systematic security review(s)

[ThomasWaldmann]

Original report by Thomas Waldmann (Bitbucket: thomaswaldmann, GitHub: thomaswaldmann).

---

Some hints (not everything applies to Python, but you get the idea):

http://cwe.mitre.org/top25/index.html

[RogerHaase]

Google led me to ZAP: https://www.zaproxy.org/

GitHub has suppport: https://github.com/marketplace/actions/owasp-zap-baseline-scan

ZAP can be installed and run against the built-in server. The test wiki had auto registration turned off, one item with one bad link.

ZAP found 9 alerts: 5 medium risk, 3 low risk, 1 informational.

• Absence of Anti-CSRF Tokens (1664)

• Application Error Disclosure (2)

• Content Security Policy (CSP) Header Not Set (1320)

• Missing Anti-clickjacking Header (1034)

• Vulnerable JS Library (5) {werkzeug 1.0.1 installs jquery 3.4.1}

• Application Error Disclosure (220)

• Timestamp Disclosure - Unix (12)

• X-Content-Type-Options Header Missing (1171)

• Information Disclosure - Suspicious Comments (57)

Any suggestions for a better tool?

[ReimarBauer]

I have a similiar issue in my project, a colleague mentioned there https://w3af.org/
we have not compared both. seems that it is py 2.7 based.

[UlrichB22]

From what I've read, ZAP looks good (I haven't tested it). The new URL for the ZAP basic scan is https://github.com/marketplace/actions/zap-baseline-scan.

Additionally, we can do a static security code analysis, e.g. with 'bandit'. See https://bandit.readthedocs.io.

I tested 'bandit' using config from https://github.com/codefactor-io/default-configs/blob/master/.bandit.yml and an additional line in .bandit.yml to exclude test modules:

exclude_dirs: ["*/_tests/*"]

This results in 13 issues, see the summary section in the report:

[...]
Code scanned:
	Total lines of code: 33362
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 6
		Medium: 2
		High: 5
	Total issues (by confidence):
		Undefined: 0
		Low: 1
		Medium: 0
		High: 12
Files skipped (0):

[UlrichB22]

Further issues related to 'bandit' findings are documented in #1820.