Here is the golden path
cnspec shell host https://mondoo.com -c 'http.get.header.params["X-Content-Type-Options"] == "nosniff"'
→ no Mondoo configuration file provided, using defaults
→ connected to Network Host
___ _ __ ___ _ __ ___ ___
/ __| '_ \/ __| '_ \ / _ \/ __|
| (__| | | \__ \ |_) | __/ (__
\___|_| |_|___/ .__/ \___|\___|
mondoo™ |_|
> http.get.header.params["X-Content-Type-Options"] == "nosniff"
[ok] value: [
0: "nosniff"
]
but host defaults to the http schema so if you run the same query it will panic
cnspec shell host mondoo.com -c 'http.get.header.params["X-Content-Type-Options"] == "nosniff"'
→ no Mondoo configuration file provided, using defaults
→ connected to Network Host
___ _ __ ___ _ __ ___ ___
/ __| '_ \/ __| '_ \ / _ \/ __|
| (__| | | \__ \ |_) | __/ (__
\___|_| |_|___/ .__/ \___|\___|
mondoo™ |_|
> http.get.header.params["X-Content-Type-Options"] == "nosniff"
⢿ Executing query...
panic: interface conversion: interface {} is nil, not []interface {}
goroutine 114 [running]:
go.mondoo.com/mql/v13/llx.cmpArrayOne(...)
/home/runner/go/pkg/mod/go.mondoo.com/mql/v13@v13.5.0/llx/builtin_array.go:1057
...
This was found running http security policy
cnspec scan host mondoo.com --incognito -f ./cnspec/content/mondoo-http-security.mql.yaml
→ no Mondoo configuration file provided, using defaults
→ discover related assets for 1 asset(s)
Scanning assets...
○ mondoo.com [host]
0/1 completed · 0s
panic: interface conversion: interface {} is nil, not []interface {} [recovered, repanicked]
goroutine 148 [running]:
go.mondoo.com/mql/v13/providers-sdk/v1/upstream/health.ReportPanic({0x1047ec497, 0x6}, {0x10491f88c, 0x6}, {0x1049203e8, 0x8}, {0x0, 0x0, 0x7414aec032c0?})
/home/runner/go/pkg/mod/go.mondoo.com/mql/v13@v13.5.0/providers-sdk/v1/upstream/health/errors.go:64 +0x124
Here is the golden path
but host defaults to the
httpschema so if you run the same query it will panicThis was found running http security policy