NEST-536: Add necessary security exceptions #403
Conversation
sarahelsaig
changed the base branch from
dev
to
task/system-text-json-migration
Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs
Outdated
Show resolved
Hide resolved
| // There is no need to security scan anything in Lombiq.Tests.UI.Shortcuts. | ||
| configuration.ExcludeUrlWithRegex(@".*/Lombiq.Tests.UI.Shortcuts/.*"); | ||
|
|
||
| configuration.MarkScanRuleAsFalsePositiveForUrlWithRegex( | ||
| ".*/(Login|ChangePassword)[?][rR]eturnUrl=.*", // #spell-check-ignore-line | ||
| 6, | ||
| "Path Traversal", | ||
| "Setting the ReturnUrl query parameter to a itself yields a false positive"); | ||
|
|
||
| configuration.MarkScanRuleAsFalsePositiveForUrlWithRegex( | ||
| ".*/(Login|ChangePassword)[?][rR]eturnUrl=.*", // #spell-check-ignore-line | ||
| 40018, | ||
| "SQL Injection", | ||
| "Setting the ReturnUrl query parameter to an SQL expression can't actually cause SQL Injection."); |
There was a problem hiding this comment.
These three should rather be in the plans, so they're applied to every scan.
There was a problem hiding this comment.
You didn't yet move configuration.ExcludeUrlWithRegex(@".*/Lombiq.Tests.UI.Shortcuts/.*"); BTW.
There was a problem hiding this comment.
I don't know how to do that for a filter with no rule ID. Also the configuration.ExcludeUrlWithRegex(@".*/Admin/.*"); right above it is the same kind, so I assumed if it was possible you would've already moved it into the plans.
There was a problem hiding this comment.
In the end, this is run, what should be possible in YML too: https://github.com/Lombiq/UI-Testing-Toolbox/blob/dev/Lombiq.Tests.UI/SecurityScanning/YamlDocumentExtensions.cs#L107
I don't remember the reason for the admin config, but that perhaps makes more sense here: keep in mind that it's easier to override the C# config from a delegate, than modify the YML document. Maybe we want to override that. I can't imagine this for the shortcuts rule, though.
…Extensions.cs Co-authored-by: Zoltán Lehóczky <[email protected]>
# Conflicts: # Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs
NEST-536