forked from HHS/TANF-app
-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'raft-tdp-main' into adp/usermgmt-updates
- Loading branch information
Showing
30 changed files
with
658 additions
and
633 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,26 @@ | ||
| # OWASP Zap Scan HTML Report | ||
|
|
||
| We have added a feature to the CI/CD which produces a report in HTML for the OWASP Zap scan. | ||
| This will make it much easier to review the results of these scans. This document shows how | ||
| to access the report. | ||
|
|
||
| ### Accessing the HTML Report | ||
|
|
||
| 1. When a pull request is issued, the CI/CD checks automatically kick off. Go to the bottom of the | ||
|
|
||
| Conversation screen to see the checks running. | ||
|
|
||
|  | ||
|
|
||
| 2. To the right of either `ci/circleci: test-backend` or `ci/circleci: test-backend` click the `Details` | ||
| link to view the running process at CircleCI | ||
|
|
||
|  | ||
|
|
||
| 3. Click the `Artifacts` tab at the top of the screen once the process has completed. | ||
|
|
||
|  | ||
|
|
||
| 4. Click the `owasp_report.html` link to view the report. | ||
|
|
||
|  | ||
| # OWASP Zap Scan HTML Report | ||
|
|
||
| We have added a feature to the CI/CD which produces a report in HTML for the OWASP Zap scan. | ||
| This will make it much easier to review the results of these scans. This document shows how | ||
| to access the report. | ||
|
|
||
| ### Accessing the HTML Report | ||
|
|
||
| 1. When a pull request is issued, the CI/CD checks automatically kick off. Go to the bottom of the | ||
|
|
||
| Conversation screen to see the checks running. | ||
|
|
||
|  | ||
|
|
||
| 2. To the right of either `ci/circleci: test-backend` or `ci/circleci: test-backend` click the `Details` | ||
| link to view the running process at CircleCI | ||
|
|
||
|  | ||
|
|
||
| 3. Click the `Artifacts` tab at the top of the screen once the process has completed. | ||
|
|
||
|  | ||
|
|
||
| 4. Click the `owasp_report.html` link to view the report. | ||
|
|
||
|  |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| #!/usr/bin/env bash | ||
| set -e | ||
| if command -v codecov > /dev/null 2>&1; then | ||
| echo The command codecov is available | ||
| else | ||
| echo The command codecov is not available, installing... | ||
| set -x | ||
|
|
||
| echo Importing Codecov PGP public keys... | ||
| curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --import | ||
|
|
||
| echo Downloading codecov uploader... | ||
| curl -Os https://uploader.codecov.io/latest/linux/codecov | ||
|
|
||
| echo Downloading SHA signatures... | ||
| curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM | ||
| curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig | ||
|
|
||
| echo Verifying package integrity... | ||
| sha256sum -c codecov.SHA256SUM | ||
| gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM | ||
|
|
||
| echo Validation successful, completing installation... | ||
| chmod +x codecov | ||
| rm codecov.SHA256SUM | ||
| rm codecov.SHA256SUM.sig | ||
| sudo mv codecov /usr/bin/ | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| #!/bin/sh | ||
|
|
||
|
|
||
| TARGET=$1 | ||
| ENVIRONMENT=$2 | ||
|
|
||
| TARGET_DIR="$(pwd)/tdrs-$TARGET" | ||
| REPORT_NAME=owasp_report.html | ||
| REPORTS_DIR="$TARGET_DIR/reports" | ||
|
|
||
| if [ "$ENVIRONMENT" = "nightly" ]; then | ||
| APP_URL="https://tdp-$TARGET-staging.app.cloud.gov/" | ||
| CONFIG_FILE="zap.conf" | ||
| elif [ "$ENVIRONMENT" = "circle" ]; then | ||
| CONFIG_FILE="zap.conf" | ||
| if [ "$TARGET" = "frontend" ]; then | ||
| APP_URL="http://tdp-frontend/" | ||
| elif [ "$TARGET" = "backend" ]; then | ||
| APP_URL="http://web:8080/" | ||
| else | ||
| echo "Invalid target $TARGET" | ||
| exit 1 | ||
| fi | ||
| elif [ "$ENVIRONMENT" = "local" ]; then | ||
|
|
||
| # docker-compose down | ||
| # docker-compose up -d --build | ||
|
|
||
| if [ "$TARGET" = "frontend" ]; then | ||
| APP_URL="http://tdp-frontend/" | ||
| elif [ "$TARGET" = "backend" ]; then | ||
| APP_URL="http://web/" | ||
| else | ||
| echo "Invalid target $TARGET" | ||
| exit 1 | ||
| fi | ||
| else | ||
| echo "Invalid environment $ENVIRONMENT" | ||
| exit 1 | ||
|
|
||
| fi | ||
|
|
||
|
|
||
| # do an OWASP ZAP scan | ||
| export ZAP_CONFIG=" \ | ||
| -config globalexcludeurl.url_list.url\(0\).regex='.*/robots\.txt.*' \ | ||
| -config globalexcludeurl.url_list.url\(0\).description='Exclude robots.txt' \ | ||
| -config globalexcludeurl.url_list.url\(0\).enabled=true \ | ||
| -config spider.postform=true" | ||
|
|
||
| echo "================== OWASP ZAP tests ==================" | ||
| cd $TARGET_DIR | ||
|
|
||
| if [ "$TARGET" = "frontend" ]; then | ||
| docker-compose down | ||
| docker-compose up -d --build | ||
| fi | ||
|
|
||
| # Ensure the reports directory can be written to | ||
| chmod 777 $(pwd)/reports | ||
|
|
||
| if [ -z ${CONFIG_FILE+x} ]; then | ||
| echo "No config file" | ||
| docker-compose run zaproxy zap-full-scan.py \ | ||
| -t $APP_URL \ | ||
| -m 5 \ | ||
| -z "${ZAP_CONFIG}" \ | ||
| -r "$REPORT_NAME" | tee /dev/tty | grep -q "FAIL-NEW: 0" | ||
| else | ||
| echo "Config file $ENVIRONMENT" | ||
| docker-compose run zaproxy zap-full-scan.py \ | ||
| -t $APP_URL \ | ||
| -m 5 \ | ||
| -z "${ZAP_CONFIG}" \ | ||
| -c "$CONFIG_FILE" \ | ||
| -r "$REPORT_NAME" | tee /dev/tty | grep -q "FAIL-NEW: 0" | ||
| fi | ||
|
|
||
|
|
||
| # The `grep -q` piped to the end of the previous command will return a | ||
| # 0 exit code if the term is found and 1 otherwise. | ||
| ZAPEXIT=$? | ||
|
|
||
| if [ "$TARGET" = "frontend" ]; then | ||
| docker-compose down --remove-orphan | ||
| fi | ||
|
|
||
| EXIT=0 | ||
|
|
||
| if [ "$ZAPEXIT" = 1 ] ; then | ||
| echo "OWASP ZAP scan failed" | ||
| EXIT=1 | ||
| fi | ||
|
|
||
| exit $EXIT | ||
| cd .. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.