Mitigated On/Before/After now use DateTimeFilter

[hblankenship]

Fixes filtering for mitigation for the on/before/after fields

[sc-7759]

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the Defect Dojo application's filtering capabilities by adding DateTimeFilter for mitigated date fields, improving the ability to track and manage findings more precisely.

Expand for full summary

Summary:

The changes in this pull request are focused on improving the filtering functionality of the Defect Dojo application, specifically related to the mitigated date of findings. The changes include the addition of a DateTimeFilter for the mitigated_on, mitigated_before, and mitigated_after fields in the ApiFindingFilter and FindingFilterHelper classes. This enhancement allows for more precise filtering of findings based on the mitigated date, which can be useful for security teams to better understand the status of findings and track their remediation progress.

From an application security perspective, these changes do not directly address any specific security vulnerabilities. However, they do improve the overall functionality and usability of the Defect Dojo application, which can indirectly contribute to a more secure environment by providing security teams with better tools to manage and track findings.

Files Changed:

• dojo/filters.py: This file contains the changes related to the addition of the DateTimeFilter for the mitigated_on, mitigated_before, and mitigated_after fields in the ApiFindingFilter and FindingFilterHelper classes. These changes improve the filtering functionality of the Defect Dojo application, allowing for more granular control over the tracking and management of findings based on their mitigated date.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[Maffooch]

If a user were to be reliant on passing a date to this filter, would the API accept the absence of the timestamp? For example, if the query was mitigated_on=2025-01-02 would a validation error be thrown?

[hblankenship]

A validation error does not get thrown if you use 2025-01-02 without the timestamp. Should it?