Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ACS-9036] Fix failing tests in acs-packaging FromLegacyAcsUpgradeTest #2996

Merged
merged 2 commits into from
Nov 26, 2024
Merged

[ACS-9036] Fix failing tests in acs-packaging FromLegacyAcsUpgradeTest #2996

merged 2 commits into from
Nov 26, 2024

Conversation

cezary-witkowski
Copy link
Contributor

No description provided.

@cezary-witkowski cezary-witkowski changed the title [ACS-5768] Fix failing tests in acs-packaging FromLegacyAcsUpgradeTest [ACS-9036] Fix failing tests in acs-packaging FromLegacyAcsUpgradeTest Nov 25, 2024
@cezary-witkowski cezary-witkowski force-pushed the feature/ACS-9036-update-alf-licence branch from 7a841e2 to 471e4dd Compare November 25, 2024 10:10
@github-actions GitHub Actions
Copy link



Scan Summary:
PIPELINE_SCAN_VERSION: 24.10.0-0
DEV-STAGE: DEVELOPMENT
PROJECT-NAME: acs-packaging-acs
SCAN_ID: ddfb8bd7-943b-4d4a-8c6d-177cb47c37b3
SCAN_STATUS: SUCCESS
SCAN_MESSAGE: Scan successful. Results size: 92039 bytes
====================
Analysis Successful.
====================

==========================
Found 2 Scannable modules.
==========================
alfresco.war
JS files within alfresco.war

===================
Analyzed 2 modules.
===================
alfresco.war
JS files within alfresco.war

===================
Analyzed 33 issues.
===================

details


--------------------------------
Found 1 issues of High severity.
--------------------------------
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS): org/springframework/security/spring-security-webauthn.js:199
Details: This call to href() contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP Supported Cleansers
https://downloads.veracode.com/securityscan/cwe/v4/java/80.html
----------------------------------
Found 1 issues of Medium severity.
----------------------------------
CWE-601: URL Redirection to Untrusted Site ('Open Redirect'): org/springframework/security/spring-security-webauthn.js:199
Details: This call to href() contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP
https://downloads.veracode.com/securityscan/cwe/v4/java/601.html
----------------------------------
Skipping 1 issues of Low severity.
----------------------------------
--------------------------------------------
Skipping 1 issues of Informational severity.
--------------------------------------------

Total flaws found: 33, New flaws found: 2 as compared to baseline


========================
FAILURE: Found 2 issues!
========================

[25 Nov 2024 10:13:55,0316] PIPELINE-SCAN INFO: Writing Scan Summary to file '/home/runner/work/acs-packaging/acs-packaging/results.json'.

@github-actions GitHub Actions
Copy link



Scan Summary:
PIPELINE_SCAN_VERSION: 24.10.0-0
DEV-STAGE: DEVELOPMENT
PROJECT-NAME: acs-packaging-acs
SCAN_ID: 8a2abb4b-9e39-45fd-97f7-49353654e551
SCAN_STATUS: SUCCESS
SCAN_MESSAGE: Scan successful. Results size: 92039 bytes
====================
Analysis Successful.
====================

==========================
Found 2 Scannable modules.
==========================
alfresco.war
JS files within alfresco.war

===================
Analyzed 2 modules.
===================
alfresco.war
JS files within alfresco.war

===================
Analyzed 33 issues.
===================

details


--------------------------------
Found 1 issues of High severity.
--------------------------------
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS): org/springframework/security/spring-security-webauthn.js:199
Details: This call to href() contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP Supported Cleansers
https://downloads.veracode.com/securityscan/cwe/v4/java/80.html
----------------------------------
Found 1 issues of Medium severity.
----------------------------------
CWE-601: URL Redirection to Untrusted Site ('Open Redirect'): org/springframework/security/spring-security-webauthn.js:199
Details: This call to href() contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP
https://downloads.veracode.com/securityscan/cwe/v4/java/601.html
----------------------------------
Skipping 1 issues of Low severity.
----------------------------------
--------------------------------------------
Skipping 1 issues of Informational severity.
--------------------------------------------

Total flaws found: 33, New flaws found: 2 as compared to baseline


========================
FAILURE: Found 2 issues!
========================

[25 Nov 2024 10:22:55,0469] PIPELINE-SCAN INFO: Writing Scan Summary to file '/home/runner/work/acs-packaging/acs-packaging/results.json'.

@github-actions GitHub Actions
Copy link



Scan Summary:
PIPELINE_SCAN_VERSION: 24.10.0-0
DEV-STAGE: DEVELOPMENT
PROJECT-NAME: acs-packaging-acs
SCAN_ID: 489a1e80-4b49-498a-a775-d8e5c47e027d
SCAN_STATUS: SUCCESS
SCAN_MESSAGE: Scan successful. Results size: 92039 bytes
====================
Analysis Successful.
====================

==========================
Found 2 Scannable modules.
==========================
alfresco.war
JS files within alfresco.war

===================
Analyzed 2 modules.
===================
alfresco.war
JS files within alfresco.war

===================
Analyzed 33 issues.
===================

details


--------------------------------
Found 1 issues of High severity.
--------------------------------
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS): org/springframework/security/spring-security-webauthn.js:199
Details: This call to href() contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response. The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc. Both the OWASP Java Encoder library and the Microsoft AntiXSS library provide contextual escaping methods. For more details on contextual escaping, see https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md. In addition, as a best practice, always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP Supported Cleansers
https://downloads.veracode.com/securityscan/cwe/v4/java/80.html
----------------------------------
Found 1 issues of Medium severity.
----------------------------------
CWE-601: URL Redirection to Untrusted Site ('Open Redirect'): org/springframework/security/spring-security-webauthn.js:199
Details: This call to href() contains a URL redirection to untrusted site flaw. Writing untrusted input into a URL value could cause the web application to redirect the request to the specified URL, leading to phishing attempts to steal user credentials. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP
https://downloads.veracode.com/securityscan/cwe/v4/java/601.html
----------------------------------
Skipping 1 issues of Low severity.
----------------------------------
--------------------------------------------
Skipping 1 issues of Informational severity.
--------------------------------------------

Total flaws found: 33, New flaws found: 2 as compared to baseline


========================
FAILURE: Found 2 issues!
========================

[25 Nov 2024 13:51:47,0854] PIPELINE-SCAN INFO: Writing Scan Summary to file '/home/runner/work/acs-packaging/acs-packaging/results.json'.

github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 25, 2024
View reviewed changes
tests/tas-elasticsearch/src/test/java/org/alfresco/elasticsearch/upgrade/BaseACSEnv.java
File licence = new File(licencePath);
if (!licence.isFile() || !licence.canRead())
{
throw new RuntimeException("Licence file at: %s is not a file or is not readable".formatted(licencePath));

Check warning

Code scanning / PMD

Avoid throwing raw exception types. Warning test

Avoid throwing raw exception types.
@cezary-witkowski cezary-witkowski merged commit 7bc9186 into master Nov 26, 2024
60 of 61 checks passed
@cezary-witkowski cezary-witkowski deleted the feature/ACS-9036-update-alf-licence branch November 26, 2024 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kmagdziarz kmagdziarz kmagdziarz approved these changes

@damianujma damianujma damianujma approved these changes

@pzhyland pzhyland pzhyland approved these changes

@gionn gionn Awaiting requested review from gionn

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@cezary-witkowski @pzhyland @damianujma @kmagdziarz