Ruff: Fix PLC2701 + merge PLC

[kiblik]

If functions are not only for private use, they should not use a private naming convention. Applies to:

• _get_prefetchable_fields
• _copy_model_util

Regarding from hyperlink._url import SCHEME_PORT_MAP, there is no known better alternative.

[dryrunsecurity]

This pull request introduces model copy utilities that by default duplicate all fields and lack built-in authorization checks, so sensitive fields (credentials, PII, internal details) can be unintentionally copied and users with read access might create full copies they shouldn’t be able to, leading to potential information disclosure and access-control bypass.

Information Disclosure via Model Copying in dojo/models.py

Vulnerability

Information Disclosure via Model Copying

Description

The copy_model_util function, when called without specifying exclude_fields, copies all fields from a model instance to a new one. Several copy methods in dojo/models.py use this utility without excluding potentially sensitive fields. This means that if a model contains sensitive data (e.g., internal network details, credentials, PII), this data will be duplicated into the new instance. If the copied instance is then accessible to unauthorized users or users with lower privileges, it can lead to information disclosure.

django-DefectDojo/dojo/models.py

Lines 132 to 135 in ac2874e

	def copy_model_util(model_in_database, exclude_fields: list[str] | None = None):
	if exclude_fields is None:
	exclude_fields = []
	new_model_instance = model_in_database.__class__()

Missing Authorization Checks in Model Copy Operations in dojo/models.py

Vulnerability

Missing Authorization Checks in Model Copy Operations

Description

The copy_model_util function and the model-specific copy methods that utilize it (e.g., for NoteHistory, Engagement, Finding) do not include any authorization checks. This means that if these copy methods are invoked from any part of the application without explicit, robust authorization checks at the call site, a user could potentially bypass access controls. A user with read access to an object might be able to create a full copy of it, gaining ownership or access to data they were not authorized to create or fully access in the original context.

django-DefectDojo/dojo/models.py

Lines 132 to 135 in ac2874e

	def copy_model_util(model_in_database, exclude_fields: list[str] | None = None):
	if exclude_fields is None:
	exclude_fields = []
	new_model_instance = model_in_database.__class__()

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved