DefectDojo "All Findings" and Detail View Inconsistent

[thekief]

Bug description

I recently had to import an finding with the following format, which I also imported in the demo instance (see https://demo.defectdojo.org/finding?vulnerability_id=test-123 and https://demo.defectdojo.org/finding/348 )

=> example snippet in Sample scan files

When importing findings are shown, e.g., in the "All Findings" view, the & is displayed in the corresponding HTML encoding. When clicking on the detailed view, this encoding persists in the path but is decoding in the title

=> see picture in Screenshots

Steps to reproduce

Steps to reproduce the behavior:

1. go to an engagement
2. import the JSON snippet shown above
3. wait for the import to finish and check the listed findings

Expected behavior

I would expect a consistent display of the information that doesn't show the HTML encodings.

Deployment method (select with an X)

• Docker Compose
• Kubernetes
• GoDojo

Environment information

• Operating System: n/a
• Docker Compose or Helm version: n/a
• DefectDojo version (see footer) or commit message: v. 2.54.3

Logs
n/a

Sample scan files

{
  "findings": [
    {
      "cve": "test-123",
      "title": "When Doing This & That",
      "severity": "Medium",
      "cvssv3_score":  5.1,
      "cvssv3": "3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L",
      "description": "We were doing very, very interesting things and found some stuff."
    }
  ]
}

Screenshots

Additional context (optional)
Add any other context about the problem here.

[tejas0077]

Hi @thekief, I've identified the issue. The "All Findings" view uses
the truncatechars_html filter which HTML-encodes special characters
like & to &, while the detail view uses plain {{ finding.title }}
without this filter. I'd like to submit a fix. Happy to raise a PR!

[thekief]

Thank you for identifying the issue :)

Did you check by chance, if there are also other places where this happens?

[tejas0077]

Yes! I found the same issue in 8 other templates and have fixed all of them in the updated PR #14524. The following templates were also affected:

• request_report.html
• templates.html
• breadcrumbs/finding_breadcrumb.html
• add_findings_as_accepted.html
• finding_related_row.html
• view_risk_acceptance.html
• view_test.html
• metrics.html