Add external script test
Add test to check for any external scripts and if found:
- Downloads the script to a local folder (to be saved artifacts for scanning)
- Logs the original script and download location.
This test was originally going to be disabled by default to avoid a breaking change, but with the other changes (especially test-specific settings) it ultimately made more sense to make this a breaking change.
Open work:
-
Adding tests for new code -
Double check existing tests against new code -
Check for the existence of files prior to downloading, but should still log the data. For some sites this may save a lot of download traffic. -
Add job to pipeline to scan script files. May need to change versions to trigger a vulnerability. -
Update documentation for new test -
Update settings with test-specific configuration (#54 (closed)). -
With this move timeout setting under that test -
Update documentation for new settings and breaking change
-
-
Implement test passing with failure (#44 (closed)). This will require updating config to allow for test-specific parameters.
Closes #42 (closed), #44 (closed), #54 (closed).
Edited by Aaron Goldenthal