Skip to content

allow .fpr extension when importing scan #12972

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

fopina
Copy link
Contributor

@fopina fopina commented Aug 12, 2025

Description

dojo/tools/fortify/parser.py expects FPR reports to have the .fpr extension, yet .fpr is not part of the allowed import extensions.

Via the UI, it is not listed as supported type but it can still be uploaded (by choosing any type). But via API it is simply not possible.

Test results

  • .fpr shows up as supported type in the report file browse dialog of import scan UI
  • .fpr files can be imported via import-scan/reimport-scan API endpoints

Checklist

This checklist is for your information.

  • Make sure to rebase your PR against the very latest dev.
  • Features/Changes should be submitted against the dev.
  • Bugfixes should be submitted against the bugfix branch.
  • Give a meaningful name to your PR, as it may end up being used in the release notes.
  • Your code is flake8 compliant.
  • Your code is python 3.11 compliant.
  • If this is a new feature and not a bug fix, you've included the proper documentation in the docs at https://github.com/DefectDojo/django-DefectDojo/tree/dev/docs as part of this PR.
  • Model changes must include the necessary migrations in the dojo/db_migrations folder.
  • Add applicable tests to the unit tests.
  • Add the proper label to categorize your PR.

Copy link

DryRun Security

🔴 Risk threshold exceeded.

This pull request contains a sensitive edit to the file "dojo/forms.py" which requires configuration in the .dryrunsecurity.yaml file to specify allowed authors and file paths, but the change is currently non-blocking.

🔴 Configured Codepaths Edit in dojo/forms.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

We've notified @mtesauro.


All finding details can be found in the DryRun Security Dashboard.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch merged commit a51d0e2 into DefectDojo:bugfix Aug 15, 2025
85 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants