Skip to content

WebVigil 1.0.3

Choose a tag to compare

View all tags
@ryanvmorais ryanvmorais released this 08 Oct 21:15
· 21 commits to main since this release
v1.0.3
d7e26af
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A patch release with one fix: a page, a script or an API description served by the scanned site can no longer keep a scan busy for a long time or make it use a lot of memory.

  • The patterns of the library fingerprint (which run in the default Safe Mode), of the Active Mode signatures and of the host-header, TRACE and CSRF-confirmation passes are bounded, and they read the first 256 KiB of a body or script.
  • The OpenAPI import caps the size of the request bodies it builds from a schema.
  • A library marker or a framework message that appears only after the first 256 KiB of a body is no longer recognised; a request body for a very large schema is cut short.
  • Upgrade with pip install -U webvigil or pull ghcr.io/ryanvmorais/webvigil:1.0.3. Nothing in the CLI, the exit codes, the configuration keys, the check ids or the JSON report changes.

Use WebVigil only on systems you own or are authorized in writing to test.

Security advisory: GHSA-7cmg-mh2g-8rwv

Full list of changes: CHANGELOG.md

Assets 2
Loading