Add case-insensitive expression index on Vulnerability_Id.vulnerability_id - #15218
Conversation
github-actions
Bot
added
New Migration
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
|
This pull request contains critical security findings because two sensitive files were modified by an author not on the allowed list. Specifically, the changes to
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0280_vulnerability_id_upper_index.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by '' (commit 05536c9) who is not in the allowed authors list. |
🔴 Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/models.py (drs_0fa1e9a9)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/models.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by '' (commit 05536c9) who is not in the allowed authors list. |
We've notified @mtesauro.
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
ebb9334 to
fedb331
Compare
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
fedb331 to
9bd75b6
Compare
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
…ty_id Index UPPER(vulnerability_id), finding_id on dojo_vulnerability_id so CVE-keyed lookups (enrichment, exploit/threat-intel matching, dedupe helpers) stop sequentially scanning the table; scanner-supplied ids are not case-normalized, so the index and any query both fold with UPPER(). finding_id is included so changed-CVE -> finding fan-out is an index-only scan. Built CONCURRENTLY IF NOT EXISTS (non-atomic migration) via SeparateDatabaseAndState so it does not lock the table on large instances and is idempotent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
9bd75b6 to
05536c9
Compare
|
Conflicts have been resolved. A maintainer will review the pull request shortly. |
3 participants
Add a case-insensitive expression index on
Vulnerability_Id.vulnerability_idAdds an index on
UPPER(vulnerability_id), finding_idtodojo_vulnerability_id.Why
Vulnerability-id → finding lookups (CVE-keyed enrichment, exploit/threat-intel matching, dedupe helpers) currently sequentially scan
dojo_vulnerability_id— the string column has no index today, and scanner-supplied ids aren't case-normalized, so any correct lookup must fold withUPPER(). This adds the matching functional index; includingfinding_idmakes the changed-CVE → finding fan-out an index-only scan.What
Vulnerability_Id.Meta.indexesgainsIndex(Upper("vulnerability_id"), "finding", name="dojo_vulnid_upper_idx").0280builds itCREATE INDEX CONCURRENTLY IF NOT EXISTS(non-atomic) so it doesn't lock the table on large instances, withSeparateDatabaseAndStatekeeping Django's model state in sync.IF NOT EXISTSmakes it idempotent and safe to co-exist with any downstream migration that created the same-named index first.Notes
🤖 Generated with Claude Code