ZAP API Scan Report

Open

#448 opened on Aug 10, 2023 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 30/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: java
Domain: api, security

Research direction

Start with the linked ZAP report and inspect the API at /api/v1/api-docs, focusing on the listed security headers, server and client responses, content types, and storage behavior. Determine which findings are defects and confirm completion by rerunning the ZAP API scan with the reported alerts addressed.

Written by the indexing model from the issue text.

Description

Site: https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca
New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- A Server Error response code was returned by the server [100000] total: 76:
- Permissions Policy Header Not Set [10063] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- Strict-Transport-Security Header Not Set [10035] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- Unexpected Content-Type was returned [100001] total: 78:
- A Client Error response code was returned by the server [100000] total: 2:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense
- Non-Storable Content [10049] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs

View the following link to download the report.
RunnerID:5827129021

Dominant language: Java
Stars: 0
Forks: 2
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Document Hot Rod migration version compatibility for Data Grid 8.6 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

infinispan/infinispan#18150 · Opened Sep 21, 2026
[BUG] Route53Resolver: CreateResolverEndpoint requires IpAddressRequests, but the AWS member is IpAddresses, so no SDK client can call it Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

floci-io/floci#4108 · Opened Sep 21, 2026
[BUG] RestGetModelHandlerIT.testGetModel_whenModelIDIsInValid_thenFail depends on test order and fails when run alone Open

untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

opensearch-project/k-NN#3597 · Opened Sep 21, 2026
Concurrent builder skips 'verify' phase when running 'mvn install' Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

apache/maven#13230 · 1 comment · Opened Sep 21, 2026
ComponentGeNRTL leaves lnGamma stale after computing gamma Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

equinor/neqsim#3899 · 1 comment · Opened Sep 21, 2026

More Java issues