Skip to content

HSTS missing header vulnerability tests for IAST#1561

Merged
DDJavierSantos merged 5 commits intomainfrom
jsantos/hsts_vulnerability
Sep 25, 2023
Merged

HSTS missing header vulnerability tests for IAST#1561
DDJavierSantos merged 5 commits intomainfrom
jsantos/hsts_vulnerability

Conversation

@DDJavierSantos
Copy link
Copy Markdown
Contributor

@DDJavierSantos DDJavierSantos commented Sep 5, 2023

Description

Added endpoints and tests for the hsts missing header vulnerability

Motivation

To test the new hsts vulnerability detection code

Workflow

  1. ⚠️⚠️ Create your PR as draft
  2. Follow the style guidelines of this project (See how to easily lint the code)
  3. Work on you PR until the CI passes (if something not related to your task is failing, you can ignore it)
  4. Mark it as ready for review

Once your PR is reviewed, you can merge it! ❤️

Reviewer checklist

  • Check what scenarios are modified. If needed, add the relevant label (run-parametric-scenario, run-profiling-scenario...). If this PR modifies any system-tests internal, then add the run-all-scenarios label (more info).
  • CI is green
    • If not, failing jobs are not related to this change (and you are 100% sure about this statement)
  • if any of build-some-image label is present
    1. is the image labl have been updated ?
    2. just before merging, locally build and push the image to hub.docker.com
  • if a scenario is added (or removed), add (or remove) it in system-test-dasboard nightly

@DDJavierSantos DDJavierSantos requested review from a team as code owners September 5, 2023 13:26
cbeauchesne
cbeauchesne requested changes Sep 5, 2023
View reviewed changes
Comment thread tests/appsec/iast/sink/test_hsts_missing_header.py Outdated
cbeauchesne
cbeauchesne requested changes Sep 6, 2023
View reviewed changes
Comment thread tests/appsec/iast/sink/test_hsts_missing_header.py Outdated
@DDJavierSantos DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from ce057bc to b71eb67 Compare September 6, 2023 09:24
smola
smola requested changes Sep 6, 2023
View reviewed changes
Comment thread tests/appsec/iast/sink/test_hsts_missing_header.py Outdated
Comment thread tests/appsec/iast/sink/test_hsts_missing_header.py
Comment thread .../docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/AppSecIast.java
cbeauchesne
cbeauchesne requested changes Sep 6, 2023
View reviewed changes
Copy link
Copy Markdown
Collaborator

@cbeauchesne cbeauchesne left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failing on c++ (you just need to skip it in manifests/cpp.yml) and akka-http

smola
smola requested changes Sep 7, 2023
View reviewed changes
Comment thread .../docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/AppSecIast.java Outdated
@DDJavierSantos DDJavierSantos requested a review from smola September 7, 2023 09:11
cbeauchesne
cbeauchesne requested changes Sep 14, 2023
View reviewed changes
Comment thread tests/appsec/iast/sink/test_hsts_missing_header.py Outdated
@DDJavierSantos DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from b4ef1b3 to 787c0aa Compare September 15, 2023 09:11
cbeauchesne
cbeauchesne requested changes Sep 15, 2023
View reviewed changes
Comment thread manifests/java.yml Outdated
@DDJavierSantos DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from 787c0aa to 0e3baea Compare September 25, 2023 07:38
@cbeauchesne cbeauchesne marked this pull request as draft September 25, 2023 08:08
@cbeauchesne
Copy link
Copy Markdown
Collaborator

cbeauchesne commented Sep 25, 2023

I've put it back to draft, as there are some conflicts, and changes requests.

@DDJavierSantos DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from b2b6dbb to 5661434 Compare September 25, 2023 08:30
@DDJavierSantos DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from 436ce65 to afe954f Compare September 25, 2023 08:51
@smola smola reopened this Sep 25, 2023
@DDJavierSantos DDJavierSantos marked this pull request as ready for review September 25, 2023 13:12
@DDJavierSantos DDJavierSantos requested a review from a team September 25, 2023 13:12
@DDJavierSantos DDJavierSantos requested review from a team as code owners September 25, 2023 13:12
@DDJavierSantos DDJavierSantos merged commit 69d97c5 into main Sep 25, 2023
@DDJavierSantos DDJavierSantos deleted the jsantos/hsts_vulnerability branch September 25, 2023 15:21
@smola smola mentioned this pull request Sep 29, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes

@uurien uurien uurien approved these changes

@manuel-alvarez-alvarez manuel-alvarez-alvarez manuel-alvarez-alvarez approved these changes

@cbeauchesne cbeauchesne cbeauchesne approved these changes

@bantonsson bantonsson Awaiting requested review from bantonsson bantonsson is a code owner automatically assigned from DataDog/apm-java

@PerfectSlayer PerfectSlayer Awaiting requested review from PerfectSlayer PerfectSlayer is a code owner automatically assigned from DataDog/apm-java

@gnufede gnufede Awaiting requested review from gnufede gnufede is a code owner automatically assigned from DataDog/apm-python

@ZStriker19 ZStriker19 Awaiting requested review from ZStriker19 ZStriker19 is a code owner automatically assigned from DataDog/apm-python

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@DDJavierSantos @cbeauchesne @smola @uurien @manuel-alvarez-alvarez