Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Notes on Findings for Simple Risk Acceptance #11482

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Notes on Findings for Simple Risk Acceptance #11482

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions dojo/api_v2/serializers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
from rest_framework.fields import DictField, MultipleChoiceField

import dojo.jira_link.helper as jira_helper
import dojo.risk_acceptance.helper as ra_helper
from dojo.authorization.authorization import user_has_permission
from dojo.authorization.roles_permissions import Permissions
from dojo.endpoint.utils import endpoint_filter, endpoint_meta_import
Expand Down Expand Up @@ -111,7 +112,6 @@
Vulnerability_Id_Template,
get_current_date,
)
from dojo.risk_acceptance.helper import add_findings_to_risk_acceptance, remove_finding_from_risk_acceptance
from dojo.tools.factory import (
get_choices_sorted,
requires_file,
Expand Down Expand Up @@ -1532,7 +1532,7 @@ class RiskAcceptanceSerializer(serializers.ModelSerializer):
def create(self, validated_data):
instance = super().create(validated_data)
user = getattr(self.context.get("request", None), "user", None)
add_findings_to_risk_acceptance(user, instance, instance.accepted_findings.all())
ra_helper.add_findings_to_risk_acceptance(user, instance, instance.accepted_findings.all())
return instance

def update(self, instance, validated_data):
Expand All @@ -1548,10 +1548,10 @@ def update(self, instance, validated_data):
instance = super().update(instance, validated_data)
user = getattr(self.context.get("request", None), "user", None)
# Add the new findings
add_findings_to_risk_acceptance(user, instance, findings_to_add)
ra_helper.add_findings_to_risk_acceptance(user, instance, findings_to_add)
# Remove the ones that were not present in the payload
for finding in findings_to_remove:
remove_finding_from_risk_acceptance(user, instance, finding)
ra_helper.remove_finding_from_risk_acceptance(user, instance, finding)
return instance

@extend_schema_field(serializers.CharField())
Expand Down Expand Up @@ -1767,6 +1767,13 @@ def get_related_fields(self, obj):
def get_display_status(self, obj) -> str:
return obj.status()

def process_risk_acceptance(self, data):
is_risk_accepted = data.get("risk_accepted", False)
if is_risk_accepted and not self.instance.risk_accepted and self.instance.test.engagement.product.enable_simple_risk_acceptance and not data.get("active", False):
ra_helper.simple_risk_accept(self.context["request"].user, self.instance)
elif not is_risk_accepted and self.instance.risk_accepted: # turning off risk_accepted
ra_helper.risk_unaccept(self.context["request"].user, self.instance)

# Overriding this to push add Push to JIRA functionality
def update(self, instance, validated_data):
# remove tags from validated data and store them seperately
Expand Down Expand Up @@ -1842,6 +1849,10 @@ def validate(self, data):
msg = "Active findings cannot be risk accepted."
raise serializers.ValidationError(msg)

# assuming we made it past the validations,call risk acceptance properly to make sure notes, etc get created
# doing it here instead of in update because update doesn't know if the value changed
self.process_risk_acceptance(data)

return data

def validate_severity(self, value: str) -> str:
Expand Down
Loading