SIWECOS / HSHS-DOMXSS-Scanner

MIT License
3 stars 1 forks source link

Still missing 2 placeholders #13

Closed Skeeve closed 6 years ago

Skeeve commented 6 years ago

Currently I see in the Header Scanner results the placeholders

META
HEADER

but we do not have values.

Outpu looks like this:

Überprüfung des HTTP Content-Types

Die Content Type Angabe ist korrekt konfiguriert.
Mehr Informationen

* siwecos.META
* Die Header-Angabe ist via `<meta>`-Tag gesetzt und entspricht den Empfehlungen.
* siwecos.HEADER
* Der Header ist korrekt gesetzt und entspricht den Empfehlungen.
Lednerb commented 6 years ago

The placeholder META can be replaced as a technical information via the sent value. It contains the original <meta>-Tag that was found while scanning for the content-type-definition.

The placeholder HEADER can be replaces as a technical information via the sent value. It contains the specific Header so the user can compare the already set values with the best practice proposal.

Have a look at the sample output, for example the CONTENT_TYPE-Test Case:

{
      "name": "CONTENT_TYPE",
      "hasError": false,
      "errorMessage": null,
      "score": 100,
      "scoreType": "warning",
      "testDetails": [
        {
          "placeholder": "META",
          "values": [
            "<meta charset=\"UTF-8\" \\/>"
          ]
        },
        {
          "placeholder": "CT_META_TAG_SET_CORRECT"
        },
        {
          "placeholder": "HEADER",
          "values": [
            "text\\/html; charset=UTF-8"
          ]
        },
        {
          "placeholder": "CT_CORRECT"
        }
      ]
    },

HEADER is available for every single test if a header is set. META is only available for the CONTENT_TYPE test.

Skeeve commented 6 years ago

You are right. Seems there is a miss-implementation on business logic side:

https://github.com/SIWECOS/siwecos-business-layer/issues/16

Skeeve commented 6 years ago

Correction - I'm not sure anymore that you are right.

You'r datastructure does not fit to the datastructure highlighted in https://github.com/SIWECOS/siwecos-business-layer/issues/16

As that one makes more sense to me, I asked @Weegy to clarify.