Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Readme docs - followup PR #11525

Merged
merged 4 commits into from
Jan 23, 2025
Merged

Readme docs - followup PR #11525

merged 4 commits into from
Jan 23, 2025

Conversation

paulOsinski
Copy link
Contributor

Addresses @cneill 's comments on my previous PR here #11516 (review)

@github-actions github-actions bot added the docs label Jan 7, 2025
Copy link

dryrunsecurity bot commented Jan 7, 2025

DryRun Security Summary

The pull request updates DefectDojo's documentation, enables LDAP authentication, and improves API documentation while maintaining security best practices.

Expand for full summary

Summary:

The code changes in this pull request primarily focus on updating the documentation and enabling LDAP authentication in the DefectDojo application. The changes do not introduce any obvious security vulnerabilities and follow standard practices for integrating LDAP authentication in a Django-based web application.

The key updates include:

  1. Modifying the README.md file to update a link for the "Upgrade to DefectDojo Pro" section.
  2. Updating the API v2 documentation to use the OpenAPI 3 specification and provide guidance on authentication methods.
  3. Enabling LDAP authentication by modifying Dockerfiles, requirements.txt, and the local_settings.py file, as well as providing support for configuring LDAP settings through environment variables.

From an application security perspective, these changes are generally positive, as they improve the documentation, align the API documentation with industry standards, and provide a secure way to integrate LDAP authentication. However, it is crucial to ensure that the LDAP-related configuration, such as the server URI, bind DN, and bind password, are properly secured and not exposed in the codebase or deployment environment.

Files Changed:

  1. README.md: The link for the "Upgrade to DefectDojo Pro" section has been updated.
  2. docs/content/en/open_source/api-v2-docs.md: The documentation for the DefectDojo API v2 has been updated to use the OpenAPI 3 specification and provide guidance on authentication methods.
  3. docs/content/en/open_source/ldap-authentication.md: Changes have been made to enable LDAP authentication in the DefectDojo application, including modifications to Dockerfiles, requirements.txt, and the local_settings.py file, as well as support for configuring LDAP settings through environment variables.

Code Analysis

We ran 9 analyzers against 3 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

Copy link
Contributor

github-actions bot commented Jan 7, 2025

This pull request has conflicts, please resolve those before we can evaluate the pull request.

Copy link
Contributor

github-actions bot commented Jan 7, 2025

Conflicts have been resolved. A maintainer will review the pull request shortly.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro merged commit 250b993 into DefectDojo:master Jan 23, 2025
72 of 73 checks passed
Maffooch added a commit that referenced this pull request Jan 24, 2025
* Bump vite from 6.0.7 to 6.0.9 in /docs (#11610)

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.0.7 to 6.0.9.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.0.9/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Pro Release Notes 2.42.2 (#11611)

* update changelog 2.42.2

* add additional 2.42.1 features

---------

Co-authored-by: Paul Osinski <[email protected]>

* Update .dryrunsecurity.yaml (#11617)

* Readme docs - followup PR (#11525)

* follow on to readme update

* remove broken /pricing link

* chg local_settings refs ldap-authentication.md

---------

Co-authored-by: Paul Osinski <[email protected]>

* Bump asteval from 1.0.5 to 1.0.6

Bumps [asteval](https://github.com/lmfit/asteval) from 1.0.5 to 1.0.6.
- [Release notes](https://github.com/lmfit/asteval/releases)
- [Commits](lmfit/asteval@1.0.5...1.0.6)

---
updated-dependencies:
- dependency-name: asteval
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Paul Osinski <[email protected]>
Co-authored-by: Paul Osinski <[email protected]>
Co-authored-by: Cody Maffucci <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants