Release: Merge back 2.47.1 into dev from: master-into-dev/2.47.1-2.48.0-dev #12573
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
….48.0-dev Release: Merge back 2.47.0 into bugfix from: master-into-bugfix/2.47.0-2.48.0-dev
* Update pro_features.md Add Deduplication Tuning section and link to X-tool deduplication screenshot. * Deduplication X tool Deduplication image image showing cross-tool deduplication screenshot * Initial version - Deduplication Tuning documentation of deduplication tuning * Deduplication Settings Menu * Additional screenshots for deduplication tuning Same tool, cross tool, reimport deduplication screenshots with menu selection. * Update tune_deduplication.md Added additional information about retroactive execution of deduplication adjustments. * Update pro_features.md Cleaned up language about deduplication, increase technical specificity + less markety. Added newlines for "See our guide for more information" . Some had it / others didn't - easier navigation visually & to links for more info. * Update docs/content/en/working_with_findings/finding_deduplication/tune_deduplication.md * We love the Oxford comma :) Co-authored-by: Harold Blankenship <[email protected]> --------- Co-authored-by: Cody Maffucci <[email protected]> Co-authored-by: Harold Blankenship <[email protected]>
* update changelog 2.47.0 * change article titles * change headers for sidebar --------- Co-authored-by: Paul Osinski <[email protected]>
* SAML Login: Respect `next` parameter When logging in with SAML, the `next` parameter is not respected like it is for other SSO providers * Add pre-wrapper * Add trailing name
Release: Merge release into master from: release/2.47.1
🔴 Risk threshold exceeded.This pull request contains an open redirect vulnerability in the SAML2 login link that could allow attackers to redirect users to arbitrary external sites, and includes sensitive edits to base and login template files that may require additional review or configuration in
|
| Vulnerability | Open Redirect |
|---|---|
| Description | The SAML2 login link constructs a redirect URL using unvalidated user input from request.GET.next. This allows an attacker to potentially redirect users to an arbitrary external site after login, which could be used for phishing or other malicious purposes. Best practices recommend validating and sanitizing redirect URLs, preferably using an allow-list of trusted destinations. |
django-DefectDojo/dojo/templates/dojo/login.html
Lines 97 to 103 in a38f8cd
⚠️ Configured Codepaths Edit in dojo/templates/base.html
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
⚠️ Configured Codepaths Edit in dojo/templates/base.html
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
⚠️ Configured Codepaths Edit in dojo/templates/dojo/login.html
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Release triggered by
rossops