Merge remote-tracking branch 'origin/dev' into cascade-delete-fix

# Conflicts:
#	dojo/finding/helper.py

Author: Maffooch

.dryrunsecurity.yaml

@@ -41,8 +41,8 @@ sensitiveCodepaths:
   - 'dojo/middleware.py'
   - 'dojo/models.py'
   - 'dojo/okta.py'
-  - 'dojo/pipeline.py'
-  - 'dojo/remote_user.py'
+  - 'dojo/sso/pipeline.py'
+  - 'dojo/sso/remote_user.py'
   - 'dojo/tasks.py'
   - 'dojo/urls.py'
   - 'dojo/utils.py'

Dockerfile.django-debian

@@ -5,7 +5,7 @@
 # Dockerfile.nginx to use the caching mechanism of Docker.
 
 # Ref: https://devguide.python.org/#branchstatus
-FROM python:3.13.13-slim-trixie@sha256:9213d136547f0602c3337ff48291e937f9cc43060b3e123402cf2aaff1a08b75 AS base
+FROM python:3.13.13-slim-trixie@sha256:d2462a6bed37b4fc6cabecf5a2132ae70df772fe03c7393c4d98a0c2fb48aa2e AS base
 FROM base AS build
 WORKDIR /app
 RUN \

Dockerfile.integration-tests-debian

@@ -1,9 +1,9 @@
 
 # code: language=Dockerfile
 
-FROM openapitools/openapi-generator-cli:v7.21.0@sha256:ce308310f3c1f8761e65338b8ab87b651bf4862c6acb80de510f381fffc4510b AS openapitools
+FROM openapitools/openapi-generator-cli:v7.22.0@sha256:1f459499a7c794aa0ea769c3c9b0eb54806c5ad2f68510a0ebb9338d0a626ced AS openapitools
 # currently only supports x64, no arm yet due to chrome and selenium dependencies
-FROM python:3.13.13-slim-trixie@sha256:9213d136547f0602c3337ff48291e937f9cc43060b3e123402cf2aaff1a08b75 AS build
+FROM python:3.13.13-slim-trixie@sha256:d2462a6bed37b4fc6cabecf5a2132ae70df772fe03c7393c4d98a0c2fb48aa2e AS build
 WORKDIR /app
 RUN \
   apt-get -y update && \

components/package.json

@@ -12,7 +12,7 @@
     "chosen-bootstrap": "https://github.com/dbtek/chosen-bootstrap",
     "chosen-js": "^1.8.7",
     "clipboard": "^2.0.11",
-    "datatables.net": "^2.3.7",
+    "datatables.net": "^2.3.8",
     "datatables.net-buttons-bs": "^3.2.6",
     "datatables.net-colreorder": "^2.1.2",
     "drmonty-datatables-plugins": "^1.0.0",

components/yarn.lock

@@ -167,10 +167,10 @@ datatables.net@2.3.2:
   dependencies:
     jquery ">=1.7"
 
-datatables.net@^2, datatables.net@^2.3.7:
-  version "2.3.7"
-  resolved "https://registry.yarnpkg.com/datatables.net/-/datatables.net-2.3.7.tgz#3cd34f6f5d1f40a46b5a20a4ba32604bdbcd6738"
-  integrity sha512-AvsjG/Nkp6OxeyBKYZauemuzQCPogE1kOtKwG4sYjvdqGCSLiGaJagQwXv4YxG+ts5vaJr6qKGG9ec3g6vTo3w==
+datatables.net@^2, datatables.net@^2.3.8:
+  version "2.3.8"
+  resolved "https://registry.yarnpkg.com/datatables.net/-/datatables.net-2.3.8.tgz#55a8dbe3bd2196951c498ab79bf44602a2bf3229"
+  integrity sha512-uhViowhlDlheAuo5a8TrkQqADsjrtGeOyvrigvr4t0+K3MyAWqClORXWAYIcN9VLX6iIX0C8O9gwJNd01hITRg==
   dependencies:
     jquery ">=1.7"
 

docs/content/releases/os_upgrading/2.58.md

@@ -0,0 +1,28 @@
+---
+title: 'Upgrading to DefectDojo Version 2.58.x'
+toc_hide: true
+weight: -20260504
+description: Notification .tpl templates relocated under dojo/notifications/
+---
+
+## Notification `.tpl` templates relocated
+
+The notification domain has been consolidated under a new `dojo/notifications/` package, and the 62 channel `.tpl` templates that drive alert, mail, MS Teams, Slack, and webhook notifications have moved on disk. The Django template lookup name (e.g. `notifications/mail/scan_added.tpl`) is unchanged, so most customizations keep working without any edits — but operators who override `.tpl` files by mounting them into the source tree need to update their paths.
+
+### What moved
+
+The channel templates under `alert/`, `mail/`, `msteams/`, `slack/`, `webhooks/`, and `webhooks_summary/` have been relocated:
+
+| Old on-disk location | New on-disk location |
+| --- | --- |
+| `dojo/templates/notifications/{channel}/{event}.tpl` | `dojo/notifications/templates/notifications/{channel}/{event}.tpl` |
+
+For example, `dojo/templates/notifications/mail/scan_added.tpl` now lives at `dojo/notifications/templates/notifications/mail/scan_added.tpl`. A new `TEMPLATES["DIRS"]` entry pointing at `dojo/notifications/templates/` is registered automatically, so the lookup path used by `render_to_string()` (e.g. `notifications/slack/sla_breach.tpl`) resolves exactly as before.
+
+### Required actions
+
+- **Customizing `.tpl` files via your own templates directory (recommended pattern):** No action required. Overrides resolved by lookup name continue to take precedence.
+- **Customizing `.tpl` files via a Docker volume mount or in-tree patch at the old `dojo/templates/notifications/...` path:** Update the mount/patch target to the new `dojo/notifications/templates/notifications/...` path, or move your override into a project-level templates directory keyed by the lookup name.
+- **No customizations:** No action required.
+
+For more information, check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.58.0).

docs/content/supported_tools/parsers/file/qualys_vmdr.md

@@ -0,0 +1,149 @@
+---
+title: "Qualys VMDR"
+toc_hide: true
+---
+
+The [Qualys VMDR](https://www.qualys.com/apps/vulnerability-management-detection-response/) parser for DefectDojo supports imports from CSV format. This parser handles both QID-centric and CVE-centric export variants from Qualys VMDR (Vulnerability Management, Detection, and Response).
+
+## Supported File Types
+
+The Qualys VMDR parser accepts CSV file format in two variants:
+
+**QID Format:** Primary vulnerability identifier is the Qualys QID
+**CVE Format:** Includes CVE identifiers and CVSS scores from NVD
+
+To generate these files from Qualys VMDR:
+
+1. Log into your Qualys VMDR console
+2. Navigate to Vulnerabilities > Vulnerability Management
+3. Select the assets or vulnerabilities to export
+4. Click "Download" and select CSV format
+5. Choose either QID-centric or CVE-centric export option
+6. Upload the downloaded CSV file to DefectDojo
+
+## Default Deduplication
+
+The parser uses `DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE`, which tries `unique_id_from_tool` (populated with the Qualys QID) first and falls back to hashcode deduplication.
+
+**Hashcode fields:** `title`, `component_name`, `vuln_id_from_tool`
+
+For more information, see [About Deduplication](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/).
+
+### Sample Scan Data
+
+Sample Qualys VMDR scans can be found in the [sample scan data folder](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/qualys_vmdr).
+
+## Link To Tool
+
+- [Qualys VMDR](https://www.qualys.com/apps/vulnerability-management-detection-response/)
+- [Qualys Documentation](https://www.qualys.com/documentation/)
+
+## QID Format (Primary Export)
+
+### QID Format Field Mapping
+
+<details>
+<summary>Click to expand Field Mapping Table</summary>
+
+| Source Field | DefectDojo Field | Notes |
+| ------------ | ---------------- | ----- |
+| Title | title | Truncated to 500 characters |
+| Severity | severity | Mapped: 1=Info, 2=Low, 3=Medium, 4=High, 5=Critical |
+| Severity | severity_justification | Preserved as "Qualys Severity: X" |
+| QID | unique_id_from_tool | Native Qualys vulnerability identifier |
+| QID | vuln_id_from_tool | Also used as vulnerability ID |
+| First Detected | date | Parsed to date object |
+| Status | active | True if "ACTIVE", False otherwise |
+| Solution | mitigation | Remediation guidance |
+| Threat | impact | Threat description |
+| Asset Name | component_name | Asset/server name |
+| Category | service | Vulnerability category |
+| Asset IPV4 | unsaved_endpoints | Multiple endpoints if comma-separated |
+| Asset IPV6 | unsaved_endpoints | Fallback if no IPv4 |
+| Asset Tags | unsaved_tags | Split on comma |
+| Results | description | Included in structured description |
+
+</details>
+
+### Additional Finding Settings (QID Format)
+
+| Finding Field | Default Value | Notes |
+|---------------|---------------|-------|
+| static_finding | True | Vulnerability scan data |
+| dynamic_finding | False | Not dynamic testing |
+
+## CVE Format (Extended Export)
+
+### CVE Format Field Mapping
+
+<details>
+<summary>Click to expand Field Mapping Table</summary>
+
+| Source Field | DefectDojo Field | Notes |
+| ------------ | ---------------- | ----- |
+| CVE | vuln_id_from_tool | CVE identifier (e.g., CVE-2021-44228) |
+| CVE | unsaved_vulnerability_ids | Also added for CVE tracking |
+| CVE-Description | description | Prepended to structured description |
+| CVSSv3.1 Base (nvd) | cvssv3_score | Numeric CVSS score |
+| Title | title | Truncated to 500 characters |
+| Severity | severity | Mapped: 1=Info, 2=Low, 3=Medium, 4=High, 5=Critical |
+| Severity | severity_justification | Preserved as "Qualys Severity: X" |
+| QID | unique_id_from_tool | Native Qualys vulnerability identifier |
+| First Detected | date | Parsed to date object |
+| Status | active | True if "ACTIVE", False otherwise |
+| Solution | mitigation | Remediation guidance |
+| Threat | impact | Threat description |
+| Asset Name | component_name | Asset/server name |
+| Category | service | Vulnerability category |
+| Asset IPV4 | unsaved_endpoints | Multiple endpoints if comma-separated |
+| Asset IPV6 | unsaved_endpoints | Fallback if no IPv4 |
+| Asset Tags | unsaved_tags | Split on comma |
+| Results | description | Included in structured description |
+
+</details>
+
+### Additional Finding Settings (CVE Format)
+
+| Finding Field | Default Value | Notes |
+|---------------|---------------|-------|
+| static_finding | True | Vulnerability scan data |
+| dynamic_finding | False | Not dynamic testing |
+
+## Special Processing Notes
+
+### Severity Conversion
+
+Qualys severity levels (1-5 numeric scale) are converted to DefectDojo severity levels:
+- `1` → Info
+- `2` → Low
+- `3` → Medium
+- `4` → High
+- `5` → Critical
+
+The original Qualys severity is preserved in the severity_justification field as "Qualys Severity: X".
+
+### Endpoint Handling
+
+The parser creates Endpoint objects from IP addresses:
+- Multiple IPv4 addresses (comma-separated) create multiple endpoints
+- Falls back to IPv6 if no IPv4 address is present
+
+### CSV Format Handling
+
+Qualys VMDR exports use a non-standard CSV format where each row is wrapped in outer quotes and fields are delimited by `,""` instead of standard `","`. The parser automatically detects and handles both standard and non-standard CSV formats.
+
+**Multi-line records:** Qualys fields such as Results and Threat may contain embedded newlines. The parser correctly assembles multi-line records that span multiple lines in the CSV file, including records containing malformed quote patterns in fields like Results.
+
+**Metadata lines:** Some Qualys exports include 3 metadata lines (report title, date range, column count) before the header row. The parser auto-detects whether metadata is present and skips it accordingly.
+
+### Data Cleaning
+
+- **HTML tags** in fields like Threat (mapped to impact) are stripped automatically
+- **Qualys null markers** (`'-`) are filtered and treated as empty values
+- **Stray quotes** left by the non-standard CSV format are cleaned from field values
+
+### Format Detection
+
+The parser automatically detects whether the import file is QID format or CVE format by examining the first column of the header row:
+- If first column is "QID" → QID format parser is used
+- If first column is "CVE" → CVE format parser is used

docs/package-lock.json

@@ -21,7 +21,7 @@
 from rest_framework import serializers
 from rest_framework.exceptions import NotFound
 from rest_framework.exceptions import ValidationError as RestFrameworkValidationError
-from rest_framework.fields import DictField, MultipleChoiceField
+from rest_framework.fields import DictField
 
 import dojo.finding.helper as finding_helper
 import dojo.risk_acceptance.helper as ra_helper
@@ -43,9 +43,7 @@
 from dojo.jira import services as jira_services
 from dojo.location.models import Location, LocationFindingReference
 from dojo.models import (
-    DEFAULT_NOTIFICATION,
     IMPORT_ACTIONS,
-    NOTIFICATION_CHOICES,
     SEVERITIES,
     SEVERITY_CHOICES,
     STATS_FIELDS,
@@ -82,8 +80,6 @@
     Note_Type,
     NoteHistory,
     Notes,
-    Notification_Webhooks,
-    Notifications,
     Product,
     Product_API_Scan_Configuration,
     Product_Group,
@@ -3069,110 +3065,7 @@ class FindingNoteSerializer(serializers.Serializer):
     note_id = serializers.IntegerField()
 
 
-class NotificationsSerializer(serializers.ModelSerializer):
-    product = serializers.PrimaryKeyRelatedField(
-        queryset=Product.objects.all(),
-        required=False,
-        default=None,
-        allow_null=True,
-    )
-    user = serializers.PrimaryKeyRelatedField(
-        queryset=Dojo_User.objects.all(),
-        required=False,
-        default=None,
-        allow_null=True,
-    )
-    product_type_added = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    product_added = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    engagement_added = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    test_added = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    scan_added = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    jira_update = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    upcoming_engagement = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    stale_engagement = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    auto_close_engagement = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    close_engagement = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    user_mentioned = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    code_review = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    review_requested = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    other = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    sla_breach = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    sla_breach_combined = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    risk_acceptance_expiration = MultipleChoiceField(
-        choices=NOTIFICATION_CHOICES, default=DEFAULT_NOTIFICATION,
-    )
-    template = serializers.BooleanField(default=False)
-
-    class Meta:
-        model = Notifications
-        fields = "__all__"
-
-    def validate(self, data):
-        user = None
-        product = None
-        template = False
-
-        if self.instance is not None:
-            user = self.instance.user
-            product = self.instance.product
-
-        if "user" in data:
-            user = data.get("user")
-        if "product" in data:
-            product = data.get("product")
-        if "template" in data:
-            template = data.get("template")
-
-        if (
-            template
-            and Notifications.objects.filter(template=True).count() > 0
-        ):
-            msg = "Notification template already exists"
-            raise ValidationError(msg)
-        if (
-            self.instance is None
-            or user != self.instance.user
-            or product != self.instance.product
-        ):
-            notifications = Notifications.objects.filter(
-                user=user, product=product, template=template,
-            ).count()
-            if notifications > 0:
-                msg = "Notification for user and product already exists"
-                raise ValidationError(msg)
-        return data
+from dojo.notifications.api.serializer import NotificationsSerializer  # noqa: E402, F401  -- backward compat
 
 
 class EngagementPresetsSerializer(serializers.ModelSerializer):
@@ -3349,7 +3242,4 @@ def create(self, validated_data):
             raise
 
 
-class NotificationWebhooksSerializer(serializers.ModelSerializer):
-    class Meta:
-        model = Notification_Webhooks
-        fields = "__all__"
+from dojo.notifications.api.serializer import NotificationWebhooksSerializer  # noqa: E402, F401  -- backward compat