🐛 fix typo in settings.disty.py, #10529

[manuel-sommer]

see #10529

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request involve updates to two files related to the configuration of the DefectDojo application. The first change updates the SHA-256 hash value for the .settings.dist.py configuration file, which is likely used to verify the integrity of the file. The second change updates the list of acceptable file types that can be uploaded to the application, correcting a typo in the .xslx extension and adding the .xlsx extension.

From an application security perspective, these changes do not introduce any obvious security vulnerabilities. However, it is important to ensure that any changes to configuration files, especially those that involve sensitive information or security-related settings, are thoroughly reviewed and tested to prevent the introduction of unintended security risks.

Additionally, the maintenance of the list of acceptable file types is an important security consideration, as it helps to mitigate the risks associated with file uploads, such as remote code execution or other types of attacks. It is recommended to periodically review and update this list as necessary to address any new threats or vulnerabilities that may arise.

Files Changed:

1. dojo/settings/.settings.dist.py.sha256sum: This file contains a SHA-256 hash value that is used to verify the integrity of the .settings.dist.py configuration file. The patch updates the hash value from 7b3bb14160f3ffce537d75895ee18cb0a561232fa964bae88b4861f7d289b176 to cc2980f490e627893c98386347a15352f883afa4b8908d8e67b0dc126ec70f06, indicating that the .settings.dist.py file has been modified.

2. dojo/settings/settings.dist.py: This file contains the configuration settings for the DefectDojo application. The patch updates the DD_FILE_UPLOAD_TYPES setting to include the .xlsx file extension, which was previously listed as .xslx. The .xslx extension has also been corrected to .xlsx.

Powered by DryRun Security

[mtesauro]

Closing and re-opening to try to make Flake8 happy.

[mtesauro]

@manuel-sommer Not sure what's up with flake8-your-pr since we have a PR in bugfix to remove the need for that test now that we have ruff running.

Anyway, don't worry about making it happy for this PR.

[mtesauro]

Approved

[MarMoriMem]

Approved

[chalkyfuller]

Approved

[manuel-sommer]

Please don't forget to merge ;-)