Skip to content

Commit e2dfbe4

Browse files
aaronweaveraaronweaver
committed
Added criticality justification, steps to reproduce, hotkey fix and sla update
1 parent ad78cfc commit e2dfbe4

File tree

10 files changed

+103
-22
lines changed

10 files changed

+103
-22
lines changed

‎dojo/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# Django starts so that shared_task will use this app.
55
from .celery import app as celery_app # noqa
66

7-
__version__ = '1.5.0'
7+
__version__ = '1.5.1'
88
__url__ = 'https://github.com/DefectDojo/django-DefectDojo'
99
__docs__ = 'http://defectdojo.readthedocs.io/'
1010
__demo__ = 'http://defectdojo.pythonanywhere.com/'

‎dojo/models.py‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -933,10 +933,12 @@ class Finding(models.Model):
933933
date = models.DateField(default=get_current_date)
934934
cwe = models.IntegerField(default=0, null=True, blank=True)
935935
url = models.TextField(null=True, blank=True, editable=False)
936-
severity = models.CharField(max_length=200)
936+
severity = models.CharField(max_length=200, help_text="The severity level of this flaw (Critical, High, Medium, Low, Informational)")
937937
description = models.TextField()
938938
mitigation = models.TextField()
939939
impact = models.TextField()
940+
steps_to_reproduce = models.TextField(null=True, blank=True)
941+
severity_justification = models.TextField(null=True, blank=True)
940942
endpoints = models.ManyToManyField(Endpoint, blank=True, )
941943
unsaved_endpoints = []
942944
unsaved_request = None
@@ -1086,10 +1088,19 @@ def age(self):
10861088
return days if days > 0 else 0
10871089

10881090
def sla(self):
1091+
sla_calculation = None
10891092
severity = self.severity
10901093
from dojo.utils import get_system_setting
10911094
sla_age = get_system_setting('sla_' + self.severity.lower())
1092-
return sla_age - self.age()
1095+
if sla_age and self.active:
1096+
sla_calculation = sla_age - self.age()
1097+
elif sla_age and self.mitigated:
1098+
age = self.age()
1099+
if age < sla_age:
1100+
sla_calculation = 0
1101+
else:
1102+
sla_calculation = sla_age - age
1103+
return sla_calculation
10931104

10941105
def jira(self):
10951106
try:

‎dojo/static/dojo/css/dojo.css‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -551,6 +551,14 @@ form ul#id_accepted_findings input {
551551
background-color: green;
552552
}
553553

554+
.age-blue {
555+
background-color: blue;
556+
}
557+
558+
.age-orange {
559+
background-color: #EE7600;
560+
}
561+
554562
.dojo-search {
555563
clear: right !important;
556564
display: inline-block !important;

‎dojo/templates/dojo/engagement_pdf_report.html‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,14 @@ <h6>Response {{forloop.counter}}</h6>
329329

330330
<h6>Impact</h6>
331331
<pre>{{ finding.impact|markdown_render }}</pre>
332+
{% if finding.steps_to_reproduce %}
333+
<h6>Steps to Reproduce</h6>
334+
<pre>{{ finding.steps_to_reproduce|markdown_render }}</pre>
335+
{% endif %}
336+
{% if finding.severity_justification %}
337+
<h6>Severity Justification</h6>
338+
<pre>{{ finding.severity_justification|markdown_render }}</pre>
339+
{% endif %}
332340
<h6>References</h6>
333341
<pre>{{ finding.references|markdown_render }}</pre>
334342
{% if include_finding_images %}

‎dojo/templates/dojo/product_pdf_report.html‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,14 @@ <h6>Response {{forloop.counter}}</h6>
311311

312312
<h6>Impact</h6>
313313
<pre>{{ finding.impact|markdown_render }}</pre>
314+
{% if finding.steps_to_reproduce %}
315+
<h6>Steps to Reproduce</h6>
316+
<pre>{{ finding.steps_to_reproduce|markdown_render }}</pre>
317+
{% endif %}
318+
{% if finding.severity_justification %}
319+
<h6>Severity Justification</h6>
320+
<pre>{{ finding.severity_justification|markdown_render }}</pre>
321+
{% endif %}
314322
{% if finding.references %}
315323
<h6>References</h6>
316324
<pre>{{ finding.references|markdown_render }}</pre>

‎dojo/templates/dojo/test_pdf_report.html‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,14 @@ <h6>Response {{forloop.counter}}</h6>
312312

313313
<h6>Impact</h6>
314314
<pre>{{ finding.impact|markdown_render }}</pre>
315+
{% if finding.steps_to_reproduce %}
316+
<h6>Steps to Reproduce</h6>
317+
<pre>{{ finding.steps_to_reproduce|markdown_render }}</pre>
318+
{% endif %}
319+
{% if finding.severity_justification %}
320+
<h6>Severity Justification</h6>
321+
<pre>{{ finding.severity_justification|markdown_render }}</pre>
322+
{% endif %}
315323
<h6>References</h6>
316324
<pre>{{ finding.references|markdown_render }}</pre>
317325
{% if include_finding_images %}

‎dojo/templates/dojo/view_eng.html‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -436,7 +436,7 @@ <h3 class="panel-title"><span class="fa fa-info-circle fa-fw" aria-hidden="true"
436436
</div>
437437
{% if eng.engagement_type == "CI/CD" %}
438438
<div>
439-
<div class="panel panel-default">
439+
<div class="panel panel-default-secondary">
440440
<div class="panel-heading">
441441
<h3 class="panel-title"><span class="fa fa-server" aria-hidden="true"></span>
442442
CI/CD Engagement Details
@@ -593,18 +593,21 @@ <h4><span class="fa fa-key" aria-hidden="true"></span>
593593
{% endblock %}
594594
{% block postscript %}
595595
<script type="text/javascript" src="{% static "jquery-highlight/jquery.highlight.js" %}"></script>
596+
<script type="application/javascript" src="{% static "jquery.hotkeys/jquery.hotkeys.js" %}"></script>
596597
<script type="text/javascript">
597598
$(function () {
598-
$(document).on('keypress', function(e) {
599-
var key = String.fromCharCode(e.which);
600-
if (key =='e') {
601-
window.location.assign('{% url 'edit_engagement' eng.id %}');
602-
} else if (key === 'a') {
603-
window.location.assign('{% url 'add_tests' eng.id %}');
604-
} else if (key === 'i') {
605-
window.location.assign('{% url 'import_scan_results' eng.id %}');
606-
}
599+
$(document).on('keypress', null, 'e', function () {
600+
window.location.assign('{% url 'edit_engagement' eng.id %}');
601+
});
602+
603+
$(document).on('keypress', null, 'a', function () {
604+
window.location.assign('{% url 'add_tests' eng.id %}');
607605
});
606+
607+
$(document).on('keypress', null, 'i', function () {
608+
window.location.assign('{% url 'import_scan_results' eng.id %}');
609+
});
610+
608611
$(document).ready(function(){
609612
$('[data-toggle="tooltip"]').tooltip();
610613
});

‎dojo/templates/dojo/view_finding.html‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -489,6 +489,26 @@ <h4>Impact <span class="pull-right"><a data-toggle="collapse" href="#vuln_impact
489489
</div>
490490
</div>
491491

492+
<div class="panel panel-default">
493+
<div class="panel-heading">
494+
<h4>Steps To Reproduce <span class="pull-right"><a data-toggle="collapse" href="#vuln_refs"><i
495+
class="glyphicon glyphicon-chevron-up"></i></a></span></h4>
496+
</div>
497+
<div id="vuln_refs" class="panel-body collapse in">
498+
<pre>{{ finding.steps_to_reproduce|markdown_render }}</pre>
499+
</div>
500+
</div>
501+
502+
<div class="panel panel-default">
503+
<div class="panel-heading">
504+
<h4>Severity Justification <span class="pull-right"><a data-toggle="collapse" href="#vuln_refs"><i
505+
class="glyphicon glyphicon-chevron-up"></i></a></span></h4>
506+
</div>
507+
<div id="vuln_refs" class="panel-body collapse in">
508+
<pre>{{ finding.severity_justification|markdown_render }}</pre>
509+
</div>
510+
</div>
511+
492512
<div class="panel panel-default">
493513
<div class="panel-heading">
494514
<h4>References <span class="pull-right"><a data-toggle="collapse" href="#vuln_refs"><i

‎dojo/templatetags/display_tags.py‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -246,17 +246,32 @@ def paginator_value(page):
246246

247247
@register.filter(name='finding_sla')
248248
def finding_sla(finding):
249+
if not get_system_setting('enable_finding_sla'):
250+
return ""
251+
252+
title = ""
249253
severity = finding.severity
250254
find_sla = finding.sla()
251255
sla_age = get_system_setting('sla_' + severity.lower())
252-
status = "green"
253-
status_text = 'Remediation for ' + severity.lower() + ' findings in ' + str(sla_age) + ' days or less'
254-
if find_sla < 0:
255-
status = "red"
256-
find_sla = abs(find_sla)
257-
status_text = 'Overdue: Remediation for ' + severity.lower() + ' findings in ' + str(sla_age) + ' days or less'
258-
title = '<a data-toggle="tooltip" data-placement="bottom" title="" href="#" data-original-title="' + status_text + '">' \
259-
'<span class="label severity age-' + status + '">' + str(find_sla) + '</span></a>'
256+
if finding.mitigated:
257+
status = "blue"
258+
status_text = 'Remediated within SLA for ' + severity.lower() + ' findings (' + str(sla_age) + ' days)'
259+
if find_sla and find_sla < 0:
260+
status = "orange"
261+
find_sla = abs(find_sla)
262+
status_text = 'Out of SLA: Remediatied ' + str(find_sla) + ' days past SLA for ' + severity.lower() + ' findings (' + str(sla_age) + ' days)'
263+
else:
264+
status = "green"
265+
status_text = 'Remediation for ' + severity.lower() + ' findings in ' + str(sla_age) + ' days or less'
266+
if find_sla and find_sla < 0:
267+
status = "red"
268+
find_sla = abs(find_sla)
269+
status_text = 'Overdue: Remediation for ' + severity.lower() + ' findings in ' + str(sla_age) + ' days or less'
270+
271+
if find_sla is not None:
272+
title = '<a data-toggle="tooltip" data-placement="bottom" title="" href="#" data-original-title="' + status_text + '">' \
273+
'<span class="label severity age-' + status + '">' + str(find_sla) + '</span></a>'
274+
260275
return mark_safe(title)
261276

262277

‎setup.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
setup(
66
name='DefectDojo',
7-
version='1.5.0',
7+
version='1.5.1',
88
author='Greg Anderson',
99
description="Tool for managing vulnerability engagements",
1010
install_requires=[

0 commit comments

Comments
 (0)