Schedule issue for monthly web application vulnerability scan (#7100) #7121

dsotirho-ucsc · 2025-05-14T18:18:27Z

Connected issues: #7100

Notes

Tickets https://github.com/DataBiosphere/azul-private/issues/219 and https://github.com/DataBiosphere/azul-private/issues/82 should be closed once this PR is merged

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is marked as approved
PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved connected issues to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2025-05-14T18:41:38Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.22%. Comparing base (41db1cd) to head (ba357f0).
Report is 2 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #7121   +/-   ##
========================================
  Coverage    85.22%   85.22%           
========================================
  Files          152      152           
  Lines        22099    22099           
========================================
  Hits         18834    18834           
  Misses        3265     3265

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coveralls · 2025-05-14T18:42:50Z

coverage: 85.402%. remained the same
when pulling ba357f0 on issues/dsotirho-ucsc/7100-schedule-zap-scan
into 41db1cd on develop.

dsotirho-ucsc · 2025-05-15T17:56:29Z

7121_IT_2025-05-15.txt

achave11-ucsc

Some minor nits.

achave11-ucsc · 2025-05-16T17:21:30Z

.github/ISSUE_TEMPLATE/web_app_vulnerability_scan.md

@@ -0,0 +1,33 @@
+---
+name: Run the web app vulnerability scans
+about: Issue template for the monthly web app vulnerability scans and triaging of the findings


I'd shorten a bit as …

Suggested change

about: Issue template for the monthly web app vulnerability scans and triaging of the findings

about: Issue template for the monthly scanning and triaging of web app vulnerabilities

achave11-ucsc · 2025-05-16T17:21:38Z

.github/ISSUE_TEMPLATE/web_app_vulnerability_scan.md

+  - [ ] … the AnVIL Azul Indexer https://indexer.explore.anvilproject.org/
+  - [ ] … the AnVIL Azul Service https://service.explore.anvilproject.org/
+- [ ] Uploaded scan report PDFs to the [Google Drive](https://drive.google.com/drive/folders/1LYg9qV6usZT20vxddWjSkONmrw9-PjHy)
+- [ ] Added findings to the [Google Sheet](https://docs.google.com/spreadsheets/d/1uUaiOGr8t2oKSDal_FazIUDBhNb1yq3RwbSy-xMMBO0/edit?gid=709622447#gid=709622447) and created issues for new `High`, `Medium`, and `Low` severity findings


Is a bit more duplicative but more adequate for the CL.

Suggested change

- [ ] Added findings to the [Google Sheet](https://docs.google.com/spreadsheets/d/1uUaiOGr8t2oKSDal_FazIUDBhNb1yq3RwbSy-xMMBO0/edit?gid=709622447#gid=709622447) and created issues for new `High`, `Medium`, and `Low` severity findings

- [ ] Added findings to the [Google Sheet](https://docs.google.com/spreadsheets/d/1uUaiOGr8t2oKSDal_FazIUDBhNb1yq3RwbSy-xMMBO0/edit?gid=709622447#gid=709622447) and created …

- [ ] … issues for new `High` severity findings

- [ ] … issues for new `Medium` severity findings

- [ ] … issues for new `Low` severity findings

achave11-ucsc · 2025-05-16T17:34:36Z

.github/ISSUE_TEMPLATE/web_app_vulnerability_scan.md

+about: Issue template for the monthly web app vulnerability scans and triaging of the findings
+title: Monthly web app vulnerability scans
+labels: +,compliance,infra,no demo,orange
+assignees: dsotirho-ucsc


I know you've been the point person for the task, but consider confirming this. It may be easier to detect an unassigned issue than an assigned one.

achave11-ucsc · 2025-05-16T17:41:54Z

.github/ISSUE_TEMPLATE/web_app_vulnerability_scan.md

+- [ ] Added findings to the [Google Sheet](https://docs.google.com/spreadsheets/d/1uUaiOGr8t2oKSDal_FazIUDBhNb1yq3RwbSy-xMMBO0/edit?gid=709622447#gid=709622447) and created issues for new `High`, `Medium`, and `Low` severity findings
+- [ ] Added a comment to issues previously created for newly fixed findings (e.g. "No longer a finding as of the YYYY-MM-DD ZAP scan")
+- [ ] Added a comment to this issue listing the newly created issues, a count of fixed findings, and a screenshot of the Google Sheet
+- [ ] Assigned issue to only the system administrator


Like our other CLs.

Suggested change

- [ ] Assigned issue to only the system administrator

- [ ] Issue is assigned to only the system administrator

dsotirho-ucsc · 2025-05-16T22:27:20Z

7121_IT_2025-05-16.txt

achave11-ucsc

Originally missed this. My bad.

achave11-ucsc · 2025-05-16T23:31:01Z

.github/ISSUE_TEMPLATE/web_app_vulnerability_scan.md

+- [ ] Issue is assigned to only the system administrator
+- [ ] Moved issue to `Review Requested`


Apologies, I originally missed this. For consistency with our other CLs.

Suggested change

- [ ] Issue is assigned to only the system administrator

- [ ] Moved issue to `Review Requested`

- [ ] Moved issue to `Review Requested`

- [ ] Issue is assigned to only the system administrator

dsotirho-ucsc · 2025-05-19T16:54:20Z

7121_IT_2025-05-19.txt

achave11-ucsc

LGTM ✅

hannes-ucsc

Please hold warm until a fix for #7153 lands on develop.

dsotirho-ucsc · 2025-05-23T16:43:37Z

7121_IT_2025-05-23.txt

hannes-ucsc · 2025-05-24T00:29:16Z

github-actions bot added the orange [process] Done by the Azul team label May 14, 2025

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7100-schedule-zap-scan branch 3 times, most recently from ef17a8c to 9c62d30 Compare May 15, 2025 17:01

dsotirho-ucsc requested a review from achave11-ucsc May 15, 2025 18:30

dsotirho-ucsc assigned achave11-ucsc May 15, 2025

achave11-ucsc requested changes May 16, 2025

View reviewed changes

achave11-ucsc removed their assignment May 16, 2025

dsotirho-ucsc requested a review from achave11-ucsc May 16, 2025 22:27

dsotirho-ucsc assigned achave11-ucsc May 16, 2025

achave11-ucsc requested changes May 16, 2025

View reviewed changes

achave11-ucsc removed their assignment May 16, 2025

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7100-schedule-zap-scan branch from 71c2912 to b097299 Compare May 19, 2025 16:31

dsotirho-ucsc requested a review from achave11-ucsc May 19, 2025 17:43

dsotirho-ucsc assigned achave11-ucsc May 19, 2025

achave11-ucsc approved these changes May 19, 2025

View reviewed changes

achave11-ucsc marked this pull request as ready for review May 19, 2025 18:23

achave11-ucsc requested a review from hannes-ucsc as a code owner May 19, 2025 18:23

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc May 19, 2025

hannes-ucsc reviewed May 21, 2025

View reviewed changes

hannes-ucsc removed their assignment May 21, 2025

hannes-ucsc added the hold warm [process] PR can't land just yet but needs to be rebased daily label May 21, 2025

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7100-schedule-zap-scan branch 2 times, most recently from 373082e to b6c0b24 Compare May 22, 2025 22:43

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7100-schedule-zap-scan branch from b6c0b24 to b290032 Compare May 23, 2025 16:16

dsotirho-ucsc requested a review from hannes-ucsc May 23, 2025 16:44

dsotirho-ucsc assigned hannes-ucsc May 23, 2025

dsotirho-ucsc removed the hold warm [process] PR can't land just yet but needs to be rebased daily label May 23, 2025

hannes-ucsc approved these changes May 24, 2025

View reviewed changes

hannes-ucsc added the no sandbox [process] PR will not be tested in the sandbox label May 24, 2025

hannes-ucsc added the 0 reviews [process] Lead didn't request any changes label May 24, 2025

hannes-ucsc assigned achave11-ucsc and unassigned hannes-ucsc May 24, 2025

achave11-ucsc assigned dsotirho-ucsc and unassigned achave11-ucsc May 27, 2025

Schedule issue for monthly web application vulnerability scan (#7100)

ba357f0

dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/7100-schedule-zap-scan branch from b290032 to ba357f0 Compare May 29, 2025 00:54

dsotirho-ucsc added sandbox [process] Resolution is being verified in sandbox deployment and removed no sandbox [process] PR will not be tested in the sandbox labels May 29, 2025

dsotirho-ucsc merged commit f728fd0 into develop May 29, 2025
11 checks passed

dsotirho-ucsc deleted the issues/dsotirho-ucsc/7100-schedule-zap-scan branch May 29, 2025 03:36

dsotirho-ucsc removed their assignment May 29, 2025

	about: Issue template for the monthly web app vulnerability scans and triaging of the findings
	about: Issue template for the monthly scanning and triaging of web app vulnerabilities

-- [ ] Added findings to the [Google Sheet](https://docs.google.com/spreadsheets/d/1uUaiOGr8t2oKSDal_FazIUDBhNb1yq3RwbSy-xMMBO0/edit?gid=709622447#gid=709622447) and created issues for new `High`, `Medium`, and `Low` severity findings
+- [ ] Added findings to the [Google Sheet](https://docs.google.com/spreadsheets/d/1uUaiOGr8t2oKSDal_FazIUDBhNb1yq3RwbSy-xMMBO0/edit?gid=709622447#gid=709622447) and created …
+  - [ ] … issues for new `High` severity findings
+  - [ ] … issues for new `Medium` severity findings
+  - [ ] … issues for new `Low` severity findings

	- [ ] Assigned issue to only the system administrator
	- [ ] Issue is assigned to only the system administrator

		- [ ] Issue is assigned to only the system administrator
		- [ ] Moved issue to `Review Requested`

Schedule issue for monthly web application vulnerability scan (#7100) #7121

Schedule issue for monthly web application vulnerability scan (#7100) #7121

Uh oh!

Conversation

dsotirho-ucsc commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notes

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

Uh oh!

codecov bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dsotirho-ucsc commented May 15, 2025

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

achave11-ucsc May 16, 2025

Choose a reason for hiding this comment

Uh oh!

achave11-ucsc May 16, 2025

Choose a reason for hiding this comment

Uh oh!

achave11-ucsc May 16, 2025

Choose a reason for hiding this comment

Uh oh!

achave11-ucsc May 16, 2025

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 16, 2025

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

achave11-ucsc May 16, 2025

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 19, 2025

Uh oh!

achave11-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

hannes-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

dsotirho-ucsc commented May 23, 2025

Uh oh!

hannes-ucsc commented May 24, 2025

Security design review

Uh oh!

Uh oh!

Uh oh!

dsotirho-ucsc commented May 14, 2025 •

edited

Loading

codecov bot commented May 14, 2025 •

edited

Loading

coveralls commented May 14, 2025 •

edited

Loading