Repository navigation
Conversation
… paths Add the tool reference page for the DefectDojo Upstream Connector, which pulls an open source DefectDojo instance into DefectDojo Pro over the export API. Rewrite the self-hosted migration guide so it presents the database dump and the connector as two paths, with a comparison table. The dump steps stay as they were. Refs sc-15202. Depends on #16448 for the export API page the two pages link to.
|
This pull request contains multiple low-severity findings where user 'svader0' modified several sensitive codepaths without being on the allowed authors list. These changes affect various files within the dojo directory, including migrations, filters, importers, and templates.
Configured Sensitive Codepath Modified by Non-Allowed Author in
|
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/db_migrations/0303_system_settings_install_id.py' matches configured sensitive codepath pattern 'dojo/db_migrations/*.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/filters.py (drs_7bb423d0)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/filters.py' matches configured sensitive codepath pattern 'dojo/filters.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/finding/helper.py (drs_01f8aa86)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/finding/helper.py' matches configured sensitive codepath pattern 'dojo/finding/*.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/importers/default_importer.py (drs_e2b1c548)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/importers/default_importer.py' matches configured sensitive codepath pattern 'dojo/importers/*.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/importers/default_reimporter.py (drs_82a9c18e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/importers/default_reimporter.py' matches configured sensitive codepath pattern 'dojo/importers/*.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/risk_acceptance/helper.py (drs_0b6b8dbc)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/risk_acceptance/helper.py' matches configured sensitive codepath pattern 'dojo/risk_acceptance/*.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/base.html (drs_1f9aa58e)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/base.html' matches configured sensitive codepath pattern 'dojo/templates/*.html' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templates/dojo/support.html (drs_dc500440)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templates/dojo/support.html' matches configured sensitive codepath pattern 'dojo/templates/**/*.html' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/templatetags/display_tags.py (drs_aeb6b411)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/templatetags/display_tags.py' matches configured sensitive codepath pattern 'dojo/templatetags/*.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Configured Sensitive Codepath Modified by Non-Allowed Author in dojo/urls.py (drs_aa31388c)
| Vulnerability | Configured Sensitive Codepath Modified by Non-Allowed Author |
|---|---|
| Description | File 'dojo/urls.py' matches configured sensitive codepath pattern 'dojo/urls.py' and was modified by 'svader0' (commit 0113e67) who is not in the allowed authors list. |
Comment to provide feedback on these findings.
Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]
Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing
All finding details can be found in the DryRun Security Dashboard.
#16386 is milestoned for 3.5.0. A 3.4.300 source has the export API but no read-only mode, so the connector path now says how to stop writes by hand.
…d the MB file cap The Source DefectDojo connector now opens on One-Time, can delete its connection after the Sync, turns read-only mode on at the source during each Sync, and takes the file cap in MB. The preflight card shows a summary with View More.
…rogress and the summary notification
Also say that the connector turns read-only mode on at the source for each Sync, instead of saying that it changes nothing there.
…ration page The report, the Include boxes, Sync and the run history are now on the connection's migration page instead of a View More window and the records page. Open Migration on the tile's card or in its Manage Configuration menu opens it.
…eekly and Monthly schedules
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two docs pages for the Source DefectDojo connector. The connector pulls an open source DefectDojo instance into DefectDojo Pro over the export API, from the Connectors UI. You can run it as many times as you need until cutover (story sc-15202, Phase 1).
docs/content/connectors/toolreference/defectdojo.md(new). The connector reference page:DefectDojo - Connectors Import.docs/content/get_started/pro/onprem/migrating_from_open_source.md(rewritten). The page now has two paths. Path 1 is the database dump, with every existing step kept. Path 2 is the connector, with its own before-you-start list, five steps and a checklist. A "Which path" table at the top compares the two.celery inspect active. Path 1 also clears the setting in the restored database.The connector is not in a Pro release yet, so both pages say it ships in a coming release. The translated siblings of the migration guide are generated, so only the English page changes here.
Related PRs
Checks
hugo --minify --gc --config config/production/hugo.tomlbuilds the site with no warning about these pages.Update (2026-10-26): the connector page and the migration page now say that the connector opens on One-Time, that it can delete its connection after the Sync, that it turns read-only mode on at the source during each Sync and off at the end, that the file cap is in MB, and that the preflight card shows a summary with View More. The cutover steps changed to match: an optional manual lock first, the last Sync, then read-only mode on again.
Update (2026-10-28): with One-Time, Discover starts right after Submit and the records page opens. In View More, each source Product has an Include box. During a Sync the card shows Migrating: X of Y Findings, then Migration Complete or Migration Failed, and Connection Deleted when the connection deletes itself. One notification sums up the migration and stays after the delete.
Update (2026-10-28, later): the connector is now named DefectDojo Migration on its tile, in the connector list and on both pages. The migration page also says that the connector turns read-only mode on at the source for each Sync.
Update (2026-10-28, migration page): the connection now opens on its own migration page. The report sections, the Include boxes, Sync and the run history are on that page, and the tile's card and Manage Configuration menu open it with Open Migration. The View More window is gone.
Update (2026-10-28, tile): Open Migration is now a button on the connector's tile, above Manage Configuration, and a save on Edit Configuration opens the migration page.
Update (2026-10-28, labels): the button on the migration page is Begin Migration, the delete box is Delete the Connection After the Migration, a progress bar shows the import, and a stalled import is described with what to do.
Update (2026-10-28, Auto-Mapping): Auto-Mapping is always on for this connector, so the form no longer offers it. Both pages drop the step that turned it on, and the reference says how to map a source Product to a Product with another name before the migration begins.
Update (2026-10-29): this connector has no records page now, so the reference drops the Edit Record step for a Product with another name, and the gear menu on the migration page holds Discover and Edit Configuration. The checklist asks to clear Include on each Product to leave behind. Frequency now offers One-Time, Daily, Weekly (on a chosen weekday) and Monthly (on the first day of each month). The Estimated Duration counts only the findings in the included Products.