From 003ff2e8509099810f3001be736fad388b7f91b9 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 13 Sep 2021 12:28:34 +0200 Subject: [PATCH 1/7] Added draft typo3scan integration test Signed-off-by: Ilyes Ben Dlala --- tests/integration/scanner/typo3scan.test.js | 34 +++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 tests/integration/scanner/typo3scan.test.js diff --git a/tests/integration/scanner/typo3scan.test.js b/tests/integration/scanner/typo3scan.test.js new file mode 100644 index 0000000000..26a32cdeef --- /dev/null +++ b/tests/integration/scanner/typo3scan.test.js @@ -0,0 +1,34 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +const { scan } = require("../helpers"); + +jest.retryTimes(3); + +test( + "typo3scan scans old-typo3", + async () => { + const { categories, severities, count } = await scan( + "typo3scan-old-typo3", + "typo3scan", + ["-d","http://old-typo3.demo-targets.svc"], + "--vuln", + 90 + ); + + expect(count).toBe(1); + expect(categories).toMatchInlineSnapshot(` + Object { + "WEB APPLICATION": 1, + } + `); + expect(severities).toMatchInlineSnapshot(` +Object { + "informational": 1, +} +`); + }, + 3 * 60 * 1000 +); + From 589a02cb8b3929a17bfe39b19dfb77082237ff2b Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Mon, 13 Sep 2021 12:51:26 +0200 Subject: [PATCH 2/7] Addded the typo3scan test to the ci.yaml The demo-target build is also added Signed-off-by: Ilyes Ben Dlala --- .github/workflows/ci.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 2b415efd10..201c6420c0 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -909,6 +909,8 @@ jobs: helm -n demo-targets install petstore ./demo-targets/swagger-petstore/ --set="fullnameOverride=petstore" --wait # Install old-wordpress app helm -n demo-targets install old-wordpress ./demo-targets/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait + # Install old-typo3 app + helm -n demo-targets install old-typo3 ./demo-targets/old-typo3/ --set="fullnameOverride=old-typo3" --wait # Install juiceshop app helm -n demo-targets install juiceshop ./demo-targets/juice-shop/ --set="fullnameOverride=juiceshop" --wait # Install plain nginx server @@ -1054,6 +1056,19 @@ jobs: cd tests/integration/ npx jest --ci --color scanner/sslyze.test.js + # ---- Typo3scan Integration Tests ---- + + - name: "typo3scan Integration Tests" + run: | + kubectl -n integration-tests delete scans --all + helm -n integration-tests install typo3scan ./scanners/typo3scan/ \ + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-typo3scan" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" + cd tests/integration/ + npx jest --ci --color scanner/typo3scan.test.js + # ---- Whatweb Integration Tests ---- - name: "Whatweb Integration Tests" From e2c780be63ef58bf991d44aa0c032be229a293fc Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Tue, 14 Sep 2021 13:49:28 +0200 Subject: [PATCH 3/7] The old-typo3 image now runs under root user This is to allow binding to port 80 from kind cluster Signed-off-by: Ilyes Ben Dlala --- demo-targets/old-typo3/container/Dockerfile | 3 --- 1 file changed, 3 deletions(-) diff --git a/demo-targets/old-typo3/container/Dockerfile b/demo-targets/old-typo3/container/Dockerfile index bc5b4688d9..55a76c9e07 100644 --- a/demo-targets/old-typo3/container/Dockerfile +++ b/demo-targets/old-typo3/container/Dockerfile @@ -10,9 +10,6 @@ COPY ./typo3conf /var/www/html/typo3conf RUN chown -R www-data.www-data /var/www/html/typo3conf \ && chmod +rxw /var/www/html/typo3conf/cms-016d0ef9.sqlite -# Change to low-privilege user 'www-data' -USER 33 - # Login details # Username: root # Password: supersecret From d4efb0be073a7af59178884e355557ee08e43c81 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 15 Sep 2021 10:52:30 +0200 Subject: [PATCH 4/7] Fixed typo3scan integration test parameters Updated Test Snapshot Signed-off-by: Ilyes Ben Dlala --- tests/integration/scanner/typo3scan.test.js | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/tests/integration/scanner/typo3scan.test.js b/tests/integration/scanner/typo3scan.test.js index 26a32cdeef..8a56368e59 100644 --- a/tests/integration/scanner/typo3scan.test.js +++ b/tests/integration/scanner/typo3scan.test.js @@ -12,23 +12,21 @@ test( const { categories, severities, count } = await scan( "typo3scan-old-typo3", "typo3scan", - ["-d","http://old-typo3.demo-targets.svc"], - "--vuln", + ["-d", "http://old-typo3.demo-targets.svc", "--vuln"], 90 ); - expect(count).toBe(1); + expect(count).toBe(53); expect(categories).toMatchInlineSnapshot(` Object { - "WEB APPLICATION": 1, + "Vulnerability": 53, } `); expect(severities).toMatchInlineSnapshot(` -Object { - "informational": 1, -} -`); + Object { + "high": 53, + } + `); }, 3 * 60 * 1000 -); - +); \ No newline at end of file From e60972acc65773a86e9a17f0ed891cbb3715a84a Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 15 Sep 2021 11:07:16 +0200 Subject: [PATCH 5/7] Added a test to typo3scan.test.js Signed-off-by: Ilyes Ben Dlala --- tests/integration/scanner/typo3scan.test.js | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/integration/scanner/typo3scan.test.js b/tests/integration/scanner/typo3scan.test.js index 8a56368e59..76ea63620c 100644 --- a/tests/integration/scanner/typo3scan.test.js +++ b/tests/integration/scanner/typo3scan.test.js @@ -29,4 +29,14 @@ test( `); }, 3 * 60 * 1000 +); + +test( + "Invalid argument should be marked as errored", + async () => { + await expect( + scan("typo3scan-invalidArg", "typo3scan", ["--invalidArg", "example.com"], 90) + ).rejects.toThrow("HTTP request failed"); + }, + 3 * 60 * 1000 ); \ No newline at end of file From 3728bb30ee9ae124658ea4f44642629140db6856 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 15 Sep 2021 13:05:22 +0200 Subject: [PATCH 6/7] Added typo3scan to third-party scanner builds Signed-off-by: Ilyes Ben Dlala --- .github/workflows/ci.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 201c6420c0..0b0085bf36 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -565,6 +565,7 @@ jobs: - ncrack - nmap - whatweb + - typo3scan steps: - name: Checkout uses: actions/checkout@v2 From 7ed25beaff64f58b64a5d35d60720c06b56f74c9 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 15 Sep 2021 14:37:11 +0200 Subject: [PATCH 7/7] Fixed wrong merge on ci.yaml And Better typo3scan test description Signed-off-by: Ilyes Ben Dlala --- .github/workflows/ci.yaml | 83 --------------------- tests/integration/scanner/typo3scan.test.js | 2 +- 2 files changed, 1 insertion(+), 84 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 183aceb592..c8ee3e3253 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -681,88 +681,6 @@ jobs: repository: ${{ env.DOCKER_NAMESPACE }}/scanner-${{ matrix.scanner }} readme-filepath: ./scanners/${{ matrix.scanner }}/docs/README.DockerHub-Scanner.md - scanner-nikto: - # This Scanner has to be build seperately because the official image is only on GitHub but not on DockerHub - name: "Build | Scanner | Nikto" - needs: - - unit-python - - unit-javascript - runs-on: ubuntu-latest - services: - registry: - image: registry:2 - ports: - - 5000:5000 - steps: - - name: Checkout secureCodeBox - uses: actions/checkout/@v2 - with: - path: scb - - - name: "Checkout Nikto" - uses: actions/checkout/@v2 - with: - repository: "sullo/nikto" - path: nikto - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 - with: - driver-opts: network=host - - - name: Build and Push Nikto to Local Registry - uses: docker/build-push-action@v2 - with: - context: ./nikto/ - file: ./nikto/Dockerfile - push: true - tags: localhost:5000/sullo/nikto:latest - - - name: Docker Meta - id: docker_meta - uses: crazy-max/ghaction-docker-meta@v1 - with: - images: ${{ env.DOCKER_NAMESPACE }}/scanner-nikto - tag-sha: true - tag-custom: 2.1.6 - tag-semver: | - {{ version }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 - with: - driver-opts: network=host - - - name: Login to DockerHub - uses: docker/login-action@v1 - with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_TOKEN }} - - - name: Set baseImageTag to commit hash - run: | - echo "baseImageTag=sha-$(git rev-parse --short HEAD)" >> $GITHUB_ENV - - - name: Build and Push - uses: docker/build-push-action@v2 - with: - context: ./scb/scanners/nikto/scanner - file: ./scb/scanners/nikto/scanner/Dockerfile - build-args: | - baseImageTag=${{ env.baseImageTag }} - platforms: linux/amd64 - push: true - tags: ${{ steps.docker_meta.outputs.tags }} - labels: ${{ steps.docker_meta.outputs.labels }} - - - name: Update Docker Hub Description - uses: peter-evans/dockerhub-description@v2 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_PASSWORD }} - repository: ${{ env.DOCKER_NAMESPACE }}/scanner-nikto - readme-filepath: ./scb/scanners/nikto/docs/README.DockerHub-Scanner.md - # ---- Integration Tests ---- Integration-tests: @@ -773,7 +691,6 @@ jobs: - parsers - scanners-third-party - scanners-custom - - scanner-nikto runs-on: ubuntu-latest strategy: matrix: diff --git a/tests/integration/scanner/typo3scan.test.js b/tests/integration/scanner/typo3scan.test.js index 76ea63620c..9521c273aa 100644 --- a/tests/integration/scanner/typo3scan.test.js +++ b/tests/integration/scanner/typo3scan.test.js @@ -7,7 +7,7 @@ const { scan } = require("../helpers"); jest.retryTimes(3); test( - "typo3scan scans old-typo3", + "typo3scan scans old-typo3 for vulnerable extensions and core only", async () => { const { categories, severities, count } = await scan( "typo3scan-old-typo3",