search

SIWECOS / HSHS-DOMXSS-Scanner

MIT License
3 stars 1 forks source link

HEADER gives hasError:true but no errorMessage #51

Closed Skeeve closed 5 years ago

Skeeve commented 5 years ago

Excerpt from a HEADER Scan result:

   "version" : "1.0.0",
   "name" : "HEADER",
   "score" : 75,
   "errorMessage" : null,
   "hasError" : true

This leads to BLA failing here:

           if ($item['has_error']) {
                $errorRaw           = $item['complete_request']['errorMessage'];
                $error              = array();
                $error['report']    = html_entity_decode(__('siwecos.' . $errorRaw['placeholder']));
                $error['has_error'] = true;
                $error['score']     = 0;
                if (array_key_exists('values', $errorRaw)) { // <- HERE

See: https://github.com/SIWECOS/siwecos-business-layer/issues/46

Lednerb commented 5 years ago

According to our discussions it was decided that the global hasError should also be set to true even if there is no global error but an error in one of the test cases.

See this: https://github.com/SIWECOS/HSHS-DOMXSS-Scanner/issues/39

IMHO there should not be a globas hasError: true if there is no global error. That's leads to hasError: true without an errorMessage because the errorMessage is defined in the specific test, that also has the hasError: attribute.

I would fix this by reverting this check introduced by 5381c082c168e9154e958a08603b6db48e61ad8f: 'hasError' => $ratings->whereIn('scoreType', ['warning'])->contains('hasError', true),