The rule would raise info alerts for each script it found along with the integrety hash, as per
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

This could just work on URLs that are in scope - it would just be useful when you're trying to create a CSP for a specific site.

OWASP ZAP published https://www.zaproxy.org/blog/2021-04-19-collecting-statistics-for-open-source-projects explaining their way to collect some stats about usage and downloads of the project. It would be nice to have something similar (or near-identical, even) for Juice Shop.

Download stats interesting for Juice Shop would definitely include:

• Docker image pulls (main app and CTF extension)

What's the issue?
Overwritten test scenario, can be summarized and link to payload lists from other repos

How do we solve it?
Chop down the content to the required and needed information, link to payload lists instead of enumerating all possible usernames and passwords, provide further guidance on how to test.

If no one is up to handle it, I can take care of it

Safety parser relly on a DB of vulnerabilities with CVE infos. This databases is upgraded/modified every month.
This pb is that our unit tests relly on this changing file.

We need to do one of these options:

1. fix the DB file for unit tests
2. remove completely this feature and wait that the CVE info come from the report (I pushed a pull request upstream to have CVE directly in the JSON rep

Description

BeanUtils is a library that is doing automatic mapping to Java object.
It can cause arm when the attack controls part of the list of properties being sets. BeanUtils does not blacklist properties like class, classloader or other objects that are likely to load arbitrary classes and possibly run code.

Code

import org.apache.commons.beanutils.BeanUtils;

public

Current Behavior:

When viewing vulns in the Audit Vulnerabilities tab. the Analysis column appears to contain code (enum?) names, e.g. NOT_SET, FALSE_POSITIVE. This problem also occurs in Policy Violations tab.

Steps to Reproduce:

Open the Audit Vulnerabilities tab.

Expected Behavior:

The Analysis column contains language specific analysis values, e.g. Not Set, False Positive

https://github.com/OWASP/www-community/blob/master/pages/CRV2_AppThreatModeling.md

Contains a bunch of HTML based tables that need attention. They did not auto-migrate well and at a certain point break the rendering of the majority of the page.