ZAP API Scan Report
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
No source file is named. Download the ZAP report from the linked GitHub Actions run and review the listed Spring Actuator, /latest/meta-data/, and cookie findings first; trace each endpoint to its owning code or configuration. Done means each alert is remediated or explicitly validated as expected, with a rerun showing the resulting ZAP status.
Written by the indexing model from the issue text.
Description
- Site: https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca
New Alerts- Spring Actuator Information Leak [40042] total: 1:
- A Server Error response code was returned by the server [100000] total: 1:
- Cookie with SameSite Attribute None [10054] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
- Unexpected Content-Type was returned [100001] total: 1:
- A Client Error response code was returned by the server [100000] total: 287:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/8957941648739209258
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/
- ..
- Non-Storable Content [10049] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
- Session Management Response Identified [10112] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
View the following link to download the report.
RunnerID:11003189783
ZAP is supported by the Crash Override Open Source Fellowship
- Dominant language
- Java
- Stars
- 4
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from bcgov/EDUC-SOAM-API
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 25/100
bcgov/EDUC-SOAM-API#104 · 2 comments ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 45/100
bcgov/EDUC-SOAM-API#103 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
bcgov/EDUC-SOAM-API#102 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
bcgov/EDUC-SOAM-API#101 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 25/100
bcgov/EDUC-SOAM-API#92 ·
All issues in bcgov/EDUC-SOAM-API
Similar issues
-
agent:working follow-up
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Sanne/incus-spawn#1683 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
checkstyle/checkstyle#22210 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
521xueweihan/HelloGitHub#4105 ·
-
devops good first issue security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
asciidoctor/asciidoctorj#1339 ·