SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00
Code Issues Releases Activity Actions

Merge pull request #506 from csaf-poc/support-legacy-security-txt

Browse source 
PMD: Support legacy security.txt location as fallback.
This commit is contained in:
JanHoefelmeyer 2023-11-30 07:34:46 +01:00 • committed by GitHub
commit d4ef21531a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 96 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

50
cmd/csaf_checker/processor.go
View file

@ -1262,10 +1262,26 @@ func (p *processor) checkProviderMetadata(domain string) bool {
// It checks the existence of the CSAF field in the file content and tries to fetch
// the value of this field. Returns an empty string if no error was encountered,
// the errormessage otherwise.
func (p *processor) checkSecurity(domain string) string {
func (p *processor) checkSecurity(domain string, legacy bool) (int, string) {
folder := "https://" + domain + "/"
if !legacy {
folder = folder + ".well-known/"
}
msg := p.checkSecurityFolder(folder)
if msg == "" {
if !legacy {
return 0, "Found valid security.txt within the well-known directory"
}
return 2, "Found valid security.txt in the legacy location"
}
return 1, folder + "security.txt: " + msg
}
// checkSecurityFolder checks the security.txt in a given folder.
func (p *processor) checkSecurityFolder(folder string) string {
client := p.httpClient()
path := "https://" + domain + "/.well-known/security.txt"
path := folder + "security.txt"
res, err := client.Get(path)
if err != nil {
return fmt.Sprintf("Fetching %s failed: %v", path, err)
@ -1298,7 +1314,7 @@ func (p *processor) checkSecurity(domain string) string {
return fmt.Sprintf("CSAF URL '%s' invalid: %v", u, err)
}
base, err := url.Parse("https://" + domain + "/.well-known/")
base, err := url.Parse(folder)
if err != nil {
return err.Error()
}
@ -1391,7 +1407,14 @@ func (p *processor) checkWellknown(domain string) string {
func (p *processor) checkWellknownSecurityDNS(domain string) error {
warningsW := p.checkWellknown(domain)
warningsS := p.checkSecurity(domain)
// Security check for well known (default) and legacy location
warningsS, sDMessage := p.checkSecurity(domain, false)
// if the security.txt under .well-known was not okay
// check for a security.txt within its legacy location
sLMessage := ""
if warningsS == 1 {
warningsS, sLMessage = p.checkSecurity(domain, true)
}
warningsD := p.checkDNS(domain)
p.badWellknownMetadata.use()
@ -1399,17 +1422,30 @@ func (p *processor) checkWellknownSecurityDNS(domain string) error {
p.badDNSPath.use()
var kind MessageType
if warningsS == "" || warningsD == "" || warningsW == "" {
if warningsS != 1 || warningsD == "" || warningsW == "" {
kind = WarnType
} else {
kind = ErrorType
}
// Info, Warning or Error depending on kind and warningS
kindSD := kind
if warningsS == 0 {
kindSD = InfoType
}
kindSL := kind
if warningsS == 2 {
kindSL = InfoType
}
if warningsW != "" {
p.badWellknownMetadata.add(kind, warningsW)
}
if warningsS != "" {
p.badSecurity.add(kind, warningsS)
p.badSecurity.add(kindSD, sDMessage)
// only if the well-known security.txt was not successful:
// report about the legacy location
if warningsS != 0 {
p.badSecurity.add(kindSL, sLMessage)
}
if warningsD != "" {
p.badDNSPath.add(kind, warningsD)

4
cmd/csaf_checker/reporters.go
View file

@ -251,10 +251,6 @@ func (r *securityReporter) report(p *processor, domain *Domain) {
req.message(WarnType, "Performed no in-depth test of security.txt.")
return
}
if len(p.badSecurity) == 0 {
req.message(InfoType, "Found CSAF entry in security.txt.")
return
}
req.Messages = p.badSecurity
}