Add different pro banner for databases over 100k findings and endpoints

[Maffooch]

When a databases reaches over 100k findings and endpoints, it is suggested that they consider pro

[sc-2978]

[dryrunsecurity]

DryRun Security Summary

The code changes introduce a new scheduled task "trigger_evaluate_pro_proposition" that runs every 8 hours to update announcement messages based on system findings and endpoints, along with modifications to the existing task functionality in DefectDojo application.

Expand for full summary

Summary:

The code changes in this pull request appear to be focused on adding a new scheduled task to the DefectDojo application and modifying an existing task responsible for updating the announcement message based on the number of findings and endpoints in the system.

The new scheduled task, "trigger_evaluate_pro_proposition", is scheduled to run every 8 hours and is responsible for executing the "dojo.tasks.evaluate_pro_proposition" function. This change does not introduce any obvious security concerns, as scheduled tasks are a common pattern in web applications and are generally not considered a security risk, as long as the tasks themselves do not perform any sensitive or unauthorized operations.

The changes to the "dojo/tasks.py" file introduce a new task called "evaluate_pro_proposition", which is responsible for updating the announcement message based on the number of findings and endpoints in the system. This change also does not appear to introduce any security vulnerabilities, but it's important to ensure that the announcement message is properly sanitized and any user-provided input is properly validated to prevent potential injection attacks (e.g., Cross-Site Scripting (XSS)).

Files Changed:

1. dojo/settings/settings.dist.py:

   • A new scheduled task called "trigger_evaluate_pro_proposition" has been added, which is scheduled to run every 8 hours and executes the "dojo.tasks.evaluate_pro_proposition" function.
   • This change does not introduce any obvious security concerns, but it's important to review the task to ensure it does not perform any sensitive or unauthorized operations.

2. dojo/tasks.py:

   • A new task called "evaluate_pro_proposition" has been added, which is responsible for updating the announcement message based on the number of findings and endpoints in the system.
   • The task checks if the CREATE_CLOUD_BANNER setting is enabled, retrieves the existing announcement object, and updates the message if the count of findings and endpoints is greater than or equal to 100,000.
   • This change does not appear to introduce any security vulnerabilities, but it's important to ensure that the announcement message is properly sanitized and any user-provided input is properly validated to prevent potential injection attacks.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved