New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ZAP Scan Baseline Report #86

Open

github-actions bot opened this issue Apr 9, 2021 · 4 comments

github-actions bot commented Apr 9, 2021

Site: https://localhost
New Alerts
- Timestamp Disclosure - Unix [10096] total: 15:
- X-Content-Type-Options Header Missing [10021] total: 11:
- Modern Web Application [10109] total: 6:
- X-Frame-Options Header Not Set [10020] total: 2:
  - https://localhost/
  - https://localhost
- Content Security Policy (CSP) Header Not Set [10038] total: 4:
- Information Disclosure - Suspicious Comments [10027] total: 11:
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 4:
- Incomplete or No Cache-control Header Set [10015] total: 3:
- Application Error Disclosure [90022] total: 1:
  - https://localhost/_next/static/chunks/pages/_error-b124520ada623f3bf8a0.js

View the following link to download the report.
RunnerID:731435512

Member

slowr commented Apr 9, 2021 •

edited

Loading

@vkotronis this is the new report with nginx proxy in front.

There are some missing stuff that we had before like CSP: https://github.com/FORTH-ICS-INSPIRE/artemis/blob/5b12a9d79a2785d53182244b2eec0d30f87aad96/frontend/webapp/core/__init__.py#L48

Then we need to hide some stuff in nginx configuration and lastly, we can create a file in the repo for some false-negatives.

(more info if you download the report)

Member

vkotronis commented Apr 9, 2021

@slowr I approved the nginx PR, could you also create an issue with the missing CSP details?

Author

github-actions bot commented Apr 26, 2021

Site: https://localhost
New Alerts
- Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 11:
- CSP: script-src unsafe-inline [10055] total: 3:
- CSP: style-src unsafe-inline [10055] total: 3:
- CSP: Wildcard Directive [10055] total: 3:
- CSP: Notices [10055] total: 3:
Resolved Alerts
- X-Content-Type-Options Header Missing [10021] total: 11:
- X-Frame-Options Header Not Set [10020] total: 2:
- Content Security Policy (CSP) Header Not Set [10038] total: 4:
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 4:

View the following link to download the report.
RunnerID:784860073

Author

github-actions bot commented May 13, 2021

Site: https://localhost
New Alerts
- X-Content-Type-Options Header Missing [10021] total: 11:
- X-Frame-Options Header Not Set [10020] total: 2:
  - https://localhost/
  - https://localhost
- Content Security Policy (CSP) Header Not Set [10038] total: 4:
- Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 4:
Resolved Alerts
- Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 11:
- CSP: script-src unsafe-inline [10055] total: 3:
- CSP: style-src unsafe-inline [10055] total: 3:
- CSP: Wildcard Directive [10055] total: 3:
- CSP: Notices [10055] total: 3:

View the following link to download the report.
RunnerID:839280981

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment