Repository navigation
fix(import): resolve the import target the same way in the permission check and the import - #16873
Merged
Maffooch merged 2 commits intoNov 13, 2026
Merged
Conversation
… check and the import The scan import permission checks read the raw request, while the import itself runs on the serializer's validated data. Two differences let them pick different targets: the serializer trims whitespace from the name fields and the raw read did not, and the import permission check read a response-only engagement field that the serializer drops. Trim the names when reading the raw request, and ignore that field in the check, so the check authorizes the same product and engagement the import writes to.
|
This pull request modifies two sensitive codepaths in the
Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/importers/auto_create_context.py' matches configured sensitive codepath pattern 'dojo/importers/*.py' and was modified by 'svader0' (commit f35c2d7) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/authorization/api_permissions.py (drs_66017f84)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/authorization/api_permissions.py' matches configured sensitive codepath pattern 'dojo/authorization/*.py' and was modified by 'svader0' (commit f35c2d7) who is not in the allowed authors list. |
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
svader0
commented
Nov 13, 2026
Collaborator
Author
|
Review summary: the check and the import now resolve the same target in the cases I tried. API v3 does not call the changed helper, so the change does not affect it. Follow-ups I am adding to this PR:
|
… checks ReImportScanSerializer drops test_id and EndpointMetaImporterSerializer drops product_id, because both are response-only fields. The permission checks still read them from the raw request. Ignore them in the checks too, so each check resolves its target the same way as its serializer. Adds reimport tests, including one for a name with surrounding spaces, and a meta import test.
Maffooch
enabled auto-merge
November 13, 2026 20:45
blakeaowens
approved these changes
Nov 13, 2026
Maffooch
approved these changes
Nov 13, 2026
devGregA
approved these changes
Nov 13, 2026
Maffooch
disabled auto-merge
November 13, 2026 20:49
Maffooch
enabled auto-merge
November 13, 2026 20:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scan imports check permissions on the raw request, before validation, and then run on the serializer's validated data. This change makes both steps read the target names and the engagement the same way, so the permission check looks at the same product and engagement the import uses. Names with leading or trailing spaces now resolve in the check the same way they do in the import. Adds tests. No functional change for correctly permissioned users.