Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] Fix #1314 - security.txt full url in finding #1319

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

[WIP] Fix #1314 - security.txt full url in finding #1319

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d968d57
security.txt full url in finding
bwbroersma Mar 9, 2024
bc0c08f
Update migration dependency
mxsasha Mar 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions checks/migrations/0016_domaintestappsecpriv_securitytxt_found_url.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# AddField Generated by Django 3.2.24 on 2024-03-09 12:49
# Manually created SQL migration to handle old reports

from django.db import migrations # , models


class Migration(migrations.Migration):
dependencies = [
("checks", "0015_add_rpki_scoring"),
]

operations = [
# migrations.AddField(
# model_name='domaintestappsecpriv',
# name='securitytxt_found_url',
# field=models.CharField(max_length=8000, null=True),
# ),
migrations.RunSQL(
sql=[
"ALTER TABLE checks_domaintestappsecpriv ADD COLUMN securitytxt_found_url VARCHAR(8000);",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can keep AddField and only use custom artisanal SQL for the UPDATE?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would probably also fix the build failure, as the migrations framework now does not know this SQL adds that field.

"UPDATE checks_domaintestappsecpriv SET securitytxt_found_url=securitytxt_found_host WHERE securitytxt_enabled;",
],
reverse_sql=[
"ALTER TABLE checks_domaintestappsecpriv DROP COLUMN securitytxt_found_url;",
],
),
]
4 changes: 4 additions & 0 deletions checks/models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -721,6 +721,8 @@ class DomainTestAppsecpriv(BaseTestModel):
securitytxt_recommendations = ListField(default=[])
securitytxt_score = models.IntegerField(null=True)
securitytxt_found_host = models.CharField(null=True, max_length=255)
# 8000 from https://www.rfc-editor.org/rfc/rfc9110#section-4.1-5
securitytxt_found_url = models.CharField(null=True, max_length=8000)

def __dir__(self):
return [
Expand Down Expand Up @@ -753,6 +755,7 @@ def __dir__(self):
"securitytxt_recommendations",
"securitytxt_score",
"securitytxt_found_host",
"securitytxt_found_url",
]

def get_web_api_details(self):
Expand All @@ -772,6 +775,7 @@ def get_web_api_details(self):
"securitytxt_errors": self.securitytxt_errors,
"securitytxt_recommendations": self.securitytxt_recommendations,
"securitytxt_found_host": self.securitytxt_found_host,
"securitytxt_found_url": self.securitytxt_found_url,
}

class Meta:
Expand Down
3 changes: 2 additions & 1 deletion checks/tasks/appsecpriv.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,7 @@ def save_results(model, results, addr, domain):
model.securitytxt_errors = result.get("securitytxt_errors")
model.securitytxt_recommendations = result.get("securitytxt_recommendations")
model.securitytxt_found_host = result.get("securitytxt_found_host")
model.securitytxt_found_url = result.get("securitytxt_found_url")
model.content_security_policy_enabled = result.get("content_security_policy_enabled")
model.content_security_policy_score = result.get("content_security_policy_score")
model.content_security_policy_values = result.get("content_security_policy_values")
Expand Down Expand Up @@ -190,7 +191,7 @@ def build_report(model, category):
default_message = [
{
"msgid": "retrieved-from",
"context": {"hostname": model.securitytxt_found_host},
"context": {"url": model.securitytxt_found_url},
}
]
else:
Expand Down
2 changes: 2 additions & 0 deletions checks/tasks/securitytxt.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ def parser_format(parser_messages):
"securitytxt_enabled": False,
"securitytxt_score": scoring.WEB_APPSECPRIV_SECURITYTXT_BAD,
"securitytxt_found_host": result.found_host,
"securitytxt_found_url": None,
"securitytxt_errors": result.errors,
"securitytxt_recommendations": [],
}
Expand All @@ -142,6 +143,7 @@ def parser_format(parser_messages):
"securitytxt_enabled": True,
"securitytxt_score": score,
"securitytxt_found_host": result.found_host,
"securitytxt_found_url": result.found_url,
"securitytxt_errors": errors,
"securitytxt_recommendations": parser_format(parser.recommendations + parser.notifications),
}
2 changes: 1 addition & 1 deletion translations/en/main.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2022,7 +2022,7 @@ msgid "detail tech data http-securitytxt requested-from"
msgstr "security.txt requested from {hostname}."

msgid "detail tech data http-securitytxt retrieved-from"
msgstr "security.txt retrieved from {hostname}."
msgstr "security.txt retrieved from {url}."

msgid "detail tech data http-securitytxt signed_format_issue"
msgstr ""
Expand Down
2 changes: 1 addition & 1 deletion translations/nl/main.po
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2041,7 +2041,7 @@ msgid "detail tech data http-securitytxt requested-from"
msgstr "security.txt opgevraagd van {hostname}."

msgid "detail tech data http-securitytxt retrieved-from"
msgstr "security.txt opgehaald van {hostname}."
msgstr "security.txt opgehaald van {url}."

msgid "detail tech data http-securitytxt signed_format_issue"
msgstr ""
Expand Down
Loading