🎉 make vulnids more robust

[manuel-sommer]

• Alphabetical ordering
• added examples where possible
• added a hyphen where possible to make the keys more unique

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the DefectDojo application's security and functionality by updating vulnerability URL mappings and specifying acceptable file upload types in the configuration settings.

Expand for full summary

Summary:

The code changes in this pull request are focused on improving the functionality and security of the DefectDojo application. The key changes include updating the VULNERABILITY_URLS dictionary to include new vulnerability ID prefixes and their corresponding URLs, as well as updating the FILE_UPLOAD_TYPES setting to specify a list of acceptable file types that can be uploaded to the application.

From an application security perspective, these changes are positive steps towards enhancing the security and usability of the DefectDojo application. The updated VULNERABILITY_URLS dictionary ensures that users can easily access vulnerability information from various sources, which can help in understanding and addressing identified vulnerabilities. The FILE_UPLOAD_TYPES setting is also an important security consideration, as it helps to restrict the types of files that can be uploaded to the application, thereby mitigating the risk of arbitrary file upload vulnerabilities.

Files Changed:

• dojo/settings/settings.dist.py: This file contains the configuration settings for the DefectDojo application. The key changes in this pull request include:
  1. Updating the VULNERABILITY_URLS dictionary to include new vulnerability ID prefixes and their corresponding URLs, allowing the application to link to the appropriate vulnerability information pages.
  2. Updating the FILE_UPLOAD_TYPES setting to include a list of acceptable file types that can be uploaded to a given object via arbitrary file upload, helping to mitigate the risk of arbitrary file upload vulnerabilities.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[manuel-sommer]

For "VNS": "https://vulners.com/" I did not find an example

[mtesauro]

Approved