SLA Calculations: Remove product grade calculation and consolidate task handlers

[Maffooch]

When reviewing the SLA calculation functions, I was confused by the two helper functions and consolidated them. Additionally, I noticed the product grade calculation may be wasted compute. The SLA of a finding is not considered as part of the product grade, so no reason to the recalculate

[mtesauro]

Approved

[dryrunsecurity]

This pull request introduces dynamic loading and execution of a method based on the FINDING_SLA_PERIOD_METHOD system setting, which allows an admin-updatable string to specify a function path that the application will import and call; if an attacker with administrative privileges can modify that setting they could cause arbitrary code execution on the server. This is a critical remote code execution risk stemming from executing user-configurable function paths.

Arbitrary Code Execution via Dynamic Method Loading in dojo/models.py

Vulnerability

Arbitrary Code Execution via Dynamic Method Loading

Description

The application dynamically loads and executes a method based on the FINDING_SLA_PERIOD_METHOD setting, which is stored in the System_Settings model. If an attacker with administrative privileges can modify this setting, they can specify a path to an arbitrary function (e.g., os.system or a custom malicious function) that will then be executed by the application, leading to arbitrary code execution on the server.

django-DefectDojo/dojo/models.py

Lines 3151 to 3152 in 9e4aecd

	if method := get_custom_method("FINDING_SLA_PERIOD_METHOD"):
	return method(self)

---

All finding details can be found in the DryRun Security Dashboard.