set stronger fakejwt and fix wrong advice message when no high risk

cmd/scan/report.go

@@ -36,8 +36,9 @@ func (a SortByPathAndSeverity) Less(i, j int) bool {
 }
 
 func NewScanVulnerabilityReports(report *report.ScanReport) []*ScanVulnerabilityReport {
-	vulns := make([]*ScanVulnerabilityReport, 0, len(report.GetVulnerabilityReports()))
-	for _, vr := range report.GetVulnerabilityReports() {
+	reports := report.GetFailedVulnerabilityReports()
+	vulns := make([]*ScanVulnerabilityReport, 0, len(reports))
+	for _, vr := range reports {
 		vulns = append(vulns, &ScanVulnerabilityReport{
 			OperationMethod: report.Operation.Method,
 			OperationPath:   report.Operation.Path,
@@ -132,10 +133,6 @@ func DisplayReportTable(reporter *report.Reporter) {
 
 	vulnerabilityReports := NewFullScanVulnerabilityReports(reporter.GetReports())
 	for _, vulnReport := range vulnerabilityReports {
-		if vulnReport.Vuln.HasBeenSkipped() || vulnReport.Vuln.HasPassed() {
-			continue
-		}
-
 		row := []string{
 			fmt.Sprintf("%s %s", vulnReport.OperationMethod, vulnReport.OperationPath),
 			vulnReport.Vuln.SeverityLevelString(),

cmd/scan/report_test.go

@@ -16,12 +16,20 @@ func TestNewScanVulnerabilityReports(t *testing.T) {
 			{
 				Issue: report.Issue{
 					Name: "Vuln1",
+					CVSS: report.CVSS{
+						Score: 5.0,
+					},
 				},
+				Status: report.VulnerabilityReportStatusFail,
 			},
 			{
 				Issue: report.Issue{
 					Name: "Vuln2",
+					CVSS: report.CVSS{
+						Score: 5.0,
+					},
 				},
+				Status: report.VulnerabilityReportStatusFail,
 			},
 		},
 
@@ -46,12 +54,20 @@ func TestNewFullScanVulnerabilityReports(t *testing.T) {
 			{
 				Issue: report.Issue{
 					Name: "Vuln1",
+					CVSS: report.CVSS{
+						Score: 5.0,
+					},
 				},
+				Status: report.VulnerabilityReportStatusFail,
 			},
 			{
 				Issue: report.Issue{
 					Name: "Vuln2",
+					CVSS: report.CVSS{
+						Score: 5.0,
+					},
 				},
+				Status: report.VulnerabilityReportStatusFail,
 			},
 		},
 
@@ -62,12 +78,20 @@ func TestNewFullScanVulnerabilityReports(t *testing.T) {
 			{
 				Issue: report.Issue{
 					Name: "Vuln3",
+					CVSS: report.CVSS{
+						Score: 5.0,
+					},
 				},
+				Status: report.VulnerabilityReportStatusFail,
 			},
 			{
 				Issue: report.Issue{
 					Name: "Vuln4",
+					CVSS: report.CVSS{
+						Score: 5.0,
+					},
 				},
+				Status: report.VulnerabilityReportStatusFail,
 			},
 		},
 

jwt/const.go

@@ -1,3 +1,3 @@
 package jwt
 
-const FakeJWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+const FakeJWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.ufhxDTmrs4T5MSsvT6lsb3OpdWi5q8O31VX7TgrVamA"

report/reporter.go

@@ -56,8 +56,17 @@ func (rr *Reporter) GetVulnerabilityReports() []*VulnerabilityReport {
 	return vrs
 }
 
+func (rr *Reporter) GetFailedVulnerabilityReports() []*VulnerabilityReport {
+	var vrs []*VulnerabilityReport
+	for _, r := range rr.GetReports() {
+		vrs = append(vrs, r.GetFailedVulnerabilityReports()...)
+	}
+
+	return vrs
+}
+
 func (rr *Reporter) HasHighRiskOrHigherSeverityVulnerability() bool {
-	for _, r := range rr.GetVulnerabilityReports() {
+	for _, r := range rr.GetFailedVulnerabilityReports() {
 		if r.IsHighRiskSeverity() || r.IsCriticalRiskSeverity() {
 			return true
 		}

report/reporter_test.go

@@ -0,0 +1,94 @@
+package report_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/cerberauth/vulnapi/internal/request"
+	"github.com/cerberauth/vulnapi/report"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReporter_NoHasHighRiskOrHigherSeverityVulnerability_WhenNoReport(t *testing.T) {
+	reporter := report.NewReporter()
+	assert.False(t, reporter.HasHighRiskOrHigherSeverityVulnerability())
+}
+
+func TestReporter_NoHasVulnerability_WhenNoFailedReport(t *testing.T) {
+	reporter := report.NewReporter()
+	operation, _ := request.NewOperation(request.DefaultClient, http.MethodPost, "http://localhost:8080/", nil, nil, nil)
+	sr := report.NewScanReport("id", "test", operation)
+	issue := report.Issue{
+		Name: "test",
+	}
+	vulnerabilityReport := report.NewVulnerabilityReport(issue).Pass()
+	sr.AddVulnerabilityReport(vulnerabilityReport)
+	reporter.AddReport(sr)
+
+	assert.False(t, reporter.HasVulnerability())
+}
+
+func TestReporter_HasVulnerability_WhenFailedReport(t *testing.T) {
+	reporter := report.NewReporter()
+	operation, _ := request.NewOperation(request.DefaultClient, http.MethodPost, "http://localhost:8080/", nil, nil, nil)
+	sr := report.NewScanReport("id", "test", operation)
+	issue := report.Issue{
+		Name: "test",
+	}
+	vulnerabilityReport := report.NewVulnerabilityReport(issue).Fail()
+	sr.AddVulnerabilityReport(vulnerabilityReport)
+	reporter.AddReport(sr)
+
+	assert.True(t, reporter.HasVulnerability())
+}
+
+func TestReporters_HasHighRiskOrHigherSeverityVulnerability_WhenLowRiskReport(t *testing.T) {
+	reporter := report.NewReporter()
+	operation, _ := request.NewOperation(request.DefaultClient, http.MethodPost, "http://localhost:8080/", nil, nil, nil)
+	sr := report.NewScanReport("id", "test", operation)
+	issue := report.Issue{
+		Name: "test",
+		CVSS: report.CVSS{
+			Score: 0.1,
+		},
+	}
+	vulnerabilityReport := report.NewVulnerabilityReport(issue).Fail()
+	sr.AddVulnerabilityReport(vulnerabilityReport)
+	reporter.AddReport(sr)
+
+	assert.False(t, reporter.HasHighRiskOrHigherSeverityVulnerability())
+}
+
+func TestReporters_HasHighRiskOrHigherSeverityVulnerability_WhenHighRiskReport(t *testing.T) {
+	reporter := report.NewReporter()
+	operation, _ := request.NewOperation(request.DefaultClient, http.MethodPost, "http://localhost:8080/", nil, nil, nil)
+	sr := report.NewScanReport("id", "test", operation)
+	issue := report.Issue{
+		Name: "test",
+		CVSS: report.CVSS{
+			Score: 8,
+		},
+	}
+	vulnerabilityReport := report.NewVulnerabilityReport(issue).Fail()
+	sr.AddVulnerabilityReport(vulnerabilityReport)
+	reporter.AddReport(sr)
+
+	assert.True(t, reporter.HasHighRiskOrHigherSeverityVulnerability())
+}
+
+func TestReporters_HasHighRiskOrHigherSeverityVulnerability_WhenCriticalRiskReport(t *testing.T) {
+	reporter := report.NewReporter()
+	operation, _ := request.NewOperation(request.DefaultClient, http.MethodPost, "http://localhost:8080/", nil, nil, nil)
+	sr := report.NewScanReport("id", "test", operation)
+	issue := report.Issue{
+		Name: "test",
+		CVSS: report.CVSS{
+			Score: 9.8,
+		},
+	}
+	vulnerabilityReport := report.NewVulnerabilityReport(issue).Fail()
+	sr.AddVulnerabilityReport(vulnerabilityReport)
+	reporter.AddReport(sr)
+
+	assert.True(t, reporter.HasHighRiskOrHigherSeverityVulnerability())
+}

scan/broken_authentication/authentication_bypass/authentication_bypass.go

@@ -32,20 +32,16 @@ func ScanHandler(operation *request.Operation, securityScheme auth.SecuritySchem
 
 	r := report.NewScanReport(AcceptsUnauthenticatedOperationScanID, AcceptsUnauthenticatedOperationScanName, operation)
 	if _, ok := securityScheme.(*auth.NoAuthSecurityScheme); ok {
-		vulnReport.Skip()
-		r.AddVulnerabilityReport(vulnReport).End()
-		return r, nil
+		return r.AddVulnerabilityReport(vulnReport.Skip()).End(), nil
 	}
 
 	noAuthSecurityScheme := auth.SecurityScheme(auth.NewNoAuthSecurityScheme())
 	vsa, err := scan.ScanURL(operation, &noAuthSecurityScheme)
 	if err != nil {
 		return r, err
 	}
-	r.AddScanAttempt(vsa).End()
-
 	vulnReport.WithBooleanStatus(scan.IsUnauthorizedStatusCodeOrSimilar(vsa.Response))
-	r.AddVulnerabilityReport(vulnReport)
+	r.AddVulnerabilityReport(vulnReport).AddScanAttempt(vsa).End()
 
 	return r, nil
 }

scan/broken_authentication/jwt/blank_secret/blank_secret.go

@@ -47,9 +47,7 @@ func ScanHandler(operation *request.Operation, securityScheme auth.SecuritySchem
 	r := report.NewScanReport(BlankSecretVulnerabilityScanID, BlankSecretVulnerabilityScanName, operation)
 
 	if !ShouldBeScanned(securityScheme) {
-		vulnReport.Skip()
-		r.AddVulnerabilityReport(vulnReport).End()
-		return r, nil
+		return r.AddVulnerabilityReport(vulnReport.Skip()).End(), nil
 	}
 
 	var valueWriter *jwt.JWTWriter
@@ -68,10 +66,8 @@ func ScanHandler(operation *request.Operation, securityScheme auth.SecuritySchem
 	if err != nil {
 		return r, err
 	}
-	r.AddScanAttempt(vsa).End()
-
 	vulnReport.WithBooleanStatus(scan.IsUnauthorizedStatusCodeOrSimilar(vsa.Response))
-	r.AddVulnerabilityReport(vulnReport)
+	r.AddScanAttempt(vsa).AddVulnerabilityReport(vulnReport).End()
 
 	return r, nil
 }

scan/broken_authentication/jwt/blank_secret/blank_secret_test.go

@@ -38,6 +38,22 @@ func TestBlankSecretScanHandler_Passed_WhenNoJWTAndUnauthorizedResponse(t *testi
 	assert.True(t, report.Vulns[0].HasPassed())
 }
 
+func TestBlankSecretScanHandler_Passed_WhenNoJWTAndOKResponse(t *testing.T) {
+	client := request.DefaultClient
+	httpmock.ActivateNonDefault(client.Client)
+	defer httpmock.DeactivateAndReset()
+
+	securityScheme, _ := auth.NewAuthorizationJWTBearerSecurityScheme("token", nil)
+	operation, _ := request.NewOperation(client, http.MethodGet, "http://localhost:8080/", nil, nil, nil)
+	httpmock.RegisterResponder(operation.Method, operation.Request.URL.String(), httpmock.NewBytesResponder(http.StatusOK, nil))
+
+	report, err := blanksecret.ScanHandler(operation, securityScheme)
+
+	require.NoError(t, err)
+	assert.Equal(t, 1, httpmock.GetTotalCallCount())
+	assert.True(t, report.Vulns[0].HasFailed())
+}
+
 func TestBlankSecretScanHandler_Passed_WhenUnauthorizedResponse(t *testing.T) {
 	client := request.DefaultClient
 	httpmock.ActivateNonDefault(client.Client)