🐛 add user mention notifications in note creation for Engagement, Finding, and Tests

[Maffooch]

Implement user mention notifications during note creation for Engagement, Finding, and Tests to enhance user engagement and communication. This change ensures that relevant users are notified when they are mentioned in notes, improving collaboration within the application.

[sc-12041]

[dryrunsecurity]

This pull request may disclose sensitive information in tag/mention notifications because notification messages include fields like engagement.name, finding.title, and test.title without checking that mentioned users are authorized to view those objects, potentially sending sensitive data via email, Slack, Teams, webhooks, and in-app alerts to unauthorized recipients.

Information Disclosure via Tagged Notifications in dojo/api_v2/views.py

Vulnerability	Information Disclosure via Tagged Notifications
Description	The engagement.name is included in notifications sent to users who are tagged in a note. The notification system does not verify if the tagged user has appropriate permissions to view the associated engagement. If sensitive information is stored in the engagement.name field, it can be disclosed to unauthorized users through these notifications.

django-DefectDojo/dojo/api_v2/views.py

Lines 540 to 543 in f86081c

	parent_title=f"Engagement: {engagement.name}",
	)
	serialized_note = serializers.NoteSerializer(

Information Disclosure in Finding Notifications in dojo/api_v2/views.py

Vulnerability	Information Disclosure in Finding Notifications
Description	The finding.title, which can contain sensitive details about a vulnerability, is included in notifications sent to users mentioned in a note. There is no authorization check to ensure that the mentioned user has permission to view the specific finding, leading to potential information disclosure to unauthorized individuals.

django-DefectDojo/dojo/api_v2/views.py

Lines 1107 to 1110 in f86081c

	parent_title=f"Finding: {finding.title}",
	)
	if finding.has_jira_issue:

Potential Information Disclosure in Test Notifications in dojo/api_v2/views.py

Vulnerability

Potential Information Disclosure in Test Notifications

Description

The process_tag_notifications function, when triggered by a note on a Test, sends notifications that include the test.title as parent_title. This parent_title is then used in various notification channels (email, Slack, MS Teams, webhooks, and in-app alerts) as part of the notification content. If test.title contains sensitive information, and the recipients of these notifications are not authorized to view that sensitive information, it could lead to unintended information disclosure. The Test model's title field is a CharField with a max length of 200, and there are no explicit restrictions on the type of data it can store, making it possible for sensitive data to be present.

django-DefectDojo/dojo/api_v2/views.py

Lines 2165 to 2168 in f86081c

	parent_title=f"Test: {test.title}",
	)
	serialized_note = serializers.NoteSerializer(

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved