Ruff: Add and fix S105

[kiblik]

Add rule S105 and "fix" it

[dryrunsecurity]

DryRun Security Summary

The pull request includes various security-related improvements, such as enhancing the Ruff linter configuration, improving the TrivySecretsHandler class, enhancing the Trivy parser in the Dojo application security tool, and a minor update to the Check_List model in the dojo/models.py file.

Expand for full summary

Summary:

The code changes in this pull request cover various security-related improvements across multiple files in the application. The key changes include:

1. Enhancements to the Ruff linter configuration to detect hardcoded passwords, with a reasonable exception for test files.
2. Improvements to the TrivySecretsHandler class, which is responsible for handling the detection and reporting of secrets found in the application's codebase.
3. Enhancements to the Trivy parser in the Dojo application security tool, allowing for more comprehensive and detailed security reporting of vulnerabilities, misconfigurations, secrets, and license information in Docker images.
4. A minor update to the Check_List model in the dojo/models.py file, using a code comment to suppress a security warning related to the use of a hardcoded string.

Overall, these changes demonstrate a focus on improving the security posture of the application by enhancing the detection and reporting of security-related issues. The changes appear to be well-considered and follow good application security practices.

Files Changed:

1. ruff.toml: The changes to this file include the addition of the S105 rule to the select list, which checks for the presence of hardcoded passwords, and the addition of a per-file-ignores section that excludes the S105 rule for the unittests/** directory.
2. dojo/tools/trivy_operator/secrets_handler.py: The changes in this file are focused on improving the handling of secret detection and reporting, including mapping Trivy severities, generating detailed descriptions for detected secrets, and creating corresponding Finding objects.
3. dojo/tools/trivy/parser.py: The changes in this file enhance the Trivy parser in the Dojo application security tool, allowing for more comprehensive parsing and reporting of vulnerabilities, misconfigurations, secrets, and license information from Trivy scans.
4. dojo/models.py: The change in this file is a minor update to the get_status method in the Check_List model, using a code comment to suppress a security warning related to the use of a hardcoded string.

Code Analysis

We ran 9 analyzers against 4 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.