Updates Documentation Site

[devGregA]

• Improves styling with branding guide as reference
• separates OS vs Pro in more areas

[dryrunsecurity]

🟡 Please give this pull request extra attention during review.

This pull request introduces multiple instances where Hugo templates render content without proper escaping or sanitization (e.g., raw .Content and page params in layouts/_default/list.html, use of safeHTML on .Params.lead in layouts/home.html, and safeHTML on menu .Pre in _partials/footer/footer.html), creating potential stored XSS vectors if authors or site configuration can be influenced by untrusted input. These findings are risky but non-blocking and recommend applying context-aware escaping or sanitization before emitting user- or config-supplied HTML.

🟡 Potential Cross-Site Scripting in docs/layouts/_default/list.html (77dcce3b)

Vulnerability

Potential Cross-Site Scripting

Description

The patch renders .Content and several page parameters (.Params.title, .Description, .Params.lead, .RelPermalink) directly into HTML without applying explicit escaping or context-aware sanitization. In Hugo (Go templates) .Content is the rendered HTML of a page and is intentionally raw HTML; inserting it unescaped into a page will include any embedded HTML/ scripts from the source. Similarly, using params like .Params.lead or .Description without filters relies on their contents being trusted — if authors or upstream content can include untrusted markup, that will be emitted raw. There is no evidence in the patch of contextual escaping (e.g., htmlEscape) or sanitization (e.g., passing through a sanitizer) before output, so user-supplied or content-supplied HTML can reach the rendering sink unsanitized.

django-DefectDojo/docs/layouts/_default/list.html

Lines 6 to 9 in b876803

	{{ with .Content }}<div>{{ . }}</div>{{ end }}
	<div class="card-list">
	{{ $currentSection := .CurrentSection }}
	{{ range where .Site.RegularPages.ByTitle "Section" .Section }}

🟡 Potential Cross-Site Scripting in docs/layouts/_partials/footer/footer.html (7d69853b)

Vulnerability

Potential Cross-Site Scripting

Description

The template iterates over .Site.Menus.social and renders .Pre using the safeHTML filter ({{ .Pre safeHTML }}). safeHTML disables Hugo's automatic escaping and inserts raw HTML into the page. Menu fields such as .Pre, .URL, and .Name are content-driven and may originate from site configuration or CMS-managed data; if an attacker can modify those menu entries (or if configuration contains untrusted input), arbitrary HTML/JS can be injected into the footer. No sanitization is applied before rendering with safeHTML, and surrounding attributes (href and aria-label) are not further validated or escaped in a context-appropriate way, so a path exists for malicious input to reach an HTML sink unsafely.

django-DefectDojo/docs/layouts/_partials/footer/footer.html

Lines 54 to 57 in b876803

	{{ .Pre | safeHTML }}
	</a>
	{{ end -}}
	</div>

🟡 Potential Cross-Site Scripting in docs/layouts/home.html (9d584e69)

Vulnerability	Potential Cross-Site Scripting
Description	The template uses the Hugo 'safeHTML' filter on .Params.lead ("{{ .Params.lead safeHTML }}"), which disables template auto-escaping and will render raw HTML. If .Params.lead can be influenced by an attacker (e.g., from page front-matter or CMS input), that user-controlled content would be injected into the page without escaping, allowing stored or reflected XSS.

django-DefectDojo/docs/layouts/home.html

Lines 11 to 14 in b876803

	<p class="lead">{{ .Params.lead | safeHTML }}</p>
	<div class="hero-actions">
	<a class="btn btn-primary rounded-pill btn-lg" href="{{ if site.Params.doks.docsVersioning }}{{ site.Params.doks.docsVersion }}/{{ end }}/get_started/about/about_defectdojo/" role="button">Get Started</a>
	<a class="btn btn-outline-secondary rounded-pill btn-lg ms-2" href="/supported_tools/" role="button">Supported Tools</a>

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved

[paulOsinski]

Content is ok but I'll see if we can address the XSS issue.