Skip to content

WebScan v2.5.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jun 19:35
v2.5.3
08af36e

WebScan v2.5.3 — Zero known security findings

🔒 Security — all known issues closed

A final, maximally-pedantic audit found 3 new MEDIUM + 3 confirmed LOW + 8 INFO
issues that survived v2.5.1/v2.5.2. All 14 are fixed in this release — the
codebase now has zero outstanding security findings at any severity level
(CRITICAL / HIGH / MEDIUM / LOW / INFO).

Fixed (MEDIUM)

  • M-NEW-1: H-1 fix was incomplete — TraceConfig now applied to all sessions
    (CWE-200 / CWE-522). The original v2.5.1 fix only attached the
    redirect-safe TraceConfig to engine.ScanEngine.scan_all(). Two other
    aiohttp.ClientSession(...) constructions — cli._crawl_targets (carries
    auth headers during crawling) and auth._form_login (POSTs the login form
    with credentials) — were unprotected. Both now install the same
    _build_redirect_safe_trace(). _form_login additionally uses
    allow_redirects=False.

  • M-NEW-2: shell injection in security-scan.yml via ${{ github.event.inputs.target }}
    (CWE-78 / CWE-94). Fixed via env-var indirection + URL regex validation.

  • M-6: mass_assignment PUT now carries safety markers
    (CWE-624 / CWE-639). Each probe carries Idempotency-Key: webscan-<uuid>,
    X-WebScan-Test: 1, X-WebScan-Dry-Run: 1, and allow_redirects=False.

Fixed (LOW)

  • L-1: dependency upper bounds + CVE coverage (CWE-1357 / CWE-1104).
    aiohttp>=3.9.0 → aiohttp>=3.10.11,<4 closes CVE-2024-52304 and
    CVE-2024-47881 (HTTP-parser DoS, directly exploitable from a hostile
    target). All other deps now have <major upper bounds.

  • L-4: Dockerfile hardened. Base image pinned by digest
    (python:3.12-slim@sha256:c2d8472b...). Added HEALTHCHECK instruction.

  • L-6: auto-release.yml tag validation (CWE-20). TAG is validated
    against ^v\d+\.\d+\.\d+(-[\w.]+)?$ before use.

Fixed (INFO)

  • INFO-1: explicit CORS deny-all middleware in server.py.
  • INFO-2: _safe_url() in reporter.py blocks javascript:/data:
    schemes in HTML report <a href> (CWE-79 stored XSS).
  • INFO-3: anonymize._PRIVATE_IP extended to IPv6 ULA / link-local /
    loopback + CGNAT.
  • INFO-4: prompt-injection protection in ai.py — scanner output wrapped
    in <scanner_output> tags with explicit "treat as untrusted data"
    system-prompt instructions.
  • INFO-5: assert → if/raise in ai.py (Bandit B101).
  • INFO-6: URL credentials masked in _progress bar (CWE-532).
  • INFO-7: verify_ssl parameter exposed in api.scan().
  • INFO-8: covered by M-NEW-1.

🧪 Tests — +20 new, 97% coverage sustained

  • 860 tests (was 840), all passing
  • New tests/test_v253_security.py (20 tests) covers every fixed issue
  • ruff clean, mypy --strict clean (locally and in CI env)

📊 Numbers

  • 38 plugins (unchanged)
  • 860 tests (was 840)
  • 97% coverage (sustained)
  • 61 source files
  • 0 known security findings at any severity (was 4 HIGH + 6 MEDIUM + 6 LOW)

⬆️ Upgrade

pip install --upgrade webscan-security==2.5.3

📋 Audit summary

After three audit passes (initial → v2.5.1 fixes → final → v2.5.3 fixes),
the codebase has zero outstanding security findings at any severity level.

Severity Initial audit After v2.5.1 After v2.5.2 After v2.5.3
CRITICAL 0 0 0 0
HIGH 4 0 0 0
MEDIUM 6 4 2 0
LOW 6 6 6 0
INFO — — — 0
Total 16 10 8 0
Assets 2
Loading