TDEAL-16: ZAP improvements #334

sarahelsaig · 2023-12-27T23:37:01Z

TDEAL-16

Summary by CodeRabbit

Refactor
- Improved configuration handling for security scanning features.
- Streamlined logic for temporary disabling of app log assertions during security scans.
- Enhanced YAML document manipulation with a new method for node retrieval and addition.
New Features
- Added capability to mark certain security scan rules as false positives.
- Introduced new methods for customizing the security scanning plan.

…tion.

…dle them in a specific restricted manner so exposing the original collections is only asking for shenanigans.

…re.Https".

…-Toolbox into issue/TDEAL-16

Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs

Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs

Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs

Lombiq.Tests.UI/SecurityScanning/YamlDocumentExtensions.cs

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml

Co-authored-by: Zoltán Lehóczky <[email protected]>

…Core.Diagnostics by default anyway.

Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs

Lombiq.Tests.UI/Extensions/ShouldlyExtensions.cs

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

… the samples.

… message.

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs

Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs

Lombiq.Tests.UI/Docs/SecurityScanning.md

Lombiq.Tests.UI/SecurityScanning/SecurityScanningConfiguration.cs

…Extensions.cs Co-authored-by: Zoltán Lehóczky <[email protected]>

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

Piedone

See my reply comments.

sarahelsaig added 13 commits December 26, 2023 13:26

Update baseline rule exception.

816c476

Merge remote-tracking branch 'origin/dev' into issue/TDEAL-16

3eec5b1

The baseline scan should visit at least one page that throws an excep…

7856594

…tion.

Disable app log assertion for the duration of the security scan.

222be47

Merge remote-tracking branch 'origin/dev' into issue/TDEAL-16

dfd2c55

unusing

6cfb21d

Expect custom error page.

b60dfe0

Disable rule 10037.

eea23bd

Fix disabled rules, shouldn't have been dictionary.

71f189d

Turn all the collections into private, because we have methods to han…

e011568

…dle them in a specific restricted manner so exposing the original collections is only asking for shenanigans.

Some YAML extensio DRYing.

f8219f8

By default ignore /vendor/ or /vendors/ URLs.

c61a55c

unusing

f6ea9fb

github-actions bot changed the title ~~ZAP improvements~~ TDEAL-16: ZAP improvements Dec 27, 2023

sarahelsaig mentioned this pull request Dec 27, 2023

TDEAL-16: Security and ZAP improvements Lombiq/Open-Source-Orchard-Core-Extensions#657

Merged

sarahelsaig added 3 commits December 28, 2023 02:04

Fix sample.

32f03dd

Why was this rule disabled in the first place? Just enable "OrchardCo…

445074d

…re.Https".

Merge branch 'issue/TDEAL-16' of https://github.com/Lombiq/UI-Testing…

bf117a6

…-Toolbox into issue/TDEAL-16

Piedone requested changes Dec 28, 2023

View reviewed changes

Piedone reviewed Dec 28, 2023

View reviewed changes

Lombiq.Tests.UI/SecurityScanning/AutomationFrameworkPlans/Baseline.yml Outdated Show resolved Hide resolved

sarahelsaig and others added 10 commits December 28, 2023 23:02

Update the comment.

1a6ad0c

Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

5dd7647

Co-authored-by: Zoltán Lehóczky <[email protected]>

Remove duplicate method.

2544f98

More documentation.

a97fd47

Explain why disabling "Strict-Transport-Security Header" is necessary.

33810db

Remove forced error generation because we are going to enable Orchard…

a1e8dad

…Core.Diagnostics by default anyway.

Tweak app log error handling during sercurity scan..

e0c6d65

Disable 10062.

6fa5d43

Typo.

5e3ed10

Update coment regarding unsafe-inline.

d1fd50d

Piedone reviewed Jan 12, 2024

View reviewed changes

Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs Show resolved Hide resolved

Add ShouldBeEmptyWhen extension method.

7328baa

coderabbitai bot reviewed Jan 13, 2024

View reviewed changes

Lombiq.Tests.UI/Extensions/ShouldlyExtensions.cs Outdated Show resolved Hide resolved

sarahelsaig added 2 commits January 13, 2024 01:59

Refactor AddDisableRuleFilter,

ab5cd44

False positives should contain both the name and justification.

4b1b773

coderabbitai bot reviewed Jan 13, 2024

View reviewed changes

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs Outdated Show resolved Hide resolved

sarahelsaig and others added 3 commits January 13, 2024 02:03

Add optional jsonSerializerOptions.

2461d21

Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

573eacc

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Update SecurityScanWithCustomConfigurationShouldPass and its comments.

3f1a389

coderabbitai bot reviewed Jan 13, 2024

View reviewed changes

Lombiq.Tests.UI.Samples/Tests/SecurityScanningTests.cs Show resolved Hide resolved

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs Outdated Show resolved Hide resolved

sarahelsaig and others added 9 commits January 13, 2024 02:43

Fix missing default parameter.

fdb704c

Fix docstrings.

16c5ca7

Restore sample assertion and update expected count.

5151a15

Add extension method and use security scan forgiving app assertion in…

b9d398e

… the samples.

Instead of suppressing logs, just suppress the error page's exception…

0640fb2

… message.

Add GetAbsoluteUrlOfAction.

dc737f6

Use requestor instead of second scan.

2784993

Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs

35fb6e8

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Code formatting and organization.

74bae9c

Piedone requested changes Jan 14, 2024

View reviewed changes

sarahelsaig and others added 2 commits January 14, 2024 22:00

Update Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContext…

7397bb9

…Extensions.cs Co-authored-by: Zoltán Lehóczky <[email protected]>

Various doc fixes.

9852ab3

coderabbitai bot reviewed Jan 14, 2024

View reviewed changes

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs Show resolved Hide resolved

Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs Show resolved Hide resolved

unusing

4bb9d42

Piedone requested changes Jan 14, 2024

View reviewed changes

sarahelsaig added 3 commits January 15, 2024 01:19

Additional instructions.

1fd80a3

Remove this thing whatever it is.

c6c1035

Make it a range.

ffc674a

Piedone approved these changes Jan 15, 2024

View reviewed changes

Piedone merged commit 3589205 into dev Jan 15, 2024
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TDEAL-16: ZAP improvements #334

TDEAL-16: ZAP improvements #334

sarahelsaig commented Dec 27, 2023 •

edited by coderabbitai bot

Loading

Piedone left a comment

TDEAL-16: ZAP improvements #334

TDEAL-16: ZAP improvements #334

Conversation

sarahelsaig commented Dec 27, 2023 • edited by coderabbitai bot Loading

Summary by CodeRabbit

Piedone left a comment

Choose a reason for hiding this comment

sarahelsaig commented Dec 27, 2023 •

edited by coderabbitai bot

Loading