ZAP API Scan Report
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Download the ZAP report from GitHub Actions run 17443136788 and review the listed Spring Actuator, cookie, site-isolation, content-type, and session findings across the reported API endpoints. No source files or tests are named, so first locate the configuration governing these responses. Done should be defined by the maintainers as resolved findings or documented exceptions followed by a scan confirming the result.
Written by the indexing model from the issue text.
Description
- Site: https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca
New Alerts- Spring Actuator Information Leak [40042] total: 1:
- Cookie with SameSite Attribute None [10054] total: 6:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
- Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 1:
- Unexpected Content-Type was returned [100001] total: 4:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/
- Non-Storable Content [10049] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
- Session Management Response Identified [10112] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
View the following link to download the report.
RunnerID:17443136788
- Dominant language
- Java
- Stars
- 4
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from bcgov/EDUC-SOAM-API
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 25/100
bcgov/EDUC-SOAM-API#104 · 2 comments ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 45/100
bcgov/EDUC-SOAM-API#103 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
bcgov/EDUC-SOAM-API#102 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
bcgov/EDUC-SOAM-API#101 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 25/100
bcgov/EDUC-SOAM-API#92 ·
All issues in bcgov/EDUC-SOAM-API
Similar issues
-
staticAssetsPath follows symlinks outside the directory on WindowsPossibly taken @ybelMekk claimed this today. Openbug security findings
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
navikt/mock-oauth2-server#1132 ·
Maintainers usually reply within 1 day
-
agent:working follow-up
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Sanne/incus-spawn#1683 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
checkstyle/checkstyle#22210 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
google/error-prone#6239 · 1 comment ·
Maintainers usually reply within 1 day
-
[Failing Test]: BigqueryClient.queryUnflattened fails BigQuery ITs on a transient 503Possibly taken @mxtymoshyk claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day