Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduces GlobalChecks, closes #27 #36

Closed
wants to merge 5 commits into from

Conversation

phosphore
Copy link
Contributor

This pull introduces a new class of Checks called GlobalChecks. These non-standard checks are executed after the first round of standard Checks and they work on the array of issues generated by the first batch of Checks to determine further vulnerabilities or discard false positives.
To do this, it is now possible for the standard checks to share an additional properties object when added to the initial issues array, that can later be used by any GlobalCheck to perform decisions. Using this class of checks provides an improved decisional process, which will come in handy in other checks that need to scan every JS/HTML of the target application before determining the presence or absence of a vulnerability (e.g. the Affinity check).
These checks are located in src/finder/checks/ComplexChecks/ and share a very similar loading mechanism to that of the standard checks.

This pull request adds the first GlobalCheck ever, used to check for CSP. See the old PR #35 for more information.

This pull request adds positive/negative tests for HTML/JS CSP checks.

@phosphore
Copy link
Contributor Author

I created a page for the CSP check in the project wiki.

@phosphore
Copy link
Contributor Author

phosphore commented Mar 1, 2019

Updated the CONTRIBUTING.md to add GlobalChecks.
Renamed the CSPGlobalCheck ID from CSP_CHECK to CSP_GLOBAL_CHECK.
Updated the respective wiki page.

@ikkisoft
Copy link
Contributor

ikkisoft commented Mar 4, 2019

Can we close this one, since you've opened another one?

@ikkisoft ikkisoft closed this Mar 4, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants