Fix: Apply tags to findings/endpoints when TRACK_IMPORT_HISTORY is disabled

[valentijnscholten]

Fixes #13312

Problem

When TRACK_IMPORT_HISTORY is disabled, tags were not being applied to findings and endpoints during import because the tag application logic was inside update_import_history() which returned early when the setting was disabled.

Solution

Refactored the code to:

• Extract tag application into a dedicated apply_import_tags() method
• Call apply_import_tags() from importers after update_import_history()
• Remove tag application logic from update_import_history()

This ensures tags are applied regardless of the TRACK_IMPORT_HISTORY setting while maintaining separation of concerns and eliminating code duplication.

Changes

• dojo/importers/base_importer.py: Added apply_import_tags() method and removed tag logic from update_import_history()
• dojo/importers/default_importer.py: Added call to apply_import_tags() after update_import_history()
• dojo/importers/default_reimporter.py: Added call to apply_import_tags() after update_import_history()

[dryrunsecurity]

This pull request introduces code that materializes all input iterables (notably large QuerySets like untouched_findings) into in-memory lists in apply_import_tags, which can bypass Django's lazy loading and lead to excessive memory use and an Out‑of‑Memory DoS risk on high-volume instances. While marked non-blocking, this change should be addressed to avoid potential memory exhaustion.

DoS via Memory Exhaustion in dojo/importers/base_importer.py

Vulnerability

DoS via Memory Exhaustion

Description

The apply_import_tags method forces the materialization of all input iterables, including potentially very large QuerySets of untouched_findings (representing all non-closed findings in a re-import), into in-memory Python lists. This bypasses Django's lazy loading, leading to excessive memory consumption and a high risk of Out-of-Memory Denial of Service (OOM DoS) in high-volume DefectDojo instances.

django-DefectDojo/dojo/importers/base_importer.py

Lines 350 to 353 in d5bdf84

	elif not isinstance(untouched_findings, list):
	untouched_findings = list(untouched_findings)
	if reactivated_findings is None:

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved