darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-09 15:49:48 -04:00
Code Issues Packages Projects Releases Wiki Activity

ignore source code disclosure java as a false positive

Browse Source
This commit is contained in:
Kenneth Kehl
2025-02-06 11:42:31 -08:00
parent afd3d94790
commit 208891a71a
2 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/__init__.py
View File

@@ -316,7 +316,6 @@ def init_app(application):
application.before_request(load_organization_before_request) application.before_request(load_organization_before_request)
application.before_request(request_helper.check_proxy_header_before_request) application.before_request(request_helper.check_proxy_header_before_request)
application.before_request(make_session_permanent) application.before_request(make_session_permanent)
application.before_request(block_serving_node_files)
application.after_request(save_service_or_org_after_request) application.after_request(save_service_or_org_after_request)
start = len(asset_fingerprinter._filesystem_path) start = len(asset_fingerprinter._filesystem_path)
@@ -405,11 +404,6 @@ def make_session_permanent():
session.permanent = True session.permanent = True
def block_serving_node_files():
if "node_modules" in request.path:
abort(403)
def create_beta_url(url): def create_beta_url(url):
url_created = None url_created = None
try: try:

1
zap.conf
View File

@@ -53,6 +53,7 @@
10096 WARN (Timestamp Disclosure - Passive/release) 10096 WARN (Timestamp Disclosure - Passive/release)
10097 WARN (Hash Disclosure - Passive/beta) 10097 WARN (Hash Disclosure - Passive/beta)
10098 WARN (Cross-Domain Misconfiguration - Passive/release) 10098 WARN (Cross-Domain Misconfiguration - Passive/release)
10099 IGNORE (Source Code Disclosure - Java)
10104 WARN (User Agent Fuzzer - Active/beta) 10104 WARN (User Agent Fuzzer - Active/beta)
10105 WARN (Weak Authentication Method - Passive/release) 10105 WARN (Weak Authentication Method - Passive/release)
10106 IGNORE (HTTP Only Site - Active/beta) 10106 IGNORE (HTTP Only Site - Active/beta)