fix for Add Risk Acceptance on Finding List dropdown Not Working

[hblankenship]

[sc-7768]

Fixes issue#11010

Update path for Full Risk Acceptance when clicking the ... and choosing Add Risk Acceptance... next to a finding in the finding list.

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on the view template for a test in the Dojo application, which provides comprehensive functionality for managing tests and findings, including features for bulk editing of findings, risk acceptance, credential management, file management, and Jira integration, all of which require careful review to ensure the security and integrity of the application.

Expand for full summary

Summary:

The code changes in this pull request appear to be focused on the view template for a test in the Dojo application. The template provides a comprehensive set of functionality for managing tests and findings, including features for bulk editing of findings, risk acceptance, credential management, file management, and Jira integration.

From an application security perspective, there are several areas that should be carefully reviewed to ensure the security and integrity of the application:

1. Bulk Editing of Findings: The "Bulk Edit" feature that allows updating attributes of multiple findings at once should be reviewed to ensure that it does not introduce any security vulnerabilities, such as improper access control or data validation issues.

2. Risk Acceptance: The functionality for accepting and unaccepting the risk of findings should be reviewed to ensure that it is properly implemented and does not allow the acceptance of high-risk vulnerabilities.

3. Credential Management: The section for managing credentials associated with the test should be reviewed to ensure that sensitive credential information is properly protected and that access to these credentials is properly controlled.

4. File Management: The file management functionality should be reviewed to ensure that file uploads and downloads are properly validated and sanitized to prevent security vulnerabilities such as remote code execution or directory traversal attacks.

5. Jira Integration: The Jira integration should be reviewed to ensure that it does not introduce any security vulnerabilities, such as improper data handling or authorization issues.

Files Changed:

• dojo/templates/dojo/view_test.html: This file is a Django template for the view of a test in the Dojo application. The template includes functionality for managing the test, such as editing, copying, and deleting it, as well as adding new findings and managing files associated with the test. The template also includes features for bulk editing of findings, risk acceptance, credential management, file management, and Jira integration, which should be carefully reviewed for potential security vulnerabilities.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Fixes #11010

[mtesauro]

Approved