Code

OSOE-351: Offer security checks#322

Code

Merged

Piedone merged 133 commits intodevLombiq/UI-Testing-Toolbox:devfrom issue/OSOE-351Lombiq/UI-Testing-Toolbox:issue/OSOE-351Copy head branch name to clipboardDec 5, 2023

+2,253-44

Commits

Commits on Nov 14, 2023

• Adding basics of installing ZAP from Docker

  Piedone

  committed
  0d18df7

  Copy full SHA for 0d18df7

• Adding ZAP baseline scan run as a prototype

  Piedone

  committed
  338811b

  Copy full SHA for 338811b

• Inserting SecurityScanningTests into the sample walkthrough

  Piedone

  committed
  32f9b54

  Copy full SHA for 32f9b54

• Interactive mode docs and making internally used methods internal

  Piedone

  committed
  2d288e3

  Copy full SHA for 2d288e3

• Running ZAP scans for the current base URL

  Piedone

  committed
  290aa3d

  Copy full SHA for 290aa3d

• Temporarily not running retries

  Piedone

  committed
  62c4233

  Copy full SHA for 62c4233

• Fixing ZAP network access under Linux

  Piedone

  committed
  ed31832

  Copy full SHA for ed31832

• Managing the ZapManager instance centrally

  Piedone

  committed
  8af3f0d

  Copy full SHA for 8af3f0d

• Redirecting ZAP output to the test output

  Piedone

  committed
  19cc147

  Copy full SHA for 19cc147

• Making SecurityScanShouldPass pass with simplified setup

  Piedone

  committed
  f174c2f

  Copy full SHA for f174c2f

• Docs

  Piedone

  committed
  d0ba4a8

  Copy full SHA for d0ba4a8

Commits on Nov 15, 2023

• Basics of using YAML config files

  Piedone

  committed
  dd3ff19

  Copy full SHA for dd3ff19

• Adding support for YAML config files

  Piedone

  committed
  8c703cc

  Copy full SHA for 8c703cc

• Running spiderAjax only for "modern" apps

  Piedone

  committed
  1c6667a

  Copy full SHA for 1c6667a

• Switching to the Blog recipe since ZAP has a bug with Coming Soon

  Piedone

  committed
  540dc9e

  Copy full SHA for 540dc9e

• Link to ZAP bug report

  Piedone

  committed
  51f429d

  Copy full SHA for 51f429d

• Centralizing YAML paths

  Piedone

  committed
  06d5560

  Copy full SHA for 06d5560

• More flexible YML manipulation

  Piedone

  committed
  4fa49b9

  Copy full SHA for 4fa49b9

• Adding UITestContext extensions for security scans

  Piedone

  committed
  e25d515

  Copy full SHA for e25d515

• Nicer-looking reports

  Piedone

  committed
  1ba4af9

  Copy full SHA for 1ba4af9

• Adding basics of separate docs page

  Piedone

  committed
  821bf4a

  Copy full SHA for 821bf4a

• Generating SARIF reports too

  Piedone

  committed
  7c21ab1

  Copy full SHA for 7c21ab1

• Automatically setting report directories to the conventional one

  Piedone

  committed
  754bd4c

  Copy full SHA for 754bd4c

• Docs

  Piedone

  committed
  694557f

  Copy full SHA for 694557f

• Changing report theme to the less extravagant "corporate" one

  Piedone

  committed
  06a7e02

  Copy full SHA for 06a7e02

• Saving ZAP reports into the Failure Dump

  Piedone

  committed
  06bbfe0

  Copy full SHA for 06bbfe0

• Adding the ability to assert on security scan results

  Piedone

  committed
  c5fc663

  Copy full SHA for c5fc663

• Making SecurityScanShouldPass pass

  Piedone

  committed
  4fbd32a

  Copy full SHA for 4fbd32a

Commits on Nov 16, 2023

• Docs

  Piedone

  committed
  2c48541

  Copy full SHA for 2c48541

• Adding assertion delegate that doesn't fail on HSTS not being set

  Piedone

  committed
  868763a

  Copy full SHA for 868763a

• Changing ugly object-based YAML manipulation to nicer YamlDocument-based one

  Piedone

  committed
  0a5f608

  Copy full SHA for 0a5f608

• Simpler sample assertion

  Piedone

  committed
  f2b5407

  Copy full SHA for f2b5407

• Docs

  Piedone

  committed
  d1c851a

  Copy full SHA for d1c851a

• Fixing that Automation Framework plan YAMLs were called "configuration files"

  Piedone

  committed
  35f2e8e

  Copy full SHA for 35f2e8e

• Making sure Automation Framework Plans are copied to the NuGet package too

  Piedone

  committed
  1509582

  Copy full SHA for 1509582

• Restoring the Baseline plan

  Piedone

  committed
  5ed1520

  Copy full SHA for 5ed1520

• Less oblivious assertion in sample test

  Piedone

  committed
  361d165

  Copy full SHA for 361d165

• Disabling the Strict-Transport-Security Header Not Set rule since it's not applicable for a localhost app

  Piedone

  committed
  74693fa

  Copy full SHA for 74693fa

• Removing the spiderAjax job from plans by default but adding configuration to re-add it, as well as configure excludePaths

  Piedone

  committed
  0e4f77b

  Copy full SHA for 0e4f77b

• Fixing SecurityScanWithCustomConfigurationShouldPass

  Piedone

  committed
  c4ae329

  Copy full SHA for c4ae329

• Better configurability

  Piedone

  committed
  61f162d

  Copy full SHA for 61f162d

• Fixing debug code

  Piedone

  committed
  6ee61e1

  Copy full SHA for 6ee61e1

• Docs formatting

  Piedone

  committed
  0980b9d

  Copy full SHA for 0980b9d

• Rule IDs are actually ints

  Piedone

  committed
  2a04614

  Copy full SHA for 2a04614

• Fixing assertion for when there are no alerts

  Piedone

  committed
  3f1f974

  Copy full SHA for 3f1f974

• Helper to merge YAMLs

  Piedone

  committed
  805d731

  Copy full SHA for 805d731

• Fixing method name

  Piedone

  committed
  8ac11f1

  Copy full SHA for 8ac11f1

• Docs

  Piedone

  committed
  4f7ca1f

  Copy full SHA for 4f7ca1f

• Preventing running more than one scan in the same test

  Piedone

  committed
  e4e479b

  Copy full SHA for e4e479b

• Adding config to always create a scan report but it's not working now

  Piedone

  committed
  a61497c

  Copy full SHA for a61497c

Commits on Nov 17, 2023

• Adding DisableActiveScanRule()

  Piedone

  committed
  e6cfe46

  Copy full SHA for e6cfe46

• Updating NuGet metadata

  Piedone

  committed
  5befd0f

  Copy full SHA for 5befd0f

Commits on Nov 19, 2023

• We can actually also use the current stable version of ZAP

  Piedone

  committed
  fe76c3a

  Copy full SHA for fe76c3a

• Better ZAP error handling

  Piedone

  committed
  80ddf4a

  Copy full SHA for 80ddf4a

• Typo

  Piedone

  committed
  81bba3b

  Copy full SHA for 81bba3b

• Configurability for disabling a rule just for a single URL

  Piedone

  committed
  74c2b43

  Copy full SHA for 74c2b43

Commits on Nov 20, 2023

• Adding simplified fluent configuration

  Piedone

  committed
  b983c30

  Copy full SHA for b983c30

• Making current user shortcut controller more explicit

  Piedone

  committed
  c03f54a

  Copy full SHA for c03f54a

• Removing useless "At least 100 URLs found" sample test from scans

  Piedone

  committed
  0b6f0c2

  Copy full SHA for 0b6f0c2

• Fixing CurrentUserController user retrieval logic

  Piedone

  committed
  1e2fca6

  Copy full SHA for 1e2fca6

Commits on Nov 21, 2023

• Support login

  Piedone

  committed
  9e027f4

  Copy full SHA for 9e027f4

• Docs

  Piedone

  committed
  2c9a9bc

  Copy full SHA for 2c9a9bc

• More docs

  Piedone

  committed
  1c16a3f

  Copy full SHA for 1c16a3f

• Fixing potential race condition in ZAP initialization

  Piedone

  committed
  2c5711d

  Copy full SHA for 2c5711d

• Fixing docker pull failing due to hint

  Piedone

  committed
  176b1c1

  Copy full SHA for 176b1c1

• Low-level config sample

  Piedone

  committed
  cd99756

  Copy full SHA for cd99756

• Docs

  Piedone

  committed
  023c25a

  Copy full SHA for 023c25a

• Code styling

  Piedone

  committed
  8ab5590

  Copy full SHA for 8ab5590

• Removing leftover arguments

  Piedone

  committed
  e9ac2f6

  Copy full SHA for e9ac2f6

Commits on Nov 22, 2023

• Merge remote-tracking branch 'origin/dev' into issue/OSOE-351

  Piedone

  committed
  f4a31f7

  Copy full SHA for f4a31f7

• Docs formatting

  Piedone

  committed
  751f031

  Copy full SHA for 751f031

• Removing link to now fixed ZAP bug

  Piedone

  committed
  e3a15c9

  Copy full SHA for e3a15c9

• Excluding irrelevant technologies from the scans, making them faster

  Piedone

  committed
  acb9f00

  Copy full SHA for acb9f00

• Comment on an alternative to separate ZAP Docker container instances for each scan

  Piedone

  committed
  033e23b

  Copy full SHA for 033e23b

• Merge remote-tracking branch 'origin/issue/OSOE-733' into issue/OSOE-351

  Piedone

  committed
  b41d9d2

  Copy full SHA for b41d9d2

• Removing now unnecessary browser configs

  Piedone

  committed
  e8ac897

  Copy full SHA for e8ac897

Commits on Nov 23, 2023

• Resetting debug code

  Piedone

  committed
  9c4ad2d

  Copy full SHA for 9c4ad2d

• Docs

  Piedone

  committed
  5281dd8

  Copy full SHA for 5281dd8

• Docs

  Piedone

  committed
  dc9e849

  Copy full SHA for dc9e849

• Spelling

  Piedone

  committed
  30f9c6a

  Copy full SHA for 30f9c6a

• More spelling

  Piedone

  committed
  2fffa22

  Copy full SHA for 2fffa22

• Updating Helpful Libraries NuGet references to latest

  Piedone

  committed
  600b0db

  Copy full SHA for 600b0db

• Removing unnecessary code

  Piedone

  committed
  7212085

  Copy full SHA for 7212085

• Trying to fix report creation issue under GitHub-hosted GHA runners

  Piedone

  committed
  71b0967

  Copy full SHA for 71b0967

• MaxRetryCount = 0 not to waste time

  Piedone

  committed
  3724507

  Copy full SHA for 3724507

• Another attempt to fix report creation issue under GitHub-hosted GHA runners

  Piedone

  committed
  8ceaf8d

  Copy full SHA for 8ceaf8d

• Another attempt to fix report creation issue under GitHub-hosted GHA runners with chmod

  Piedone

  committed
  eca957d

  Copy full SHA for eca957d

• Merge remote-tracking branch 'origin/issue/OSOE-733' into issue/OSOE-351

  Piedone

  committed
  439fe04

  Copy full SHA for 439fe04

• Attempting to fix test temp directory cleanup failing due to something related to ZAP keeping a handle on it

  Piedone

  committed
  1328958

  Copy full SHA for 1328958

• How about chmod a+x?

  Piedone

  committed
  a9bf935

  Copy full SHA for a9bf935

• Trying to restore the original permissions of the reports folder

  Piedone

  committed
  3645b93

  Copy full SHA for 3645b93

• Debug code

  Piedone

  committed
  1a9868c

  Copy full SHA for 1a9868c

• Fixing debug code

  Piedone

  committed
  26aa5ec

  Copy full SHA for 26aa5ec

• Simplifying ExecuteAndGetOutputAsync() call with new overload

  Piedone

  committed
  8459d69

  Copy full SHA for 8459d69

• Debug output

  Piedone

  committed
  691ff51

  Copy full SHA for 691ff51

• Attempting additional chmod

  Piedone

  committed
  2eafae1

  Copy full SHA for 2eafae1

• Fail-safe for a clean-up fail under GHA

  Piedone

  committed
  db617f2

  Copy full SHA for db617f2

• Fixing restoring the original folder permission

  Piedone

  committed
  b65ccd9

  Copy full SHA for b65ccd9

• Removing leftover directory deletion

  Piedone

  committed
  3a9b0f6

  Copy full SHA for 3a9b0f6

• Removing useless code

  Piedone

  committed
  7ddb051

  Copy full SHA for 7ddb051

• Adding debug code to see if the chmod alone breaks clean-up

  Piedone

  committed
  7b9e58d

  Copy full SHA for 7b9e58d

• Removing chmod to see if anything else breaks clean-up

  Piedone

  committed
  624bd3c

  Copy full SHA for 624bd3c

• Removing debug code

  Piedone

  committed
  aa20e16

  Copy full SHA for aa20e16

• Docs

  Piedone

  committed
  acffc2b

  Copy full SHA for acffc2b

• Intentionally failing security scan to test artifacts

  Piedone

  committed
  a267151

  Copy full SHA for a267151

• Removing MaxRetryCount = 0

  Piedone

  committed
  879570d

  Copy full SHA for 879570d

• Revert "Intentionally failing security scan to test artifacts"

  Show description for c16dcc9
  Piedone

  committed
  c16dcc9

  Copy full SHA for c16dcc9

• Updating Helpful Libraries references

  Piedone

  committed
  2122a99

  Copy full SHA for 2122a99

• Docs

  Piedone

  committed
  7316bd6

  Copy full SHA for 7316bd6

• Fixing SQL Docker operations

  Piedone

  committed
  d5dd603

  Copy full SHA for d5dd603

• Simplifying SQL Server Docker CLI calls

  Piedone

  committed
  6272d30

  Copy full SHA for 6272d30

Commits on Nov 24, 2023

• Adding script to display display the runtime of scan rules

  Piedone

  committed
  f36a553

  Copy full SHA for f36a553

• Excluding technologies also in CustomZapAutomationFrameworkPlan

  Piedone

  committed
  44b117b

  Copy full SHA for 44b117b

Commits on Nov 26, 2023

• Merge remote-tracking branch 'origin/dev' into issue/OSOE-351

  Piedone

  committed
  b47fdd6

  Copy full SHA for b47fdd6

Commits on Nov 30, 2023

• Typo

  Show description for e4cadd4
  

  Piedone

  and

  BenedekFarkas

  authored
  e4cadd4

  Copy full SHA for e4cadd4

• Grammar

  Show description for bed71de
  

  Piedone

  and

  BenedekFarkas

  authored
  bed71de

  Copy full SHA for bed71de

• SecurityScanConfiguration docs clarification and reference fixes

  Show description for 56dddac
  

  Piedone

  and

  BenedekFarkas

  authored
  56dddac

  Copy full SHA for 56dddac

• Fixing docs method reference

  Piedone

  committed
  8c2c3ee

  Copy full SHA for 8c2c3ee

• Clarifying URL regex configurations

  Piedone

  committed
  145c0ad

  Copy full SHA for 145c0ad

• Simplifying AF plan context URL management

  Piedone

  committed
  e122fac

  Copy full SHA for e122fac

• Cleaning up the ZAP container after completion

  Piedone

  committed
  1e2993d

  Copy full SHA for 1e2993d

• Cleaning up the ZAP image too after completion

  Piedone

  committed
  116bd83

  Copy full SHA for 116bd83

• Revert "Cleaning up the ZAP image too after completion"

  Show description for 462d7b1
  Piedone

  committed
  462d7b1

  Copy full SHA for 462d7b1

Commits on Dec 2, 2023

• Adding shortcuts for configuring active scan rules

  Piedone

  committed
  f0706cf

  Copy full SHA for f0706cf

• AddRequestor() docs clarification

  Piedone

  committed
  c97657a

  Copy full SHA for c97657a

• Adding SecurityScanConfiguration.AddAdditionalUri()

  Piedone

  committed
  631b502

  Copy full SHA for 631b502

• Docs on the "Cross Site Scripting (DOM Based)" active scan rule

  Piedone

  committed
  558b6ad

  Copy full SHA for 558b6ad

• Fixing that AdditionalUris wasn't applied to the YAML

  Piedone

  committed
  b39e37e

  Copy full SHA for b39e37e

• MD, C# linting fixes

  Piedone

  committed
  5f74805

  Copy full SHA for 5f74805

• Fixing MD indentation again

  Piedone

  committed
  61d16f8

  Copy full SHA for 61d16f8

Commits on Dec 4, 2023

• Code styling

  Piedone

  committed
  b9fb086

  Copy full SHA for b9fb086

• Removing outdated comment

  Show description for 72496e9
  

  Piedone

  and

  BenedekFarkas

  authored
  72496e9

  Copy full SHA for 72496e9

Commits on Dec 5, 2023

• Updating Lombiq.HelpfulLibraries package references

  Piedone

  committed
  ba9010a

  Copy full SHA for ba9010a