search

wttech / bobcat

Bobcat is an automated testing framework for functional testing of web applications.
https://cognifide.github.io/bobcat/
Apache License 2.0
90 stars 40 forks source link

Sonatype security scan #380

Closed GuptaMegha closed 5 years ago

GuptaMegha commented 5 years ago

Bobcat version: 2.1.0

Description

There is critical security vulnerability discovered in the Sonatype scan for bobcat. Because of this security issue I can not use this framework for my AEM application.

Expected Behavior

There should not be such higher security threat.

Is there anything that could be done, this will make the software secure.

mkrzyzanowski commented 5 years ago

Hi @GuptaMegha,

we've reviewed the remaining open issues, they were invalid in our case.

Bobcat is constantly checked by SonarCloud, you can see the results here

GuptaMegha commented 5 years ago

Hi @mkrzyzanowski

Please see attached sonatype report Bobcat-Build-20190910-140952.pdf

mkrzyzanowski commented 5 years ago

The issue there is related to the JQuery used in our docs site. It is not distributed along Bobcat artifacts, so there's no need to be concerned about it. As mentioned above, Bobcat codebase itself is checked continuously by SonarCloud - all identified issues have been addressed. You can safely use Bobcat :).