Findings should be created for Navigations that have no HTTP message

Background

Some vulnerability checks don't check details in a request or response, for example, they may check cookies, console logs, etc.

When a user performs an action on the website, such as clicking a button, Browserker captures the result in a "navigation result". It is possible for a navigation result to not contain any requests/responses, for example, such as when clicking on a button toggles and menu on and off.

The issue #361441 (closed) was raised as a finding created for a navigation result with no request/response caused a panic in Browserker. A short term fix resolved the issue, however, a long-term fix is desirable to ensure that all true positives are detected in the scan.

Proposal

A finding should not require a request and response. Location of the finding used in the report should be the url of the browser at the end of the navigation.

Implementation plan

  • Finding.Request should be considered optional (could be nil)
  • Finding.Response should be considered optional (could be nil)
    • Alternatively, Finding.Request/Response could be replaced with Finding.HTTPMessage
  • Check all usages of Finding.Request/Response to make sure they handle the case when it is not present
  • vulnerabilities[].evidence.request should not be present in the Secure report when request is not present
  • vulnerabilities[].evidence.response should not be present in the Secure report when response is not present
  • vulnerabilities[].location.hostname/method/path should be the URL in the browser at the end of the navigation when there is no request or response. This may need to be a new field on Finding.
  • For the following types, create a finding when there is no request
    • ConsoleEventTextMatcher matchers
    • UntrustedScriptLinkTagsIncludedMatcher
Edited by Seth Berger