[go: nahoru, domu]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add file upload extension allow list, Force authorization to download file #6564

Merged
merged 5 commits into from
Jul 20, 2022
Merged

Add file upload extension allow list, Force authorization to download file #6564

merged 5 commits into from
Jul 20, 2022

Conversation

Maffooch
Copy link
Contributor

In order to make the management of arbitrary files more secure, I have added the following behaviors:

  • Users must be able to edit the object a file belongs to download the file
  • A whitelist of supported file types is configurable by a setting/env_var
    • ['.txt', '.pdf', '.json', '.xml', '.yml', '.png', '.jpeg']

@github-actions github-actions bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR ui labels Jul 14, 2022
@Maffooch Maffooch closed this Jul 14, 2022
@Maffooch Maffooch reopened this Jul 14, 2022
mtesauro
mtesauro approved these changes Jul 20, 2022
View reviewed changes
Copy link
Contributor
@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

@devGregA devGregA merged commit ddfe274 into DefectDojo:dev Jul 20, 2022
@Maffooch Maffooch deleted the arb-files branch July 25, 2022 16:14
@dzmitry-savitski
Copy link

Is there a way to get file content via API after this change? It seems like authorization is hardcoded now, and there's no API endpoint to get file contents.

@Maffooch
Copy link
Contributor Author

Hi @dzmitry-savitski
This is a good point. I forgot that files could be retrieved by the API. Will work on a solution

@Maffooch Maffooch mentioned this pull request Aug 15, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@coheigea coheigea coheigea left review comments

@mtesauro mtesauro mtesauro approved these changes

@devGregA devGregA devGregA approved these changes

Assignees
No one assigned
Labels
enhancement security settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR ui
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@Maffooch @dzmitry-savitski @coheigea @mtesauro @devGregA