feat(k8s-test): Try login and obtain API token

[kiblik]

Simple "give me login page" is not enough. It should be possible to log in to the working application.

This PR add test for:

• simple login
• simple API test - get token

Added based on #10490

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code changes focus on improving the administration and deployment of the Defect Dojo application, with a specific emphasis on the Engagement Surveys feature and the Kubernetes deployment process.

The changes in the admin.py file set up the administration of the Engagement Surveys models, including Question, Answer, Engagement_Survey, and Answered_Survey, using Django's polymorphic admin functionality. This allows the admin interface to handle different types of questions and answers seamlessly. From a security perspective, these changes do not introduce any obvious vulnerabilities, but it's important to ensure that the underlying data models and business logic are properly secured and validated.

The changes in the .github/workflows/k8s-tests.yml file focus on improving the Kubernetes deployment process by adding checks for login and API functionality, handling errors and retries, and securely retrieving sensitive information. These changes help ensure the core functionality of the application is working as expected after deployment and address potential security concerns related to sensitive information handling.

Files Changed:

1. dojo/admin.py:

   • Unregisters the LogEntry model from the Django admin interface.
   • Sets up the administration of the Engagement Surveys models, including Question, Answer, Engagement_Survey, and Answered_Survey, using Django's polymorphic admin functionality.
   • Registers the QuestionParentAdmin and AnswerParentAdmin classes, along with the individual child model admins.
   • Registers the Engagement_Survey and Answered_Survey models with the Django admin interface.

2. .github/workflows/k8s-tests.yml:

   • Adds checks to ensure the login page is accessible and the admin user can authenticate successfully.
   • Checks the API endpoint for token authentication.
   • Checks for any pods in an error state and dumps the logs for those pods.
   • Includes a retry mechanism for the login check.
   • Retrieves the admin password from a Kubernetes secret.
   • Includes a sample curl request to demonstrate how to log in to the DefectDojo application using the admin credentials.

Powered by DryRun Security

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on the Defect Dojo Engagement Surveys feature and a GitHub Actions workflow for deploying the Defect Dojo application to a Kubernetes cluster, with no obvious security vulnerabilities introduced, and includes a robust administrative interface and a well-structured and comprehensive deployment process with a focus on security and reliability.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on the Defect Dojo Engagement Surveys feature and a GitHub Actions workflow for deploying the Defect Dojo application to a Kubernetes cluster. From an application security perspective, the changes do not introduce any obvious security vulnerabilities.

The changes to the admin.py file in the Defect Dojo codebase demonstrate the use of established libraries and the implementation of a robust administrative interface for managing survey-related data. The GitHub Actions workflow, on the other hand, showcases a well-structured and comprehensive deployment process, with a focus on security and reliability.

While the changes appear to be sound from a security standpoint, it's always important to review the entire codebase and thoroughly test any changes to ensure the application's security is maintained. Additionally, there are a few potential improvements that could be made to the GitHub Actions workflow, such as adding more comprehensive testing and optimizing the build process.

Files Changed:

1. dojo/admin.py:

   • The code changes are related to the Defect Dojo Engagement Surveys feature.
   • The code uses the auditlog library to log changes to the application, which is a good security practice.
   • The code utilizes the polymorphic library to handle different types of Question and Answer models, a common design pattern for handling heterogeneous data structures.
   • The code registers various Django admin classes for managing the Engagement Surveys, demonstrating a robust administrative interface.

2. .github/workflows/k8s-tests.yml:

   • The code change is part of a GitHub Actions workflow for deploying the Defect Dojo application to a Kubernetes cluster using Helm.
   • The workflow checks out the code, sets up Minikube, loads Docker images, and configures the Helm repository.
   • It then deploys the Defect Dojo application using Helm, with the appropriate database and broker settings.
   • The workflow includes a login check and an API token authentication check, which is a good practice to ensure the application is accessible and functioning as expected.
   • The workflow retrieves the admin password from a Kubernetes secret, a secure way to handle sensitive information.
   • The workflow uses the --overrides flag to pass the database and broker settings, keeping the deployment configuration separate from the workflow.

Code Analysis

We ran 7 analyzers against 2 files and 0 analyzers had findings. 7 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.