Advance OIDC to enable groups mapping

[manuel-sommer]

• Implement OIDC groups to be parsed.
• Added Unittests for update_oidc_groups and update_azure_groups

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies multiple sensitive codepaths (dojo/pipeline.py, dojo/models.py, dojo/group/utils.py, and a DB migration) flagged for sensitive edits and requiring verification against .dryrunsecurity.yaml, and it also introduces a potential ReDoS risk by using the admin-configurable settings.OIDC_GROUPS_FILTER directly in re.search without validation or timeout. Reviewers should confirm allowed authors/paths in .dryrunsecurity.yaml and validate or safely handle the OIDC regex to mitigate catastrophic backtracking.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/db_migrations/0252_alter_dojo_group_social_provider.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/group/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/group/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/group/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Regular Expression Denial of Service (ReDoS) in dojo/pipeline.py

Vulnerability

Regular Expression Denial of Service (ReDoS)

Description

The function uses a user-configurable setting, settings.OIDC_GROUPS_FILTER, directly as a regular expression pattern in re.search(). There is no validation on the complexity of this pattern, nor is there a timeout mechanism. If an administrator configures a vulnerable regex (e.g., one susceptible to catastrophic backtracking), an attacker who can influence the group names returned by the OIDC provider could trigger a Denial of Service.

django-DefectDojo/dojo/pipeline.py

Lines 122 to 125 in 94d7f89

	if group_filter and not re.search(group_filter, group_name):
	logger.debug(f"Skipping group '{group_name}' due to OIDC_GROUPS_FILTER: {group_filter}")
	continue
	filtered_group_names.append(group_name)

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[manuel-sommer]

@valentijnscholten could you please take a look here?

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.