feat: add Remove from Finding bulk action on View Finding page#14461
Conversation
Adds a trash button next to the Bulk Edit dropdown on the View Finding page that removes the selected endpoints from the finding without deleting the endpoint objects themselves. - endpoint_status_bulk_update (non-V3): if remove_from_finding is posted, delete the matching Endpoint_Status records for the selected endpoints - finding_location_bulk_update (V3): if remove_from_finding is posted, delete the matching LocationFindingReference records - view_finding.html: add "Remove from Finding" button that appends the selected endpoint IDs and a remove_from_finding flag to the existing bulk_change_form before submitting - Add unit tests covering single, partial, and full removal, Endpoint_Status cleanup, no-op without the flag, and redirect behaviour
@override_settings does not affect URL routing (which is set up at startup). In V3=true CI, endpoints_status_bulk resolves to the V3 handler (finding_location_bulk_update) rather than the non-V3 handler (endpoint_status_bulk_update), causing the non-V3 tests to fail. Fix by: - Wrapping each test class with @skipUnless so it only runs when the matching URL handler is active - Adding TestRemoveLocationsFromFindingView to exercise the V3 path (finding_location_bulk_update + LocationFindingReference) when V3_FEATURE_LOCATIONS=True
🟡 Please give this pull request extra attention during review.This pull request introduces DOM-based XSS risk by concatenating checkbox element IDs directly into HTML strings used to create hidden inputs (e.g., $('')), allowing an attacker who can control an element id to inject arbitrary HTML/JS. The id is not escaped or validated and the code relies on HTML parsing rather than safe DOM methods, so it should be changed to use proper escaping or create inputs with safe DOM APIs.
🟡 Potential Cross-Site Scripting in
|
| Vulnerability | Potential Cross-Site Scripting |
|---|---|
| Description | The JavaScript concatenates checkbox element IDs directly into HTML strings used to create hidden input elements: $(''). If an attacker can control an element's id, they can inject characters that break out of the attribute context and add arbitrary HTML/JS, leading to DOM-based XSS. The code does not escape or otherwise validate the id before concatenation and uses innerHTML-like construction via jQuery HTML parser instead of safe DOM methods. |
django-DefectDojo/dojo/templates/dojo/view_finding.html
Lines 1480 to 1483 in e95e41a
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
dogboat
left a comment
dogboat
left a comment
There was a problem hiding this comment.
Handy! This works, I just had some questions about the way the UI renders. Could be just my system tho.
| </ul> | ||
| </div> | ||
| <div class="btn-group mr-2" role="group"> | ||
| <button type="button" class="btn btn-sm btn-danger" data-toggle="tooltip" data-placement="bottom" title="Remove selected endpoints from this finding" aria-label="Remove selected endpoints from this finding"> |
There was a problem hiding this comment.
This is what it looks like to me, on both Chrome and Firefox (MacOS):
...which is weird, because you posted a screenshot that looks fantastic. Is it just me?
| }); | ||
| }); | ||
|
|
||
| $('a.remove-from-finding').on('click', function(e) { |
There was a problem hiding this comment.
Any chance we could have the click handler be on the entire button and not just the anchor? As it is now, I have to click the anchor content, which is a bit smaller than the button itself. When I was testing I hit the button but not the icon, which didn't trigger the action.
… click on whole button)
|
The screenshot is old and now I have an even newer one where the trash button looks the same as in other places, red on a grey background. Click handler adjusted, can't believe I didn't do that myself as I hate buttons not being clickable. 
From another place in dojo the trash icon: 
|
|
Closing and re-opening to kick the tests again |
5 participants
Summary
While working on #14660 I noticed the "delete" icon was missing from the endpoint bulk edit menu on the View Finding page.
endpoint_status_bulk_update): whenremove_from_findingis posted, delete the matchingEndpoint_Statusrecords for the selected endpointsfinding_location_bulk_update): whenremove_from_findingis posted, delete the matchingLocationFindingReferencerecordsFinding_Editpermission via@user_is_authorized; no additional permission check is neededremove_from_findingflag to the existingbulk_change_formbefore submitting, reusing the same form and URL as the bulk status updateEndpoint_Statuscleanup, no-op without the flag, and redirect behaviour