Skip to content

Add external script test

Aaron Goldenthal requested to merge feature/add-external-scripts-test into develop

Add test to check for any external scripts and if found:

  • Downloads the script to a local folder (to be saved artifacts for scanning)
  • Logs the original script and download location.

This test was originally going to be disabled by default to avoid a breaking change, but with the other changes (especially test-specific settings) it ultimately made more sense to make this a breaking change.

Open work:

  • Adding tests for new code
  • Double check existing tests against new code
  • Check for the existence of files prior to downloading, but should still log the data. For some sites this may save a lot of download traffic.
  • Add job to pipeline to scan script files. May need to change versions to trigger a vulnerability.
  • Update documentation for new test
  • Update settings with test-specific configuration (#54 (closed)).
    • With this move timeout setting under that test
    • Update documentation for new settings and breaking change
  • Implement test passing with failure (#44 (closed)). This will require updating config to allow for test-specific parameters.

Closes #42 (closed), #44 (closed), #54 (closed).

Edited by Aaron Goldenthal

Merge request reports