Ruff: Add PLC1901 to dojo/models

[manuel-sommer]

No description provided.

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies dojo/models.py and triggered sensitive-file edit warnings (these paths and allowed authors can be configured in .dryrunsecurity.yaml). It also changes the clean() method to convert empty strings for protocol, userinfo, path, query, and fragment to None, which may cause TypeError in downstream code that expects strings.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Potential Type Confusion (None vs. Empty String) in dojo/models.py

Vulnerability	Potential Type Confusion (None vs. Empty String)
Description	The clean method now explicitly converts empty string values for protocol, userinfo, path, query, and fragment to None. This change in type from an empty string to None can lead to TypeError exceptions in downstream code that expects a string and does not handle None values, potentially causing a denial of service.

django-DefectDojo/dojo/models.py

Lines 1826 to 1841 in 4783658

	errors = []
	null_char_list = ["0x00", "\x00"]
	db_type = connection.vendor
	if self.protocol is not None:
	if not re.match(r"^[A-Za-z][A-Za-z0-9\.\-\+]+$", self.protocol): # https://tools.ietf.org/html/rfc3986#section-3.1
	errors.append(ValidationError(f'Protocol "{self.protocol}" has invalid format'))
	if not self.protocol:
	self.protocol = None
	if self.userinfo is not None:
	if not re.match(r"^[A-Za-z0-9\.\-_~%\!\$&\'\(\)\*\+,;=:]+$", self.userinfo): # https://tools.ietf.org/html/rfc3986#section-3.2.1
	errors.append(ValidationError(f'Userinfo "{self.userinfo}" has invalid format'))
	if not self.userinfo:
	self.userinfo = None
	if self.host:

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved