Optimize tests for v3 #1007
Optimize tests for v3 #1007
Conversation
…lations Only Package Handlers tests need all package managers installed since they test the fix functionality. Other test suites (Unit, Scan Repository, Scan Pull Request) don't need npm, Python, pipenv, poetry, Mono, dotnet, NuGet, Pnpm, Java, or Conan installations. This will significantly speed up test execution for non-Package Handler test suites.
eyalk007
added
the
safe to test
github-actions
bot
removed
the
safe to test
eyalk007
force-pushed
the
optimize-tests
branch
from
8fa64b5 to
8c06d3a
Compare
Added Go module cache (~/go/pkg/mod) to all integration test jobs: - github-integration - azure-integration (ubuntu, windows, macos) - gitlab-integration (ubuntu, windows, macos) - bitbucket-server-integration (macos) This matches the caching already used in the main tests and Pretest jobs. Subsequent test runs will restore cached Go modules (~5s) instead of re-downloading them (~30-60s).
eyalk007
added
the
safe to test
github-actions
bot
removed
the
safe to test
eyalk007
added
the
safe to test
github-actions
bot
removed
the
safe to test
| ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}- | ||
| ${{ runner.os }}-go- | ||
| # Package managers are only needed for Package Handlers tests (fix functionality) |
There was a problem hiding this comment.
what about integration tests that run Scan-pr and Scan-repo commands and require to perform actual upgrades and dependencies resolutions?
eranturgeman
left a comment
eranturgeman
left a comment
There was a problem hiding this comment.
workflows changes in Frogbot only applied after merge, therefore the changes you've made cannot be validated in the tests execution of this PR (running agains the old yml files)
please validate all tests are passing in your fork
|
📗 Scan Summary
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewUnsafe deserialization in Go occurs when a program deserializes untrusted Vulnerable exampleimport (
"github.com/go-yaml/yaml"
"net/http"
)
func storeHandler(w http.ResponseWriter, r *http.Request) {
var data map[string]interface{}
yaml.Unmarshal([]byte(r.URL.Query().Get("data")), &data) // NOT OK
}This code uses Remediationimport (
"github.com/go-yaml/yaml"
"net/http"
)
func storeHandler(w http.ResponseWriter, r *http.Request) {
var data map[string]interface{}
yaml.UnmarshalStrict([]byte(r.URL.Query().Get("data")), &data) // SAFE
}Using Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Cross-Site Scripting (XSS) is a type of vulnerability where malicious Vulnerable examplefunc serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
fmt.Fprintf(w, "<h1>%s</h1>", message)
}In this example, the RemediationTo mitigate Stored XSS vulnerabilities, always sanitize and encode user func serveMessage(w http.ResponseWriter, r *http.Request) {
db, _ := sql.Open("sqlite3", "test.db")
message := db.QueryRow("SELECT message FROM messages WHERE id = 1")
- fmt.Fprintf(w, "<h1>%s</h1>", message)
+ fmt.Fprintf(w, "<h1>%s</h1>", html.EscapeString(message))
}In the remediation, we've used the Code FlowsVulnerable data flow analysis result
|
3 participants
We dont need to install the package managers anymore
we only need them for the fix part meaning only for hte package manager suite