File Uploads: Allow FPR format

[manuel-sommer]

closes #11153

[dryrunsecurity]

DryRun Security Summary

The pull request updates the configuration of the DefectDojo application, including a change to the SHA-256 hash value of the .settings.dist.py file and the addition of a new file type, .fpr, to the list of acceptable file types that can be uploaded to the application, which should be reviewed to ensure that the updates do not introduce any security risks.

Expand for full summary

Summary:

The code changes in this pull request involve updates to two files related to the configuration of the DefectDojo application. The first change updates the SHA-256 hash value of the .settings.dist.py configuration file, suggesting a legitimate update to the application's configuration. The second change adds a new file type, .fpr, to the list of acceptable file types that can be uploaded to the application.

While these changes do not appear to introduce any obvious security vulnerabilities, it is important to review the actual changes to the configuration files and the application's overall security posture to ensure that the updates do not have any unintended consequences or introduce new security risks. Proper file upload validation, secure configuration management, and thorough input validation are crucial to maintaining the security and reliability of the DefectDojo application.

Files Changed:

1. dojo/settings/.settings.dist.py.sha256sum: The SHA-256 hash value of the .settings.dist.py configuration file has been updated, indicating a legitimate update to the application's configuration. As an application security engineer, I would recommend reviewing the changes to the .settings.dist.py file to verify that the update does not introduce any security risks.

2. dojo/settings/settings.dist.py: The changes add a new file type, .fpr, to the list of acceptable file types that can be uploaded to the application. While this change does not appear to introduce any immediate security concerns, it is important to ensure that the application properly validates and sanitizes the uploaded files to prevent potential security vulnerabilities, such as file-based attacks. Additionally, the application's configuration should be regularly reviewed to align with the security requirements and to prevent the inclusion of unnecessary or potentially risky file types.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved