search

hyperledger-cacti / cacti

Hyperledger Cacti is a new approach to the blockchain interoperability problem
https://wiki.hyperledger.org/display/cactus
Apache License 2.0
345 stars 285 forks source link

bug(dast): ccp, sshconfig missing #3671

Open jagpreetsinghsasan opened 11 hours ago

jagpreetsinghsasan commented 11 hours ago

Describe the bug

Due to the incorporation of https://github.com/hyperledger-cacti/cacti/pull/3578 task, the DAST again got broken as it now requires a sshconfig, ccp input

To Reproduce

The failing CI test can be seen in every PR at the moment

Expected behavior

The DAST scan should run without failing

Logs/Stack traces

https://github.com/hyperledger-cacti/cacti/actions/runs/12153966297/job/33892946268?pr=3659

Additional context

Adding empty sshConfig and connectionProfile` to this line: https://github.com/hyperledger-cacti/cacti/blob/fbe68c12bf35a69cac8df7044ede937ca8c7dcd6/.github/workflows/.dast-nuclei-cmd-api-server.yaml#L88 shall fix the broken test

raynatopedrajeta commented 11 hours ago

Hello Team,

Please assign me this task. Thank you!

Rayn

petermetz commented 2 hours ago

@jagpreetsinghsasan Once you have a working fix for this (and it is merged onto main) please also make sure to set the DAST scan to be required in the branch protection rules. That way we prevent it breaking again next time a similar change is made.

One more point: The fact that DAST starting breaking with existing configuration is pointing to the idea that maybe we accidentally created a breaking change in the Fabric connector. Could you please double check? New features should not make previously working functionality break with previously valid configuration (unless we are issuing a new major release where breaking changes are allowed). If it turns out that we did make an accidental breaking change then please open an issue to tackle that by way of investigating what can be done where the two main options are:

  1. Revert the change for now and schedule it for v3.0.0
  2. Refactor the code so that the new code in the connector is backward compatible (if this is possible then it's the preferred way, but it's not always possible to refactor things with perfect backward compatibility)