ZAP API Scan Report

Open

#475 opened on Feb 15, 2024 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 20/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: java
Domain: api, backend, security

Research direction

Download the ZAP report from the linked GitHub Actions run and review the listed findings for the API host, especially the api-docs endpoint and the server and client error responses. Reproduce the scan against the listed endpoints and confirm that the reported security headers, content types, and error responses are addressed.

Written by the indexing model from the issue text.

Description

Site: https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca
New Alerts
- Content Security Policy (CSP) Header Not Set [10038] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- A Server Error response code was returned by the server [100000] total: 76:
- Permissions Policy Header Not Set [10063] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- Strict-Transport-Security Header Not Set [10035] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs
- Unexpected Content-Type was returned [100001] total: 78:
- A Client Error response code was returned by the server [100000] total: 2:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca?aaa=bbb
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense
- Non-Storable Content [10049] total: 1:
  - https://educ-rule-engine-api-e8a97a-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs

View the following link to download the report.
RunnerID:7922791250

Dominant language: Java
Stars: 0
Forks: 2
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Resize volume API validation errors are not displayed in the UI Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 90/100

apache/cloudstack#14222 · Opened Sep 22, 2026
[BUG]茶杯方块在取茶时会引发崩溃 Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

KaleidoscopeMods/KaleidoscopeCookery#218 · Opened Sep 22, 2026
Cannot differ own consent and managed consents in My Consents view and detailed consent view. Open

1.0.0-alpha2 Type/Improvement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

wso2/dpdp-accelerator#272 · Opened Sep 22, 2026
Document Hot Rod migration version compatibility for Data Grid 8.6 Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

infinispan/infinispan#18150 · Opened Sep 21, 2026
Topology should used the whole height Open

area/frontend

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

kestra-io/kestra#19685 · Opened Sep 21, 2026

More Java issues