engagement: allow unlinking of JIRA epic

[valentijnscholten]

Sometimes you find a bug report or feature request that is a good match for an LLM.

This PR fixes #9071

[dryrunsecurity]

This pull request includes a broad except Exception: in dojo/engagement/views.py around unlink_jira that logs the full exception via logger.exception, which risks recording sensitive JIRA API request/response details or stack traces in internal logs; while it returns a generic 500 to users, the internal logging could expose sensitive information if logs are accessed. Consider narrowing the exception handling and avoiding logging sensitive response details (or sanitize/redact them) before writing to logs.

Broad Exception Handling with Sensitive Data Logging in dojo/engagement/views.py

Vulnerability

Broad Exception Handling with Sensitive Data Logging

Description

The unlink_jira function uses a broad except Exception: block when calling jira_helper.unlink_jira. Interactions with external APIs like JIRA can raise exceptions containing sensitive information (e.g., API request/response details, internal URLs, detailed JIRA error messages, or stack traces from the client library). While the generic HTTP 500 response prevents direct leakage to the user, the logger.exception call will log these potentially sensitive details internally. If an attacker gains access to these logs, they could exfiltrate sensitive information, which constitutes a security risk.

django-DefectDojo/dojo/engagement/views.py

Lines 1153 to 1156 in d6cc3b2

	except Exception:
	logger.exception("Link to JIRA epic could not be deleted")
	messages.add_message(
	request,

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved