ZAP Scan Baseline Report

[github-actions]

• Site: https://localhost
  New Alerts
  • Timestamp Disclosure - Unix [10096] total: 15:
    • https://localhost/_next/static/chunks/framework.600ceb3b9635787757de.js
    • https://localhost/_next/static/chunks/bcde67e09790770b8b4893e89b00544931ae7f19.1347c3822ce16a835d24.js
    • https://localhost/_next/static/chunks/framework.600ceb3b9635787757de.js
    • https://localhost/_next/static/chunks/4674618e.7a6db50341201fcb7a55.js
    • https://localhost/_next/static/chunks/framework.600ceb3b9635787757de.js
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 11:
    • https://localhost/_next/static/chunks/084f8cb4b6e2acc71db88d3082f178f01922aea3.e6d669642193a7956a85.js
    • https://localhost/_next/static/chunks/bcde67e09790770b8b4893e89b00544931ae7f19.1347c3822ce16a835d24.js
    • https://localhost/_next/static/chunks/commons.79f04f593953ebd6389f.js
    • https://localhost/_next/static/css/75aae9a6ef1f05a55059.css
    • https://localhost/
    • ..
  • Modern Web Application [10109] total: 6:
    • https://localhost/robots.txt
    • https://localhost/sitemap.xml
    • https://localhost/_next/static/chunks/polyfills-6fc097f640a080488750.js
    • https://localhost
    • https://localhost/_next/static/chunks/framework.600ceb3b9635787757de.js
    • ..
  • X-Frame-Options Header Not Set [10020] total: 2:
    • https://localhost/
    • https://localhost
  • Content Security Policy (CSP) Header Not Set [10038] total: 4:
    • https://localhost
    • https://localhost/sitemap.xml
    • https://localhost/
    • https://localhost/robots.txt
  • Information Disclosure - Suspicious Comments [10027] total: 11:
    • https://localhost/_next/static/chunks/framework.600ceb3b9635787757de.js
    • https://localhost/sitemap.xml
    • https://localhost
    • https://localhost/_next/static/chunks/4674618e.7a6db50341201fcb7a55.js
    • https://localhost/robots.txt
    • ..
  • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 4:
    • https://localhost/sitemap.xml
    • https://localhost/robots.txt
    • https://localhost
    • https://localhost/
  • Incomplete or No Cache-control Header Set [10015] total: 3:
    • https://localhost/
    • https://localhost
    • https://localhost/_next/static/css/75aae9a6ef1f05a55059.css
  • Application Error Disclosure [90022] total: 1:
    • https://localhost/_next/static/chunks/pages/_error-b124520ada623f3bf8a0.js

View the following link to download the report.
RunnerID:731435512

[slowr]

@vkotronis this is the new report with nginx proxy in front.

There are some missing stuff that we had before like CSP: https://github.com/FORTH-ICS-INSPIRE/artemis/blob/5b12a9d79a2785d53182244b2eec0d30f87aad96/frontend/webapp/core/__init__.py#L48

Then we need to hide some stuff in nginx configuration and lastly, we can create a file in the repo for some false-negatives.

(more info if you download the report)

[vkotronis]

@slowr I approved the nginx PR, could you also create an issue with the missing CSP details?

[github-actions]

• Site: https://localhost
  New Alerts

  • Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 11:
    • https://localhost/_next/static/css/75aae9a6ef1f05a55059.css
    • https://localhost/_next/static/chunks/39.853fb83f1a0b355e8a1a.js
    • https://localhost/_next/static/chunks/main-ea8dcf839a600852e0cc.js
    • https://localhost
    • https://localhost/_next/static/chunks/084f8cb4b6e2acc71db88d3082f178f01922aea3.e6d669642193a7956a85.js
    • ..
  • CSP: script-src unsafe-inline [10055] total: 3:
    • https://localhost
    • https://localhost/robots.txt
    • https://localhost/
  • CSP: style-src unsafe-inline [10055] total: 3:
    • https://localhost/robots.txt
    • https://localhost
    • https://localhost/
  • CSP: Wildcard Directive [10055] total: 3:
    • https://localhost/
    • https://localhost
    • https://localhost/robots.txt
  • CSP: Notices [10055] total: 3:
    • https://localhost/
    • https://localhost/robots.txt
    • https://localhost

  Resolved Alerts

  • X-Content-Type-Options Header Missing [10021] total: 11:
  • X-Frame-Options Header Not Set [10020] total: 2:
  • Content Security Policy (CSP) Header Not Set [10038] total: 4:
  • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 4:

View the following link to download the report.
RunnerID:784860073

[github-actions]

• Site: https://localhost
  New Alerts

  • X-Content-Type-Options Header Missing [10021] total: 11:
    • https://localhost/_next/static/chunks/commons.eebeb76cfe5eec972e19.js
    • https://localhost/_next/static/chunks/39.b0d2c819eec5231d3a2a.js
    • https://localhost/_next/static/chunks/main-decfb0c4b2706ecd99ac.js
    • https://localhost/
    • https://localhost/_next/static/css/32ab3771139785a3c24e.css
    • ..
  • X-Frame-Options Header Not Set [10020] total: 2:
    • https://localhost/
    • https://localhost
  • Content Security Policy (CSP) Header Not Set [10038] total: 4:
    • https://localhost
    • https://localhost/sitemap.xml
    • https://localhost/
    • https://localhost/robots.txt
  • Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) [10037] total: 4:
    • https://localhost/sitemap.xml
    • https://localhost/robots.txt
    • https://localhost
    • https://localhost/

  Resolved Alerts

  • Strict-Transport-Security Multiple Header Entries (Non-compliant with Spec) [10035] total: 11:
  • CSP: script-src unsafe-inline [10055] total: 3:
  • CSP: style-src unsafe-inline [10055] total: 3:
  • CSP: Wildcard Directive [10055] total: 3:
  • CSP: Notices [10055] total: 3:

View the following link to download the report.
RunnerID:839280981