{"action":"opened","issue":{"url":"https://api.github.com/repos/jenkins-x/jx/issues/919","repository_url":"https://api.github.com/repos/jenkins-x/jx","labels_url":"https://api.github.com/repos/jenkins-x/jx/issues/919/labels{/name}","comments_url":"https://api.github.com/repos/jenkins-x/jx/issues/919/comments","events_url":"https://api.github.com/repos/jenkins-x/jx/issues/919/events","html_url":"https://github.com/jenkins-x/jx/issues/919","id":326973249,"number":919,"title":"Addon for OWASP ZA Proxy scanner","user":{"login":"michaelneale","id":14976,"avatar_url":"https://avatars0.githubusercontent.com/u/14976?v=4","gravatar_id":"","url":"https://api.github.com/users/michaelneale","html_url":"https://github.com/michaelneale","followers_url":"https://api.github.com/users/michaelneale/followers","following_url":"https://api.github.com/users/michaelneale/following{/other_user}","gists_url":"https://api.github.com/users/michaelneale/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelneale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelneale/subscriptions","organizations_url":"https://api.github.com/users/michaelneale/orgs","repos_url":"https://api.github.com/users/michaelneale/repos","events_url":"https://api.github.com/users/michaelneale/events{/privacy}","received_events_url":"https://api.github.com/users/michaelneale/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-28T10:10:55Z","updated_at":"2018-05-28T10:10:55Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"One handy thing that could be done, and I am not sure at what stage in the pipeline, but probably on a preview app, and probably as an addon, is the OWASP \"Zed Attack Proxy\" scanner that looks for common vulnerabilities. https://github.com/zaproxy/zaproxy/\r\n\r\nThis can be quite simple to run. \r\n\r\neg to run a baseline test against any URL: \r\n\r\n`docker run -t owasp/zap2docker-stable zap-baseline.py -t https://jenkins.io`\r\n(this could be a preview app) will generate results like: \r\n\r\n\r\n\r\n```\r\ndocker run -t owasp/zap2docker-stable zap-baseline.py -t https://jenkins.io\r\n_XSERVTransmkdir: ERROR: euid != 0,directory /tmp/.X11-unix will not be created.\r\nMay 28, 2018 9:41:54 AM java.util.prefs.FileSystemPreferences$1 run\r\nINFO: Created user preferences directory.\r\nTotal of 1048 URLs\r\nPASS: Cookie No HttpOnly Flag [10010]\r\nPASS: Cookie Without Secure Flag [10011]\r\nPASS: Content-Type Header Missing [10019]\r\nPASS: Information Disclosure - Sensitive Informations in URL [10024]\r\nPASS: Information Disclosure - Sensitive Information in HTTP Referrer Header [10025]\r\nPASS: HTTP Parameter Override [10026]\r\nPASS: Information Disclosure - Suspicious Comments [10027]\r\nPASS: Viewstate Scanner [10032]\r\nPASS: Weak Authentication Method [10105]\r\nPASS: Absence of Anti-CSRF Tokens [10202]\r\nPASS: Private IP Disclosure [2]\r\nPASS: Session ID in URL Rewrite [3]\r\nPASS: Script Passive Scan Rules [50001]\r\nPASS: Insecure JSF ViewState [90001]\r\nPASS: Charset Mismatch [90011]\r\nPASS: Application Error Disclosure [90022]\r\nPASS: Loosely Scoped Cookie [90033]\r\nWARN-NEW: Incomplete or No Cache-control and Pragma HTTP Header Set [10015] x 480 \r\n\thttps://jenkins.io/\r\n\thttps://jenkins.io\r\n\thttps://jenkins.io/sitemap.xml\r\n\thttps://jenkins.io/projects/\r\n\thttps://jenkins.io/projects/blueocean/\r\nWARN-NEW: Web Browser XSS Protection Not Enabled [10016] x 479 \r\n\thttps://jenkins.io/\r\n\thttps://jenkins.io/robots.txt\r\n\thttps://jenkins.io\r\n\thttps://jenkins.io/projects/\r\n\thttps://jenkins.io/projects/blueocean/\r\n```\r\n\r\nwithout any config (there is obviously a lot more). \r\nIt seems like preview apps is the right place? \r\n\r\nIf so, does an addon make sense, can @rawlingsj point in a direction of how this may happen? (could also just be part of the PR pipeline, which is then added to all build packs etc, perhaps as an additional stage?). Although given the nature of this, it would be similar to the Anchore based image scan results, where you may want to know if things are worse/better/different etc. \r\n\r\nThe baseline test https://github.com/zaproxy/zaproxy/wiki/ZAP-Baseline-Scan\r\n\r\nand "}}
{"actor":{"display_login":"michaelneale"}}