Unresolved requests are counted in False Negative tests

wallarm / gotestwaf

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

https://lab.wallarm.com/test-your-waf-before-hackers/

MIT License

1.55k stars 212 forks source link

Unresolved requests are counted in False Negative tests #259

Open marioskourtesis opened 3 weeks ago

marioskourtesis commented 3 weeks ago

When using the flag NonBlockedAsPassed requests that didn't result to 403 are counted as passed (i.e 5XX errors). However, in true negative tests, the requests which were in this category (5xx errors, unresolved) are added as well in the score of the failed negative tests which is not correct. True-Negative tests that resulted in an application error, should not be counted as failed since they didn't trigger a 403 WAF response.