the docker_python3.12 branch from 61b50d1 to 0b10ebe Compare July 2, 2024 08:52

github-actions bot added the conflicts-detected label Jul 8, 2024

kiblik force-pushed the docker_python3.12 branch from 0b10ebe to aad6158 Compare July 8, 2024 17:02

github-actions bot added the settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR label Jul 8, 2024

kiblik force-pushed the docker_python3.12 branch from aad6158 to 5fcbb12 Compare July 8, 2024 17:10

github-actions bot removed the conflicts-detected label Jul 8, 2024

kiblik force-pushed the docker_python3.12 branch 2 times, most recently from d38b2b0 to f290717 Compare July 9, 2024 07:39

kiblik mentioned this pull request Jul 9, 2024

Bump pygithub from 1.58.2 to 2.3.0 #9948

Closed

github-actions bot added the conflicts-detected label Jul 12, 2024

kiblik force-pushed the docker_python3.12 branch from f290717 to 823092d Compare July 12, 2024 23:01

kiblik force-pushed the docker_python3.12 branch from 823092d to cfd27eb Compare August 30, 2024 07:57

github-actions bot removed the conflicts-detected label Aug 30, 2024

kiblik closed this Aug 30, 2024

kiblik reopened this Aug 30, 2024

github-actions bot added the conflicts-detected label Sep 10, 2024

Maffooch closed this Jan 29, 2025

kiblik mentioned this pull request Feb 10, 2025

Bump python from 3.11.9-slim-bookworm to 3.13.2-slim-bookworm #11781

Closed

kiblik mentioned this pull request May 20, 2025

Bump pygithub from 1.58.2 to 2.6.1 #11886

Merged

github-actions bot added the conflicts-detected label Aug 26, 2025

kiblik force-pushed the docker_python3.12 branch from 75966e4 to cf7c2d0 Compare August 26, 2025 06:44

github-actions bot removed the conflicts-detected label Aug 26, 2025

valentijnscholten added this to the 2.51.0 milestone Aug 28, 2025

github-actions bot added the conflicts-detected label Sep 2, 2025

kiblik force-pushed the docker_python3.12 branch from cf7c2d0 to e6e52d5 Compare September 3, 2025 20:00

github-actions bot removed the conflicts-detected label Sep 3, 2025

feat(docker): Use Python 3.12 in docker images

8655614

Try to exclude pkg_resources warning Exclude datetime.datetime.utcnow Apply regex Fix regex Be more specific for filterwarnings Correct module name Try to exclude only based on module

kiblik force-pushed the docker_python3.12 branch from e6e52d5 to 8655614 Compare September 3, 2025 20:05

Maffooch approved these changes Sep 10, 2025

View reviewed changes

Maffooch requested review from blakeaowens and dogboat September 10, 2025 20:04

mtesauro approved these changes Sep 10, 2025

View reviewed changes

blakeaowens approved these changes Sep 10, 2025

View reviewed changes

github-actions bot added the conflicts-detected label Sep 10, 2025

Merge branch 'dev' into docker_python3.12

64ad8e9

github-actions bot removed the conflicts-detected label Sep 10, 2025

Maffooch merged commit c52c5bc into DefectDojo:dev Sep 10, 2025
84 checks passed

kiblik deleted the docker_python3.12 branch September 10, 2025 22:03

feat(docker): Use Python 3.12 in docker images #10473

feat(docker): Use Python 3.12 in docker images #10473

Uh oh!

Conversation

kiblik commented Jun 28, 2024

Uh oh!

dryrunsecurity bot commented Jun 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 8, 2024

Uh oh!

github-actions bot commented Jul 8, 2024

Uh oh!

dryrunsecurity bot commented Jul 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DryRun Security Summary

Code Analysis

Riskiness

Uh oh!

github-actions bot commented Jul 12, 2024

Uh oh!

github-actions bot commented Aug 30, 2024

Uh oh!

github-actions bot commented Sep 10, 2024

Uh oh!

Maffooch commented Jan 29, 2025

Uh oh!

github-actions bot commented Aug 26, 2025

Uh oh!

github-actions bot commented Aug 26, 2025

Uh oh!

kiblik commented Aug 27, 2025

Uh oh!

kiblik commented Aug 27, 2025

Uh oh!

mtesauro commented Aug 27, 2025

Uh oh!

github-actions bot commented Sep 2, 2025

Uh oh!

github-actions bot commented Sep 3, 2025

Uh oh!

dryrunsecurity bot commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟡 Please give this pull request extra attention during review.

Uh oh!

kiblik commented Sep 5, 2025

Uh oh!

mtesauro left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Sep 10, 2025

Uh oh!

github-actions bot commented Sep 10, 2025

Uh oh!

Uh oh!

Uh oh!

dryrunsecurity bot commented Jun 28, 2024 •

edited

Loading

dryrunsecurity bot commented Jul 8, 2024 •

edited

Loading

dryrunsecurity bot commented Sep 3, 2025 •

edited

Loading