Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

2683-zap-CORS-misconfig #2727

Merged
merged 20 commits into from
Dec 1, 2023
Merged

2683-zap-CORS-misconfig #2727

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
489d074
added cloud.gov back to scan urls
raftmsohani Oct 5, 2023
36cc7ce
temp
raftmsohani Oct 16, 2023
686cf45
revert changes on zap.conf
raftmsohani Oct 17, 2023
3088c70
revert change on zap.conf
raftmsohani Oct 17, 2023
159a395
revert changes on zap-hook.conf
raftmsohani Oct 17, 2023
1799347
revert changes on nginx.conf
raftmsohani Oct 17, 2023
3709148
revert changes on middleware.py
raftmsohani Oct 17, 2023
0b8f794
linting
raftmsohani Oct 17, 2023
adcd482
revert change on docker-compose file
raftmsohani Oct 17, 2023
bf3edcd
revert changes on .env file
raftmsohani Oct 17, 2023
4f1baf6
remove file not needed
raftmsohani Oct 17, 2023
aad6e4b
Merge branch 'develop' into 2683-zap-result-cors-misconfiguration
raftmsohani Oct 17, 2023
a4cb273
linting
raftmsohani Oct 17, 2023
f48679f
Merge branch '2683-zap-result-cors-misconfiguration' of https://githu…
raftmsohani Oct 17, 2023
18efd9c
revert changes on deploy-backend
raftmsohani Oct 17, 2023
dc5deee
revert changes on zap-scanner.py
raftmsohani Oct 17, 2023
8fb820b
revrt some changes on zap-scanner
raftmsohani Oct 17, 2023
aa0e47a
Added CORS settings
raftmsohani Oct 18, 2023
0dd838f
increase max_file allow large file clamav scans
raftmsohani Oct 18, 2023
39880c1
Merge branch 'develop' into 2683-zap-result-cors-misconfiguration
ADPennington Dec 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion scripts/deploy-backend.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,6 @@ update_backend()

if [ "$1" = "rolling" ] ; then
set_cf_envs

# Do a zero downtime deploy. This requires enough memory for
# two apps to exist in the org/space at one time.
cf push "$CGAPPNAME_BACKEND" --no-route -f manifest.buildpack.yml -t 180 --strategy rolling || exit 1
Expand Down
Empty file modified scripts/deploy-frontend.sh
100644 → 100755
View file
Open in desktop
Empty file.
7 changes: 1 addition & 6 deletions scripts/zap-scanner.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ cd "$TARGET_DIR" || exit 2


if [[ $(docker network inspect external-net 2>&1 | grep -c Scope) == 0 ]]; then
docker network create external-net
docker network create external-net
fi

# Ensure the APP_URL is reachable from the zaproxy container
Expand Down Expand Up @@ -112,10 +112,6 @@ ZAP_CLI_OPTIONS="\
-config globalexcludeurl.url_list.url\(14\).description='Site - FontAwesome.com' \
-config globalexcludeurl.url_list.url\(14\).enabled=true \

-config globalexcludeurl.url_list.url\(15\).regex='^https:\/\/.*\.cloud.gov\/.*$' \
-config globalexcludeurl.url_list.url\(15\).description='Site - Cloud.gov' \
-config globalexcludeurl.url_list.url\(15\).enabled=true \

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am trying to remember why we put this in here, but it was for a very specific reason.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

originally it was added to disable the spider to scan some of the links associated with cloud.gov, but since we are also trying to scan dev/staging, it not possible to disable the cloud.gov as a whole

-config globalexcludeurl.url_list.url\(16\).regex='^https:\/\/.*\.googletagmanager.com\/.*$' \
-config globalexcludeurl.url_list.url\(16\).description='Site - googletagmanager.com' \
-config globalexcludeurl.url_list.url\(16\).enabled=true \
Expand All @@ -140,7 +136,6 @@ ZAP_CLI_OPTIONS="\
-config globalexcludeurl.url_list.url\(21\).description='Site - IdentitySandbox.gov' \
-config globalexcludeurl.url_list.url\(21\).enabled=true \
-config spider.postform=true"

# How long ZAP will crawl the app with the spider process
ZAP_SPIDER_MINS=10

Expand Down
2 changes: 2 additions & 0 deletions tdrs-backend/clamav-router/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ events { worker_connections 1024;
# This opens a route to clamav prod
http{
server {
client_max_body_size 100m;
listen {{port}};
client_max_body_size 100m;
location /scan {
Expand All @@ -12,6 +13,7 @@ http{
}
}
server {
client_max_body_size 100m;
listen 9000;
client_max_body_size 100m;
location /scan {
Expand Down
25 changes: 23 additions & 2 deletions tdrs-backend/tdpservice/settings/cloudgov.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,14 @@ class Development(CloudGov):

# https://docs.djangoproject.com/en/2.0/ref/settings/#allowed-hosts
ALLOWED_HOSTS = ['.app.cloud.gov']

CORS_ORIGIN_ALLOW_ALL = False
CORS_ALLOWED_ORIGINS = ['https://*.app.cloud.gov']
CORS_ALLOW_CREDENTIALS = True
CORS_ALLOW_METHODS = (
raftmsohani marked this conversation as resolved.
Show resolved Hide resolved
"GET",
"PATCH",
"POST",
raftmsohani marked this conversation as resolved.
Show resolved Hide resolved
)

class Staging(CloudGov):
"""Settings for applications deployed in the Cloud.gov staging space."""
Expand All @@ -164,7 +171,14 @@ class Staging(CloudGov):
'tdp-frontend-staging.acf.hhs.gov',
'tdp-frontend-develop.acf.hhs.gov'
]

CORS_ALLOWED_ORIGINS = ['https://*.acf.hhs.gov']
CORS_ORIGIN_ALLOW_ALL = False
CORS_ALLOW_CREDENTIALS = True
CORS_ALLOW_METHODS = (
"GET",
"PATCH",
"POST",
)
LOGIN_GOV_CLIENT_ID = os.getenv(
'OIDC_RP_CLIENT_ID',
'urn:gov:gsa:openidconnect.profiles:sp:sso:hhs:tanf-proto-staging'
Expand All @@ -189,3 +203,10 @@ class Production(CloudGov):

# CORS allowed origins
CORS_ALLOWED_ORIGINS = ['https://tanfdata.acf.hhs.gov']
CORS_ORIGIN_ALLOW_ALL = False
CORS_ALLOW_CREDENTIALS = True
CORS_ALLOW_METHODS = (
"GET",
"PATCH",
"POST",
)
7 changes: 7 additions & 0 deletions tdrs-frontend/nginx/cloud.gov/locations.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,16 @@ location ~ ^/(v1|admin|static/admin|swagger|redocs) {
proxy_buffer_size 4k;
proxy_temp_file_write_size 64k;

limit_except GET HEAD POST { deny all;
}

add_header Access-Control-Allow-Origin 's3-us-gov-west-1.amazonaws.com';
}

if ($request_method ~ ^(PATCH|TRACE|OPTION)$) {
return 405;
}

location = /profile {
index index.html index.htm;
try_files $uri $uri/ /index.html;
Expand Down
Loading