remove actual_time and estimated_time fields

[valentijnscholten]

Removes Test fields that aren't used/referenced anywhere:

• actual_time
• estimated_time

Fixes #11121

[dryrunsecurity]

This pull request contains two findings: a potential information disclosure risk from adding new filter fields that might expose sensitive metadata, and a database migration that removes time-tracking fields which could lead to potential data loss, though neither finding is considered blocking.

Information Disclosure in dojo/filters.py

Vulnerability	Information Disclosure
Description	Adding 'engagement' and 'version' to filter fields could expose sensitive metadata if these fields contain confidential information. This increases the risk of information leakage through API or filter endpoints by making potentially sensitive fields searchable or filterable.

django-DefectDojo/dojo/filters.py

Lines 2982 to 2988 in c02618b

	model = Test
	fields = ["id", "title", "test_type", "target_start",
	"target_end", "notes", "percent_complete",
	"engagement", "version",
	"branch_tag", "build_id", "commit_hash",
	"api_scan_configuration", "scan_type"]

Potential Data Loss in dojo/db_migrations/0232_remove_test_actual_time_remove_test_estimated_time.py

Vulnerability	Potential Data Loss
Description	Database migration removes 'actual_time' and 'estimated_time' fields from the Test model. If these fields contained critical time-tracking or audit information, their removal could lead to permanent loss of historical data and potentially impact compliance or project tracking capabilities.

django-DefectDojo/dojo/db_migrations/0232_remove_test_actual_time_remove_test_estimated_time.py

Lines 1 to 21 in c02618b

	# Generated by Django 5.1.8 on 2025-06-27 20:26
	from django.db import migrations
	class Migration(migrations.Migration):
	dependencies = [
	('dojo', '0231_alter_finding_cvssv3_alter_finding_template_cvssv3'),
	]
	operations = [
	migrations.RemoveField(
	model_name='test',
	name='actual_time',
	),
	migrations.RemoveField(
	model_name='test',
	name='estimated_time',
	),
	]

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Wow, those are some old model fields.

When they were added we were considering tracking the accuracy of estimating manual testing vs the actual time it took the manual test to complete.

As you noticed, that idea was never fully implemented. Thanks for the clean-up work.

[mtesauro]

Approved