Make Finding Group Push to Jira Push Push to Duplicate Issues#13573
Merged
valentijnscholten merged 5 commits intoDefectDojo:devfrom Nov 5, 2025
Merged
Conversation
🔴 Risk threshold exceeded.This pull request modifies dojo/jira_link/helper.py and includes sensitive edits to that file (configurable via .dryrunsecurity.yaml), and introduces a potential resource exhaustion/DoS risk by synchronously iterating over findings and calling update_jira_issue for each, which can trigger many Jira API calls and hit rate limits.
🔴 Configured Codepaths Edit in
|
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
🔴 Configured Codepaths Edit in dojo/jira_link/helper.py
| Vulnerability | Configured Codepaths Edit |
|---|---|
| Description | Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml. |
Resource Exhaustion / Denial of Service in dojo/jira_link/helper.py
| Vulnerability | Resource Exhaustion / Denial of Service |
|---|---|
| Description | The push_finding_group_to_jira function iterates over all findings within a finding_group that have an associated Jira issue. For each finding, it calls update_jira_issue. Assuming update_jira_issue makes an external API call to Jira, this creates a synchronous loop that can trigger a high volume of individual API calls. If a finding_group contains a large number of findings, this can lead to exceeding Jira's API rate limits, causing significant performance degradation for the task, and potentially leading to a denial of service for the Jira integration or the application's worker processes. |
django-DefectDojo/dojo/jira_link/helper.py
Lines 787 to 788 in 7de10d0
We've notified @mtesauro.
All finding details can be found in the DryRun Security Dashboard.
…er the groups association is confirmed
Maffooch
reviewed
Oct 31, 2025
Maffooch
approved these changes
Nov 4, 2025
paulOsinski
approved these changes
Nov 4, 2025
valentijnscholten
approved these changes
Nov 4, 2025
blakeaowens
approved these changes
Nov 4, 2025
Maffooch
added a commit
to valentijnscholten/django-DefectDojo
that referenced
this pull request
Feb 16, 2026
…Dojo#13573) * Made file changes to test in dojo pro * Changed logic so that individual findings are pushed to jira only after the groups association is confirmed * Apply suggestion from @Maffooch * Rerecord tests --------- Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[sc-11942]
Potential future work: