bugfix: reimport: close_old_findings must respect service field

[valentijnscholten]

Fixes #12754

reimport was not respecting the value of the service field when closing old findings.

The problem was proven by a test case and is now fixed by the PR.

For import there already was working code and a test case covering this.

The PR also tweaks the docs and help texts for the close_old_findings related flags.

The new testcase also asserts that the "reopen" functionality of reimport respects the service field.

[dryrunsecurity]

This pull request contains two findings: an insecure default setting that could automatically close old security findings without proper review, and debug logging statements that might expose sensitive database query details if logs are inadvertently made public.

Insecure Default Finding Closure in dojo/forms.py

Vulnerability

Insecure Default Finding Closure

Description

The close_old_findings form field is set with initial=True, which means by default, old findings will be automatically closed when re-importing a scan. This creates a potential security risk where legitimate findings might be inadvertently marked as mitigated without proper review. The default 'true' setting could lead to unintentional hiding of security issues, especially if users are not carefully reviewing the import process.

django-DefectDojo/dojo/forms.py

Lines 651 to 657 in 3815e58

	label="Choose report file",
	allow_empty_file=True,
	required=False)
	close_old_findings = forms.BooleanField(help_text="Select if old findings in the same test that are no longer present in the report get closed as mitigated when importing.",
	required=False, initial=True)
	version = forms.CharField(max_length=100, required=False, help_text="Version that will be set on existing Test object. Leave empty to leave existing value in place.")
	branch_tag = forms.CharField(max_length=100, required=False, help_text="Branch or Tag that was scanned.")

Sensitive Information Logging in dojo/importers/default_reimporter.py

Vulnerability	Sensitive Information Logging
Description	Debug logging statements expose sensitive internal details about database queries and finding identifiers. The logs reveal database query structures and finding IDs/hash codes, which could provide reconnaissance information to potential attackers if debug logs are accidentally exposed or left enabled in production environments.

django-DefectDojo/dojo/importers/default_reimporter.py

Lines 162 to 176 in 3815e58

	at import time
	"""
	self.deduplication_algorithm = self.determine_deduplication_algorithm()
	# Only process findings with the same service value (or None)
	# Even though the service values is used in the hash_code calculation,
	# we need to make sure there are no side effects such as closing findings
	# for findings with a different service value
	# https://github.com/DefectDojo/django-DefectDojo/issues/12754
	original_findings = self.test.finding_set.all().filter(service=self.service)
	logger.debug(f"original_findings_qyer: {original_findings.query}")
	self.original_items = list(original_findings)
	logger.debug(f"original_items: {[(item.id, item.hash_code) for item in self.original_items]}")
	self.new_items = []
	self.reactivated_items = []
	self.unchanged_items = []

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved