Skip to content

jira: add none checks in a few places#13886

Merged
Maffooch merged 1 commit intoDefectDojo:bugfixfrom
valentijnscholten:jira-none-checks
Dec 15, 2025
Merged

jira: add none checks in a few places#13886
Maffooch merged 1 commit intoDefectDojo:bugfixfrom
valentijnscholten:jira-none-checks

Conversation

@valentijnscholten
Copy link
Member

[sc-11909]

@dryrunsecurity
Copy link

DryRun Security

This pull request logs a JIRA API error response's "meta" object directly (in dojo/jira_link/helper.py lines 1183–1186), which may expose sensitive request or authentication-related details in logs and lead to information disclosure. Consider sanitizing or omitting the meta content before logging to avoid leaking sensitive data.

Potential Logging of Sensitive Information in dojo/jira_link/helper.py
Vulnerability Potential Logging of Sensitive Information
Description The code logs the 'meta' object directly from a JIRA API error response without sanitization. This 'meta' object could potentially contain sensitive information such as parts of the request, internal error details, or authentication-related data, which, if exposed in logs, could lead to information disclosure.

logger.exception("jira_meta for project: %s and url: %s meta: %s", jira_project.project_key if jira_project else "N/A", jira_url, json.dumps(meta, indent=4))
log_jira_alert(e.text, find)
return None


All finding details can be found in the DryRun Security Dashboard.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch merged commit 05138f3 into DefectDojo:bugfix Dec 15, 2025
148 of 149 checks passed
Maffooch pushed a commit to valentijnscholten/django-DefectDojo that referenced this pull request Feb 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants