fix: ui must not overwrite service field from parser

[valentijnscholten]

Fixes #13461

The web form in the UI by default sends an empty string, which ended up overwriting the service value provided by parsers.

Only a few parsers do this, so the impact of this fix is low:

• Trivy Scan
• Trivy Operator Scan
• Hydra Scan
• JFrog Xray API Summary Artifact Scan
• StackHawk HawkScan

The fix consists of:

• Do not send empty string to the importer/reimporter
• Always show service field on view_finding page, even if it's empty
• Ensure None and empty string are treated equally in reimporter close findings, similar to other places

The bug did not affect hash_code calculations as an empty string is not used in the hash calculation:

django-DefectDojo/dojo/models.py

Lines 3011 to 3013 in 7c0d92a

	for field in settings.HASH_CODE_FIELDS_ALWAYS:
	if getattr(self, field):
	fields_to_hash += str(getattr(self, field))

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[dryrunsecurity]

This pull request adds a debug log statement in dojo/models.py that logs fields listed in the HASH_CODE_FIELDS_ALWAYS setting, which could expose sensitive data (URLs, file paths, request/response data, PII, or credentials) if those fields are configured to include such information and debug logs are enabled or not properly secured. The scanner flags this as a risky practice (non-blocking) due to potential data exposure in production logs.

Sensitive Data in Logs in dojo/models.py

Vulnerability

Sensitive Data in Logs

Description

A new debug log statement has been added that logs the value of fields specified in the HASH_CODE_FIELDS_ALWAYS setting. If an administrator configures this setting to include fields containing sensitive data (e.g., URLs, file paths, request/response data, or other PII/credentials that might be stored in a Finding field), that data could be exposed in debug logs. This poses a risk if debug logging is enabled in a production environment or if logs are not properly secured.

django-DefectDojo/dojo/models.py

Lines 3013 to 3016 in eb1fc5e

	deduplicationLogger.debug("adding HASH_CODE_FIELDS_ALWAYSfield %s to hash_fields: %s", field, getattr(self, field))
	fields_to_hash += str(getattr(self, field))
	logger.debug("fields_to_hash : %s", fields_to_hash)

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved