push_to_jira: fix pushing to JIRA during import/reimport in asynchronous mode#13916
Merged
valentijnscholten merged 4 commits intoDefectDojo:bugfixfrom Dec 17, 2025
Merged
Conversation
|
This pull request logs the full DRF serializer
Information Disclosure via Debug Logging in
|
| Vulnerability | Information Disclosure via Debug Logging |
|---|---|
| Description | The code logs the entire context dictionary at the debug level. In a Django REST Framework (DRF) environment, this context typically contains the DRF request object. When the request object is converted to a string for logging, it includes all request headers, which results in the sensitive Authorization header (containing API keys or JWTs) being written to the application's debug logs. |
django-DefectDojo/dojo/api_v2/serializers.py
Lines 2284 to 2287 in ec2c764
All finding details can be found in the DryRun Security Dashboard.
Maffooch
previously approved these changes
Dec 16, 2025
dogboat
previously approved these changes
Dec 17, 2025
Jino-T
previously approved these changes
Dec 17, 2025
added significant changes to the PR
Maffooch
approved these changes
Dec 17, 2025
Jino-T
approved these changes
Dec 17, 2025
dogboat
approved these changes
Dec 17, 2025
b3049f9
into
DefectDojo:bugfix
277 of 279 checks passed
Maffooch
pushed a commit
to valentijnscholten/django-DefectDojo
that referenced
this pull request
Feb 16, 2026
…ous mode (DefectDojo#13916) * push_to_jira: add logging * push_to_jira: add logging * push to jira: fix passing of parameters in async mode * push to jira: fix passing of parameters in async mode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Findings weren't pushed to JIRA during import/reimport when postprocessing was happening in the background (default behaviour, unless
block_executionwas set toTrue). Bug was introduced in 2.53.0.This was not caught by our unit tests as these run in synchronous mode.
During debugging I added some logging helpful for troubleshooting, let's leave that in place for now via this PR.