🐛 Remove unselected parsers from filters and test types

[manuel-sommer]

#13761
#7386

[valentijnscholten]

Do you have screenshots of other places where the list is shown?

Import form:

API spec:

[valentijnscholten]

I wonder if we have conflicting/overlapping settings here. If you go to https://demo.defectdojo.org/test_type you can already mark test types (scanners) as active or inactive. I haven't looked at the code yet, but do we need two different ways to activate/deactivate scanners? The solution via an env variable is less flexible as it requires sysadmin involvement and restarts to change. wdyt @Maffooch

[manuel-sommer]

I wonder if we have conflicting/overlapping settings here. If you go to https://demo.defectdojo.org/test_type you can already mark test types (scanners) as active or inactive. I haven't looked at the code yet, but do we need two different ways to activate/deactivate scanners? The solution via an env variable is less flexible as it requires sysadmin involvement and restarts to change. wdyt @Maffooch

You are right @valentijnscholten, looks like a duplicate. Then, the better option would be to remove the env way.

[valentijnscholten]

Maybe the intention was to have some sort of "company wide exclusion" via the env variable and then allow security teams to enable/disable on top of that? I don't know.

[manuel-sommer]

Maybe the intention was to have some sort of "company wide exclusion" via the env variable and then allow security teams to enable/disable on top of that? I don't know.

If we keep both, we should add documentation.

[Maffooch]

I think the active flag on individual test types is sufficient. There are also some helpers to exclude inactive scanners for import/reimport forms:

django-DefectDojo/dojo/tools/factory.py

Lines 50 to 68 in a85bbba

	def get_inactive_test_types():
	try:
	return list(Test_Type.objects.filter(active=False).values_list("name", flat=True))
	except Exception:
	# This exception is reached in the event of loading fixtures in to an empty database
	# prior to migrations runnings
	return []
	def get_scan_types_sorted():
	inactive_test_types = get_inactive_test_types()
	res = [(key, PARSERS[key].get_description_for_scan_types(key)) for key in PARSERS if key not in inactive_test_types]
	return sorted(res, key=lambda x: x[0].lower())
	def get_choices_sorted():
	inactive_test_types = get_inactive_test_types()
	res = [(key, PARSERS[key].get_label_for_scan_types(key)) for key in PARSERS if key not in inactive_test_types]
	return sorted(res, key=lambda x: x[1].lower())

[manuel-sommer]

FYI: I will remove the functionality (PARSER_EXCLUDE in settings) within a PR against dev as this is a breaking change.
In this PR I will move forward to fix the inactive part to remove them from the filters etc.

[valentijnscholten]

Might be better to do all of it in one PR in dev. If we split it up people might get confused if the parser exclude setting is still there. Wdyt?

[Maffooch]

Might be better to do all of it in one PR in dev. If we split it up people might get confused if the parser exclude setting is still there. Wdyt?

I agree with this thinking

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[manuel-sommer]

Please review @valentijnscholten
I rebased the PR onto dev, removed DD_PARSER_EXCLUDE, adjusted the filter to exclude the inactive test types and exclude them also within the import.

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request makes sensitive edits to multiple files (dojo/filters.py, dojo/finding/views.py, and dojo/utils.py) and includes an information disclosure issue where get_visible_scan_types() in dojo/finding/views.py returns all active Test_Type objects without authorization checks, potentially exposing internal scan/type information to unauthorized users.

🔴 Configured Codepaths Edit in dojo/filters.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Information Disclosure in dojo/finding/views.py

Vulnerability

Information Disclosure

Description

The get_visible_scan_types() function, called within the get_initial_context method of a view, retrieves all active Test_Type objects without any authorization checks. This means that any authenticated user accessing this view could potentially see a list of all active scan types configured in the system. If these Test_Type objects contain sensitive information, such as names of internal-only tools, custom scanners, or proprietary processes, this constitutes an information disclosure. This provides reconnaissance information to a low-privileged user, which could aid in further attacks.

django-DefectDojo/dojo/finding/views.py

Lines 303 to 309 in c9f34c2

	"enable_table_filtering": get_system_setting("enable_ui_table_based_searching"),
	"title_words": get_words_for_field(Finding, "title"),
	"component_words": get_words_for_field(Finding, "component_name"),
	"visible_test_types": get_visible_scan_types(),
	}
	# Look to see if the product was used
	if product_id := self.get_product_id():

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.