fix(helm): Empty string values propagated as strings (not as null)

[kiblik]

During more testing of the HELM chart with schema, I noticed a collision like

- at '/django/mediaPersistentVolume/persistentVolumeClaim/storageClassName': got string, want null

[dryrunsecurity]

This pull request introduces an insecure default configuration in the Helm chart (helm/defectdojo/values.yaml) by setting sensitive fields like admin.password, admin.secretKey, admin.credentialAes256Key, and admin.metricsHttpAuthPassword to empty strings. If deployed without overrides, this can produce blank credentials and missing cryptographic keys—allowing unauthorized access and compromising data integrity/confidentiality—while the chart does not enforce or auto-generate secure values.

Insecure Default Configuration in helm/defectdojo/values.yaml

Vulnerability

Insecure Default Configuration

Description

The Helm chart's values.yaml now defaults sensitive fields like admin.password, admin.secretKey, admin.credentialAes256Key, and admin.metricsHttpAuthPassword to empty strings. If a user deploys the chart without overriding these values, the application will be configured with blank or non-existent credentials and cryptographic keys. This leads to a highly insecure deployment, potentially allowing unauthorized access (due to an empty password) and compromising data integrity/confidentiality (due to empty secret/AES keys). The chart does not appear to enforce user-provided values or auto-generate secure ones when these are left empty.

django-DefectDojo/helm/defectdojo/values.yaml

Lines 124 to 136 in d1d6837

	admin:
	user: admin
	password: ""
	firstName: Administrator
	lastName: User
	mail: admin@defectdojo.local
	secretKey: ""
	credentialAes256Key: ""
	metricsHttpAuthPassword: ""
	monitoring:
	enabled: false

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved