Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TDEAL-16: ZAP improvements #334

Merged
merged 93 commits into from
Jan 15, 2024
Merged

TDEAL-16: ZAP improvements #334

merged 93 commits into from
Jan 15, 2024

Commits on Dec 26, 2023

  1. Update baseline rule exception.

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    816c476 View commit details
    Browse the repository at this point in the history

  2. Merge remote-tracking branch 'origin/dev' into issue/TDEAL-16

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    3eec5b1 View commit details
    Browse the repository at this point in the history

  3. The baseline scan should visit at least one page that throws an excep… 

    …tion.
    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    7856594 View commit details
    Browse the repository at this point in the history

  4. Disable app log assertion for the duration of the security scan.

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    222be47 View commit details
    Browse the repository at this point in the history

  5. Merge remote-tracking branch 'origin/dev' into issue/TDEAL-16

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    dfd2c55 View commit details
    Browse the repository at this point in the history

  6. unusing

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    6cfb21d View commit details
    Browse the repository at this point in the history

  7. Expect custom error page.

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    b60dfe0 View commit details
    Browse the repository at this point in the history

  8. Disable rule 10037.

    @sarahelsaig
    sarahelsaig committed Dec 26, 2023
    Configuration menu
    Copy the full SHA
    eea23bd View commit details
    Browse the repository at this point in the history

Commits on Dec 27, 2023

  1. Fix disabled rules, shouldn't have been dictionary.

    @sarahelsaig
    sarahelsaig committed Dec 27, 2023
    Configuration menu
    Copy the full SHA
    71f189d View commit details
    Browse the repository at this point in the history

  2. Turn all the collections into private, because we have methods to han… 

    …dle them in a specific restricted manner so exposing the original collections is only asking for shenanigans.
    @sarahelsaig
    sarahelsaig committed Dec 27, 2023
    Configuration menu
    Copy the full SHA
    e011568 View commit details
    Browse the repository at this point in the history

  3. Some YAML extensio DRYing.

    @sarahelsaig
    sarahelsaig committed Dec 27, 2023
    Configuration menu
    Copy the full SHA
    f8219f8 View commit details
    Browse the repository at this point in the history

  4. By default ignore /vendor/ or /vendors/ URLs.

    @sarahelsaig
    sarahelsaig committed Dec 27, 2023
    Configuration menu
    Copy the full SHA
    c61a55c View commit details
    Browse the repository at this point in the history

  5. unusing

    @sarahelsaig
    sarahelsaig committed Dec 27, 2023
    Configuration menu
    Copy the full SHA
    f6ea9fb View commit details
    Browse the repository at this point in the history

Commits on Dec 28, 2023

  1. Fix sample.

    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    32f03dd View commit details
    Browse the repository at this point in the history

  2. Why was this rule disabled in the first place? Just enable "OrchardCo… 

    …re.Https".
    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    445074d View commit details
    Browse the repository at this point in the history

  3. Merge branch 'issue/TDEAL-16' of https://github.com/Lombiq/UI-Testing… 

    …-Toolbox into issue/TDEAL-16
    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    bf117a6 View commit details
    Browse the repository at this point in the history

  4. Update the comment.

    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    1a6ad0c View commit details
    Browse the repository at this point in the history

  5. Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs 

    Co-authored-by: Zoltán Lehóczky <[email protected]>
    @sarahelsaig @Piedone
    sarahelsaig and Piedone committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    5dd7647 View commit details
    Browse the repository at this point in the history

  6. Remove duplicate method.

    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    2544f98 View commit details
    Browse the repository at this point in the history

  7. More documentation.

    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    a97fd47 View commit details
    Browse the repository at this point in the history

  8. Explain why disabling "Strict-Transport-Security Header" is necessary.

    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    33810db View commit details
    Browse the repository at this point in the history

  9. Remove forced error generation because we are going to enable Orchard… 

    …Core.Diagnostics by default anyway.
    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    a1e8dad View commit details
    Browse the repository at this point in the history

  10. Tweak app log error handling during sercurity scan..

    @sarahelsaig
    sarahelsaig committed Dec 28, 2023
    Configuration menu
    Copy the full SHA
    e0c6d65 View commit details
    Browse the repository at this point in the history

Commits on Dec 29, 2023

  1. Disable 10062.

    @sarahelsaig
    sarahelsaig committed Dec 29, 2023
    Configuration menu
    Copy the full SHA
    6fa5d43 View commit details
    Browse the repository at this point in the history

  2. Typo.

    @sarahelsaig
    sarahelsaig committed Dec 29, 2023
    Configuration menu
    Copy the full SHA
    5e3ed10 View commit details
    Browse the repository at this point in the history

  3. Update coment regarding unsafe-inline.

    @sarahelsaig
    sarahelsaig committed Dec 29, 2023
    Configuration menu
    Copy the full SHA
    d1fd50d View commit details
    Browse the repository at this point in the history

Commits on Jan 5, 2024

  1. Change "The response contains Personally Identifiable Information" to… 

    … "high" threshold instead of "off".
    @sarahelsaig
    sarahelsaig committed Jan 5, 2024
    Configuration menu
    Copy the full SHA
    af0a663 View commit details
    Browse the repository at this point in the history

Commits on Jan 6, 2024

  1. Merge remote-tracking branch 'origin/dev' into issue/TDEAL-16

    @sarahelsaig
    sarahelsaig committed Jan 6, 2024
    Configuration menu
    Copy the full SHA
    1941430 View commit details
    Browse the repository at this point in the history

  2. Update the CustomZapAutomationFrameworkPlan.

    @sarahelsaig
    sarahelsaig committed Jan 6, 2024
    Configuration menu
    Copy the full SHA
    e581165 View commit details
    Browse the repository at this point in the history

Commits on Jan 7, 2024

  1. Add DoWithoutAppLogAssertionAsync

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    faa917b View commit details
    Browse the repository at this point in the history

  2. Test a known error page.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    212b761 View commit details
    Browse the repository at this point in the history

  3. Merge branch 'issue/TDEAL-16' of https://github.com/Lombiq/UI-Testing… 

    …-Toolbox into issue/TDEAL-16
    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    3145498 View commit details
    Browse the repository at this point in the history

  4. Simplify job configuration using new extension methods.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    d939ed0 View commit details
    Browse the repository at this point in the history

  5. Limit the execution duration of activeScan.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    7653286 View commit details
    Browse the repository at this point in the history

  6. Permit some error lines in app logs.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    2149e2f View commit details
    Browse the repository at this point in the history

  7. Add AssertAppLogsForSecurityScan.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    9026b83 View commit details
    Browse the repository at this point in the history

  8. Permit another format exception.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    b48b062 View commit details
    Browse the repository at this point in the history

  9. Much nicer app log error reporting.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    411d7cd View commit details
    Browse the repository at this point in the history

  10. spelling?

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    9f949da View commit details
    Browse the repository at this point in the history

  11. unusing

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    e38ba5e View commit details
    Browse the repository at this point in the history

  12. Eliminate this arbitrary limitation.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    fb08f79 View commit details
    Browse the repository at this point in the history

  13. Make AssertAppLogsForSecurityScan parametric.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    85e4b68 View commit details
    Browse the repository at this point in the history

  14. Fix code styling.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    218f8b3 View commit details
    Browse the repository at this point in the history

  15. Use SafelyDeleteDirectoryIfExists.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    15bd351 View commit details
    Browse the repository at this point in the history

  16. Add default value to userName in SignInDirectly.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    0d43a1f View commit details
    Browse the repository at this point in the history

  17. Add exception for a parameter key being null.

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    fb5bcdd View commit details
    Browse the repository at this point in the history

  18. check empty userName differently

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    85327ec View commit details
    Browse the repository at this point in the history

  19. unusing

    @sarahelsaig
    sarahelsaig committed Jan 7, 2024
    Configuration menu
    Copy the full SHA
    888c0ab View commit details
    Browse the repository at this point in the history

Commits on Jan 8, 2024

  1. Reorganize the security scanning test into a reusable extension.

    @sarahelsaig
    sarahelsaig committed Jan 8, 2024
    Configuration menu
    Copy the full SHA
    31a58cc View commit details
    Browse the repository at this point in the history

  2. Update HL NuGet package.

    @sarahelsaig
    sarahelsaig committed Jan 8, 2024
    Configuration menu
    Copy the full SHA
    2b2545d View commit details
    Browse the repository at this point in the history

  3. Update HL NuGet again.

    @sarahelsaig
    sarahelsaig committed Jan 8, 2024
    Configuration menu
    Copy the full SHA
    059a34f View commit details
    Browse the repository at this point in the history

Commits on Jan 9, 2024

  1. Make the AssertSecurityScanHasNoAlerts more informative.

    @sarahelsaig
    sarahelsaig committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    b2e8ec2 View commit details
    Browse the repository at this point in the history

  2. Try to delete the ZAP directory even more safely.

    @sarahelsaig
    sarahelsaig committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    b225f61 View commit details
    Browse the repository at this point in the history

Commits on Jan 10, 2024

  1. Instead of trying to delete the Zap directory use Zap1, Zap2, etc to … 

    …avoid reporting conflicts.
    @sarahelsaig
    sarahelsaig committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    3127ba7 View commit details
    Browse the repository at this point in the history

  2. Throw on failure.

    @sarahelsaig
    sarahelsaig committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    106085a View commit details
    Browse the repository at this point in the history

  3. nuget

    @sarahelsaig
    sarahelsaig committed Jan 10, 2024
    Configuration menu
    Copy the full SHA
    11a538f View commit details
    Browse the repository at this point in the history

Commits on Jan 12, 2024

  1. Additional documentation.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    8c12e5e View commit details
    Browse the repository at this point in the history

  2. Documentation cross-linking.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    07efb93 View commit details
    Browse the repository at this point in the history

  3. Include the PII disclosure issue URL.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    a137be5 View commit details
    Browse the repository at this point in the history

  4. Rename maxScanDurationInMinutes to maxActiveScanDurationInMinutes.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    cca1aa5 View commit details
    Browse the repository at this point in the history

  5. Rename extension method and mention it in the samples.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    050812e View commit details
    Browse the repository at this point in the history

  6. Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs 

    Co-authored-by: Zoltán Lehóczky <[email protected]>
    @sarahelsaig @Piedone
    sarahelsaig and Piedone committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    a9a4083 View commit details
    Browse the repository at this point in the history

  7. Make error page scanning optional.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    43a782d View commit details
    Browse the repository at this point in the history

  8. Use STJ.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    e94c005 View commit details
    Browse the repository at this point in the history

  9. Update Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguratio… 

    …n.cs

Co-authored-by: Zoltán Lehóczky <[email protected]>
    @sarahelsaig @Piedone
    sarahelsaig and Piedone committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    1b71ab7 View commit details
    Browse the repository at this point in the history

  10. More info on build-and-test-orchard-core.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    9ca337f View commit details
    Browse the repository at this point in the history

  11. Merge branch 'issue/TDEAL-16' of https://github.com/Lombiq/UI-Testing… 

    …-Toolbox into issue/TDEAL-16
    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    573ff8a View commit details
    Browse the repository at this point in the history

  12. Update workflow name convention.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    d85b200 View commit details
    Browse the repository at this point in the history

  13. Code styling.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    3e631a2 View commit details
    Browse the repository at this point in the history

  14. Add missing using.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    50817fb View commit details
    Browse the repository at this point in the history

  15. Use configuration to initialize the start URL.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    0c2bbcf View commit details
    Browse the repository at this point in the history

  16. Update HL nuget.

    @sarahelsaig
    sarahelsaig committed Jan 12, 2024
    Configuration menu
    Copy the full SHA
    1d07bc8 View commit details
    Browse the repository at this point in the history

Commits on Jan 13, 2024

  1. Add ShouldBeEmptyWhen extension method.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    7328baa View commit details
    Browse the repository at this point in the history

  2. Refactor AddDisableRuleFilter,

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    ab5cd44 View commit details
    Browse the repository at this point in the history

  3. False positives should contain both the name and justification.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    4b1b773 View commit details
    Browse the repository at this point in the history

  4. Add optional jsonSerializerOptions.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    2461d21 View commit details
    Browse the repository at this point in the history

  5. Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs 

    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    @sarahelsaig @coderabbitai
    sarahelsaig and coderabbitai[bot] committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    573eacc View commit details
    Browse the repository at this point in the history

  6. Update SecurityScanWithCustomConfigurationShouldPass and its comments.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    3f1a389 View commit details
    Browse the repository at this point in the history

  7. Fix missing default parameter.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    fdb704c View commit details
    Browse the repository at this point in the history

  8. Fix docstrings.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    16c5ca7 View commit details
    Browse the repository at this point in the history

  9. Restore sample assertion and update expected count.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    5151a15 View commit details
    Browse the repository at this point in the history

  10. Add extension method and use security scan forgiving app assertion in… 

    … the samples.
    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    b9d398e View commit details
    Browse the repository at this point in the history

  11. Instead of suppressing logs, just suppress the error page's exception… 

    … message.
    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    0640fb2 View commit details
    Browse the repository at this point in the history

  12. Add GetAbsoluteUrlOfAction.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    dc737f6 View commit details
    Browse the repository at this point in the history

  13. Use requestor instead of second scan.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    2784993 View commit details
    Browse the repository at this point in the history

  14. Update Lombiq.Tests.UI/SecurityScanning/SecurityScanConfiguration.cs 

    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    @sarahelsaig @coderabbitai
    sarahelsaig and coderabbitai[bot] committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    35fb6e8 View commit details
    Browse the repository at this point in the history

  15. Code formatting and organization.

    @sarahelsaig
    sarahelsaig committed Jan 13, 2024
    Configuration menu
    Copy the full SHA
    74bae9c View commit details
    Browse the repository at this point in the history

Commits on Jan 14, 2024

  1. Update Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContext… 

    …Extensions.cs

Co-authored-by: Zoltán Lehóczky <[email protected]>
    @sarahelsaig @Piedone
    sarahelsaig and Piedone committed Jan 14, 2024
    Configuration menu
    Copy the full SHA
    7397bb9 View commit details
    Browse the repository at this point in the history

  2. Various doc fixes.

    @sarahelsaig
    sarahelsaig committed Jan 14, 2024
    Configuration menu
    Copy the full SHA
    9852ab3 View commit details
    Browse the repository at this point in the history

  3. unusing

    @sarahelsaig
    sarahelsaig committed Jan 14, 2024
    Configuration menu
    Copy the full SHA
    4bb9d42 View commit details
    Browse the repository at this point in the history

Commits on Jan 15, 2024

  1. Additional instructions.

    @sarahelsaig
    sarahelsaig committed Jan 15, 2024
    Configuration menu
    Copy the full SHA
    1fd80a3 View commit details
    Browse the repository at this point in the history

  2. Remove this thing whatever it is.

    @sarahelsaig
    sarahelsaig committed Jan 15, 2024
    Configuration menu
    Copy the full SHA
    c6c1035 View commit details
    Browse the repository at this point in the history

  3. Make it a range.

    @sarahelsaig
    sarahelsaig committed Jan 15, 2024
    Configuration menu
    Copy the full SHA
    ffc674a View commit details
    Browse the repository at this point in the history