Skip to content

DAST Site validation - Model Layer - Backend

Summary

create new model called dast_site_token.

   Column       |           Type           | Collation | Nullable |                Default                 | Storage  | Stats target | Description
----------------+--------------------------+-----------+----------+----------------------------------------+----------+--------------+-------------
 id             | bigint                   |           | not null | nextval('dast_sites_id_seq'::regclass) | plain    |              |
 project_id     | bigint                   |           | not null |                                        | plain    |              |
 token          | text                     |           | not null |                                        | extended |              |
 url            | text                     |           | not null |                                        | extended |              |
 expired_at     | timestamp with time zone |           | not null |                                        | plain    |              |
 created_at     | timestamp with time zone |           | not null |                                        | plain    |              |
 updated_at     | timestamp with time zone |           | not null |                                        | plain    |              |
  • token is a uuidv4 and will have a uniqueness constraint
  • expired_at is timestamp indicating when the token was used
  • url is th eurl to be validated

create new model called dast_site_validation:

   Column                    |           Type           | Collation | Nullable |                Default                 | Storage  | Stats target | Description
-----------------------------+--------------------------+-----------+----------+----------------------------------------+----------+--------------+-------------
 id                          | bigint                   |           | not null | nextval('dast_sites_id_seq'::regclass) | plain    |              |
 project_id                  | bigint                   |           | not null |                                        | plain    |              |
 dast_site_token_id          | bigint                   |           | not null |                                        | plain    |              |
 domain                      | text                     |           | not null |                                        | extended |              |
 validation_strategy         | text                     |           | not null |                                        | extended |              |
 validation_started_at       | timestamp with time zone |           |          |                                        | plain    |              |
 validation_passed_at        | timestamp with time zone |           |          |                                        | plain    |              |
 validation_failed_at        | timestamp with time zone |           |          |                                        | plain    |              |
 validation_last_retried_at  | timestamp with time zone |           |          |                                        | plain    |              |
 created_at                  | timestamp with time zone |           | not null |                                        | plain    |              |
 updated_at                  | timestamp with time zone |           | not null |                                        | plain    |              |
  • status will be computed based on result of values of validation_started_at, validation_passed_at and validation_failed_at
  • domain is the hostname that has been confirmed as being owned
  • validation_strategy will determine how a dast_site is validated (e.g. metadata, file, headers, etc) and may use a different representation other than text e.g. int via enum

extend dast_site to include nullable dast_site_validation_id:

    Column                |           Type           | Collation | Nullable |                Default                 | Storage  | Stats target | Description
 -------------------------+--------------------------+-----------+----------+----------------------------------------+----------+--------------+-------------
  id                      | bigint                   |           | not null | nextval('dast_sites_id_seq'::regclass) | plain    |              |
  project_id              | bigint                   |           | not null |                                        | plain    |              |
+ dast_site_validation_id | bigint                   |           |          |                                        | plain    |              |
  created_at              | timestamp with time zone |           | not null |                                        | plain    |              |
  updated_at              | timestamp with time zone |           | not null |                                        | plain    |              |
  url                     | text                     |           | not null |                                        | extended |              |
  • dast_site_validation_id is nullable to indicate that validation is not always necessary (e.g. passive scan case)

Implementation Plan

  • create dast_site_token
  • create dast_site_validation
  • extend dast_site to have dast_site_validation_id (+ associations)
  • add computed status to dast_site_validation
Edited by Philip Cunningham