Insecure cookie vulnerability detection#3184
Merged
Merged
Conversation
Contributor
Overall package sizeSelf size: 4.21 MB Dependency sizes
🤖 This report was automatically generated by heaviest-objects-in-the-universe |
Codecov Report
@@ Coverage Diff @@
## master #3184 +/- ##
==========================================
+ Coverage 86.49% 86.52% +0.02%
==========================================
Files 335 337 +2
Lines 11974 12020 +46
Branches 33 33
==========================================
+ Hits 10357 10400 +43
- Misses 1617 1620 +3
... and 2 files with indirect coverage changes 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
uurien
marked this pull request as ready for review
May 24, 2023 16:56
CarlesDD
reviewed
May 24, 2023
CarlesDD
reviewed
May 24, 2023
CarlesDD
reviewed
May 25, 2023
uurien
force-pushed
the
ugaitz/insecure-cookie
branch
2 times, most recently
from
May 25, 2023 15:49
6695d89 to
0c9e3dc
Compare
uurien
force-pushed
the
ugaitz/insecure-cookie
branch
from
May 29, 2023 07:24
0c9e3dc to
e34ca46
Compare
CarlesDD
previously approved these changes
May 29, 2023
iunanua
reviewed
May 30, 2023
iunanua
reviewed
May 30, 2023
iunanua
previously approved these changes
May 30, 2023
iunanua
reviewed
May 30, 2023
iunanua
reviewed
May 30, 2023
iunanua
previously approved these changes
May 31, 2023
rochdev
approved these changes
May 31, 2023
rochdev
previously approved these changes
May 31, 2023
added 10 commits
June 1, 2023 08:27
uurien
force-pushed
the
ugaitz/insecure-cookie
branch
from
June 1, 2023 06:32
6e7d8af to
a51df1c
Compare
CarlesDD
approved these changes
Jun 1, 2023
uurien
pushed a commit
that referenced
this pull request
Jun 1, 2023
* Initial version of insecure-cookie vulnerability * Small fix * Add tests * rename const * Fix test * Exclude express file from insecure cookie stack trace * Some code styles + tests * Small code spaces * intermediate-cookies-analyzer to set-cookies-header-intercepteor * Comments in the PR * Comments in PR * Ignore insecure cookie when cookie value is empty * Reuse excluded paths array
uurien
pushed a commit
that referenced
this pull request
Jun 1, 2023
* Initial version of insecure-cookie vulnerability * Small fix * Add tests * rename const * Fix test * Exclude express file from insecure cookie stack trace * Some code styles + tests * Small code spaces * intermediate-cookies-analyzer to set-cookies-header-intercepteor * Comments in the PR * Comments in PR * Ignore insecure cookie when cookie value is empty * Reuse excluded paths array
uurien
pushed a commit
that referenced
this pull request
Jun 1, 2023
* Initial version of insecure-cookie vulnerability * Small fix * Add tests * rename const * Fix test * Exclude express file from insecure cookie stack trace * Some code styles + tests * Small code spaces * intermediate-cookies-analyzer to set-cookies-header-intercepteor * Comments in the PR * Comments in PR * Ignore insecure cookie when cookie value is empty * Reuse excluded paths array
This was referenced Jun 1, 2023
Merged
Merged
Merged
uurien
pushed a commit
that referenced
this pull request
Jun 2, 2023
* Initial version of insecure-cookie vulnerability * Small fix * Add tests * rename const * Fix test * Exclude express file from insecure cookie stack trace * Some code styles + tests * Small code spaces * intermediate-cookies-analyzer to set-cookies-header-intercepteor * Comments in the PR * Comments in PR * Ignore insecure cookie when cookie value is empty * Reuse excluded paths array
uurien
pushed a commit
that referenced
this pull request
Jun 2, 2023
* Initial version of insecure-cookie vulnerability * Small fix * Add tests * rename const * Fix test * Exclude express file from insecure cookie stack trace * Some code styles + tests * Small code spaces * intermediate-cookies-analyzer to set-cookies-header-intercepteor * Comments in the PR * Comments in PR * Ignore insecure cookie when cookie value is empty * Reuse excluded paths array
uurien
pushed a commit
that referenced
this pull request
Jun 2, 2023
* Initial version of insecure-cookie vulnerability * Small fix * Add tests * rename const * Fix test * Exclude express file from insecure cookie stack trace * Some code styles + tests * Small code spaces * intermediate-cookies-analyzer to set-cookies-header-intercepteor * Comments in the PR * Comments in PR * Ignore insecure cookie when cookie value is empty * Reuse excluded paths array
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
When we detect that
set-cookieheader is set without theSecureproperty it identifiesINSECURE_COOKIEvulnerability and that is reported.Plugin Checklist
Additional Notes
Note for non appsec reviewers:
To be able to detect that headers are set, when IAST is active
res.setHeadermethod is instrumented and an event in a new channel is published.