Skip to content

Findings risk accepted using "Risk Accepted resolution mapping" have no expiration date #13439

@maxi-bee

Description

@maxi-bee

Bug description
The Jira integration has an setting "Risk Accepted resolution mapping" for using Risk Acceptance from Jira. Whenever a resolution configured via a Jira configuration assigned to a product, tickets with such resolution will be risk accepted on the Defect Dojo side. The bug is that this integration DOES NOT set the expiration_time (default on the model is also None, at the model), resulting a the acceptance never expiring, which is very inconvenient.

Instead, maybe this should either used the "Risk acceptance form default days" on the System Settings or a new setting "Risk acceptance integrations default days" or use a single one "Risk acceptance default days". In this PR, I am proposing it to use the "Risk acceptance form default days" for this too

Steps to reproduce
Steps to reproduce the behavior:

  1. Configure a Jira configuration with a "Risk Accepted resolution mapping"
  2. Set everything up properly and validate integration works
  3. Move the Jira ticket resoltion to the matching resolution mapping on Jira
  4. Notice the Defect Dojo finding is now "Risk Accepted"
  5. Verify that the expiration date for such finding is "Never"

Expected behavior
The expiration date used should be a default on the settings, rather than never, "Risk acceptance form default days" works for now

Deployment method (select with an X)

  • Docker Compose
  • Kubernetes
  • GoDojo

Environment information
Any

Logs
Don't have any

Sample scan files
N/A

Screenshots
N/A

Additional context (optional)
N/A

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions