JIRA helper: respect simple/full risk acceptance on webhook processiing

[valentijnscholten]

I noticed that Findings that were "Risk Accepted" in JIRA did not set the finding.risk_accepted field. Also a full Risk_Acceptance was created even if that feature was disabled for the product. This PR corrects this.

This code is executed when a webhook is coming from JIRA or when the management command jira_status_reconciliation is run.

[dryrunsecurity]

This pull request introduces a potential information disclosure vulnerability through debug logging in the Jira link helper, where sensitive identifiers like jira_issue.jira_key could be exposed if debug logging is accidentally enabled in a production environment.

Information disclosure via debug logging in dojo/jira_link/helper.py

Vulnerability	Information disclosure via debug logging
Description	The patch introduces new logger.debug statements that include jira_issue.jira_key. While debug logs are generally not a high risk, if debug logging is inadvertently enabled in production, sensitive internal identifiers or system details can be exposed. This falls under information disclosure.

django-DefectDojo/dojo/jira_link/helper.py

Lines 1674 to 1697 in a6166b2

	jira_instance = get_jira_instance(finding)
	if resolved:
	if jira_instance and resolution_name in jira_instance.accepted_resolutions and (finding.test.engagement.product.enable_simple_risk_acceptance or finding.test.engagement.enable_full_risk_acceptance):
	if not finding.risk_accepted:
	logger.debug(f"Marking related finding of {jira_issue.jira_key} as accepted.")
	finding.risk_accepted = True
	finding.active = False
	finding.mitigated = None
	finding.is_mitigated = False
	finding.false_p = False
	if finding.test.engagement.product.enable_full_risk_acceptance:
	logger.debug(f"Creating risk acceptance for finding linked to {jira_issue.jira_key}.")
	ra = Risk_Acceptance.objects.create(
	accepted_by=assignee_name,
	owner=finding.reporter,
	decision_details=f"Risk Acceptance automatically created from JIRA issue {jira_issue.jira_key} with resolution {resolution_name}",
	)
	finding.test.engagement.risk_acceptance.add(ra)
	ra_helper.add_findings_to_risk_acceptance(User.objects.get_or_create(username="JIRA")[0], ra, [finding])
	status_changed = True
	elif jira_instance and resolution_name in jira_instance.false_positive_resolutions:
	if not finding.false_p:

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved