Document web application vulnerability scanning procedure (#7021) #7096

dsotirho-ucsc · 2025-05-06T23:07:17Z

Connected issues: #7021

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is marked as approved
PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved connected issues to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2025-05-06T23:31:08Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.24%. Comparing base (7964fe5) to head (9d9da68).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #7096   +/-   ##
========================================
  Coverage    85.24%   85.24%           
========================================
  Files          152      152           
  Lines        22060    22060           
========================================
  Hits         18804    18804           
  Misses        3256     3256

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coveralls · 2025-05-06T23:31:52Z

coverage: 85.417%. remained the same
when pulling 9d9da68 on issues/dsotirho-ucsc/7021-document-scan-procedure
into 7964fe5 on develop.

dsotirho-ucsc · 2025-05-08T16:42:41Z

7096_IT_2025-05-08.txt

OPERATOR.rst

achave11-ucsc

Looks good, small nits.

dsotirho-ucsc · 2025-05-09T17:42:36Z

7096_IT_2025-05-09.txt

achave11-ucsc

the intended category of ZAP application usage.

In that spirit, I'd rearrange the sections, moving the ZAP Setup last, and maybe the authenticated scan preceding it, but I'll leave that to your discretion. Also, consider having a small/medium explanatory paragraph in the beginning regarding the how long to expect for a scan to run and any network/connectivity delays that may be experienced while running this without request limit filters (if any).

dsotirho-ucsc · 2025-05-13T19:26:45Z

7096_IT_2025-05-13.txt

In that spirit, I'd rearrange the sections, moving the ZAP Setup last, and maybe the authenticated scan preceding it, but I'll leave that to your discretion.

I think it makes sense to have the setup first, since it has options that should be set before any scans are run.

Also, consider having a small/medium explanatory paragraph in the beginning regarding the how long to expect for a scan to run and any network/connectivity delays that may be experienced while running this without request limit filters (if any).

I've expanded a few of the sections to make them more descriptive, and added a ZAP Sessions section.

achave11-ucsc

Approved ✅

hannes-ucsc · 2025-05-14T17:30:31Z

OPERATOR.rst

+
+- From the menu, select ``Tools`` -> ``Options``:
+
+  - -> ``Network`` -> ``Rate Limit``, add and enable a 3 request per second rule


No double bullets, please.

Suggested change

- -> ``Network`` -> ``Rate Limit``, add and enable a 3 request per second rule

- Select ``Network`` -> ``Rate Limit``, add and enable a 3 request per second rule

hannes-ucsc · 2025-05-14T20:18:13Z

OPERATOR.rst

+
+The process for running an authenticated scan is to first obtain an Azul
+authentication token, and launch the ZAP application with the token set as
+an environment variable. See


This is reStructuredText

https://sublime-and-sphinx-guide.readthedocs.io/en/latest/references.html#links-to-external-web-pages

hannes-ucsc · 2025-05-14T20:19:29Z

OPERATOR.rst

+
+  - -> ``Check for Updates``:
+
+    - Check for updates on startup: Checked


Suggested change

- Check for updates on startup: Checked

- Check the *Check for updates on startup* option

Use italics when you quote from a UI.

hannes-ucsc

Please also ask for another peer review from Abraham asking him to walk through these steps in order to verify them.

hannes-ucsc · 2025-05-15T15:47:40Z

OPERATOR.rst

+environment variable. See the `ZAP documentation
+<https://www.zaproxy.org/docs/getting-further/authentication/handling-auth-yourself/>`_
+for more information.


For long URLs, separate the link and the target definition as outlined in the Sphinx documentation I linked to in my previous review.

hannes-ucsc · 2025-05-15T15:48:13Z

OPERATOR.rst

+- From the popup, select the *No, I do not want to persis this session at this
+  moment in time* option and click *Start*
+
+- From the menu, select *Edit* -> *ZAP Mode* -> *Standard Mode* (This should be


Use em dash, please.

Suggested change

- From the menu, select *Edit* -> *ZAP Mode* -> *Standard Mode* (This should be

- From the menu, select *Edit* – *ZAP Mode* – *Standard Mode* (This should be

hannes-ucsc · 2025-05-15T15:51:52Z

OPERATOR.rst

+  - Using the Swagger UI, excecute an enpoint such as ``/index/catalogs``
+
+  - Note the example ``curl`` command, and copy the token from the
+    ``Authorization`` header option (e.g. "Bearer ya29.a0…")


Suggested change

``Authorization`` header option (e.g. "Bearer ya29.a0…")

``Authorization`` header option (e.g. ``Bearer ya29.a0…``)

hannes-ucsc · 2025-05-15T15:54:13Z

OPERATOR.rst

+new scan. Failure to do so can pollute the scan results with the findings from
+the previous scan.
+
+If you are promopted with options to persist the ZAP session, select the *No, I


Suggested change

If you are promopted with options to persist the ZAP session, select the *No, I

If you are prompted with options to persist the ZAP session, select the *No, I

hannes-ucsc · 2025-05-15T15:56:09Z

OPERATOR.rst

+
+    - Check the *Check for updates to the add-ons you have installed* option
+
+Running an authenticated scan


This sounds like it is optional. It should state clearly that all scans should be authenticated, or, if only some should be authenticated, which ones.

dsotirho-ucsc · 2025-05-16T00:33:57Z

7096_IT_2025-05-15.txt

dsotirho-ucsc · 2025-05-16T00:48:04Z

Please also ask for another peer review from Abraham asking him to walk through these steps in order to verify them.

@achave11-ucsc, Please peer review, and attempt to follow the guide in order to successfully run scans and generate reports. A full list of the URLs to scan is available from the issue template for the monthly scan (template is not yet merged PR #7121).

Since completing all 8 scans would take a ~24 hours, I suggest running one scan fully (the Azul indexer scans complete the quickest), generating a report, and comparing the results to the last triaged scan results on this Google Sheet. For the other scans, getting the scan to start and seeing findings start to trickle in should suffice.

Feel free to reach out if you have any questions, however (hopefully) the guide will give you everything you need. Thanks!

achave11-ucsc

LGTM ✅

hannes-ucsc

PL please.

dsotirho-ucsc · 2025-05-27T16:24:55Z

7096_IT_2025-05-27.txt

hannes-ucsc

I believe we discussed in PL using a numbered list for the sequence of steps. Please also flatten the list structure so that it becomes a simple sequence of steps. Make sure that list items are complete sentences.

github-actions bot added the orange [process] Done by the Azul team label May 6, 2025

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7021-document-scan-procedure branch 3 times, most recently from 1023862 to 634e24a Compare May 8, 2025 16:13

dsotirho-ucsc assigned achave11-ucsc May 8, 2025

dsotirho-ucsc requested a review from achave11-ucsc May 8, 2025 16:43

achave11-ucsc reviewed May 9, 2025

View reviewed changes

OPERATOR.rst Show resolved Hide resolved

achave11-ucsc reviewed May 9, 2025

View reviewed changes

achave11-ucsc removed their assignment May 9, 2025

dsotirho-ucsc requested a review from achave11-ucsc May 9, 2025 17:43

dsotirho-ucsc assigned achave11-ucsc May 9, 2025

achave11-ucsc requested changes May 9, 2025

View reviewed changes

achave11-ucsc removed their assignment May 9, 2025

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7021-document-scan-procedure branch 3 times, most recently from 5fc1864 to ac189e9 Compare May 13, 2025 18:27

dsotirho-ucsc requested a review from achave11-ucsc May 13, 2025 19:26

dsotirho-ucsc assigned achave11-ucsc May 13, 2025

achave11-ucsc previously approved these changes May 13, 2025

View reviewed changes

achave11-ucsc marked this pull request as ready for review May 13, 2025 21:31

achave11-ucsc requested a review from hannes-ucsc as a code owner May 13, 2025 21:31

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc May 13, 2025

hannes-ucsc requested changes May 14, 2025

View reviewed changes

hannes-ucsc removed their assignment May 14, 2025

dsotirho-ucsc assigned hannes-ucsc May 14, 2025

hannes-ucsc requested changes May 15, 2025

View reviewed changes

hannes-ucsc removed their assignment May 15, 2025

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7021-document-scan-procedure branch from 7fe1f01 to c473359 Compare May 15, 2025 23:40

dsotirho-ucsc requested a review from achave11-ucsc May 16, 2025 00:48

dsotirho-ucsc assigned achave11-ucsc May 16, 2025

achave11-ucsc previously approved these changes May 17, 2025

View reviewed changes

achave11-ucsc requested a review from hannes-ucsc May 17, 2025 01:01

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc May 17, 2025

hannes-ucsc requested changes May 21, 2025

View reviewed changes

hannes-ucsc added 2 reviews [process] Lead requested changes twice and removed 1 review [process] Lead requested changes once labels May 21, 2025

hannes-ucsc removed their assignment May 21, 2025

dsotirho-ucsc dismissed achave11-ucsc’s stale review via 2d10b12 May 23, 2025 16:24

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7021-document-scan-procedure branch 2 times, most recently from 2d10b12 to bcf2b25 Compare May 23, 2025 20:35

dsotirho-ucsc added 3 commits May 27, 2025 09:02

Remove duplicate table of contents

df6aebc

Document web application vulnerability scanning procedure (#7021)

47e56fa

fixup! Document web application vulnerability scanning procedure (#7021)

9d9da68

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7021-document-scan-procedure branch from bcf2b25 to 9d9da68 Compare May 27, 2025 16:02

dsotirho-ucsc requested a review from hannes-ucsc May 27, 2025 16:31

dsotirho-ucsc assigned hannes-ucsc May 27, 2025

hannes-ucsc requested changes May 27, 2025

View reviewed changes

hannes-ucsc added 3 reviews [process] Lead requested changes thrice and removed 2 reviews [process] Lead requested changes twice labels May 27, 2025

hannes-ucsc removed their assignment May 27, 2025


		- From the menu, select ``Tools`` -> ``Options``:

		- -> ``Network`` -> ``Rate Limit``, add and enable a 3 request per second rule

	- -> ``Network`` -> ``Rate Limit``, add and enable a 3 request per second rule
	- Select ``Network`` -> ``Rate Limit``, add and enable a 3 request per second rule


		- -> ``Check for Updates``:

		- Check for updates on startup: Checked

	- Check for updates on startup: Checked
	- Check the Check for updates on startup option

	- From the menu, select Edit -> ZAP Mode -> Standard Mode (This should be
	- From the menu, select Edit – ZAP Mode – Standard Mode (This should be

	``Authorization`` header option (e.g. "Bearer ya29.a0…")
	``Authorization`` header option (e.g. ``Bearer ya29.a0…``)

	If you are promopted with options to persist the ZAP session, select the *No, I
	If you are prompted with options to persist the ZAP session, select the *No, I


		- Check the Check for updates to the add-ons you have installed option

		Running an authenticated scan

Document web application vulnerability scanning procedure (#7021) #7096

Are you sure you want to change the base?

Document web application vulnerability scanning procedure (#7021) #7096

Uh oh!

Conversation

dsotirho-ucsc commented May 6, 2025 • edited by achave11-ucsc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

Uh oh!

codecov bot commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dsotirho-ucsc commented May 8, 2025

Uh oh!

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 9, 2025

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 13, 2025

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hannes-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 16, 2025

Uh oh!

dsotirho-ucsc commented May 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

hannes-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 27, 2025

dsotirho-ucsc commented May 6, 2025 •

edited by achave11-ucsc

Loading

codecov bot commented May 6, 2025 •

edited

Loading

coveralls commented May 6, 2025 •

edited

Loading

dsotirho-ucsc commented May 16, 2025 •

edited

Loading