thalla/lomavuokraus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OWASP ZAP baseline security scan helper

Browse source
This commit is contained in:
Tero Halla-aho 2025-12-06 18:22:20 +02:00
parent 61fc8dc5ba
commit 682081b932
4 changed files with 71 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
PROGRESS.md
View file

@ -29,6 +29,7 @@
- New testing DB (`lomavuokraus_testing`) holds the previous staging/prod data; the main `lomavuokraus` DB was recreated clean with only the seeded admin user. Migration history was copied, and a schema snapshot lives at `docs/db-schema.sql`. - New testing DB (`lomavuokraus_testing`) holds the previous staging/prod data; the main `lomavuokraus` DB was recreated clean with only the seeded admin user. Migration history was copied, and a schema snapshot lives at `docs/db-schema.sql`.
- Testing environment wiring added: dedicated namespace (`lomavuokraus-test`), deploy wrapper (`deploy/deploy-test.sh`), API host support, and a DNS updater for `test.lomavuokraus.fi` / `apitest.lomavuokraus.fi`. - Testing environment wiring added: dedicated namespace (`lomavuokraus-test`), deploy wrapper (`deploy/deploy-test.sh`), API host support, and a DNS updater for `test.lomavuokraus.fi` / `apitest.lomavuokraus.fi`.
- Access control tightened: middleware now gates admin routes, admin-only pages check session/role, API handlers return proper 401/403, and listing removal is limited to owners/admins (no more moderator overrides). - Access control tightened: middleware now gates admin routes, admin-only pages check session/role, API handlers return proper 401/403, and listing removal is limited to owners/admins (no more moderator overrides).
- Security: added OWASP ZAP baseline helper (`scripts/zap-baseline.sh`) and documentation (`docs/security.html`) for quick unauthenticated scans against test/staging/prod.
- Backend/data: Added Prisma models (User/Listing/ListingTranslation/ListingImage), seed script creates sample listing; DB on Hetzner VM `46.62.203.202`, staging secrets set in `lomavuokraus-web-secrets`. - Backend/data: Added Prisma models (User/Listing/ListingTranslation/ListingImage), seed script creates sample listing; DB on Hetzner VM `46.62.203.202`, staging secrets set in `lomavuokraus-web-secrets`.
- Auth: Register/login/verify flows; session cookie (`session_token`), NavBar shows email+role badge. Roles: USER, ADMIN, USER_MODERATOR (approve users), LISTING_MODERATOR (approve listings). Admin can change roles at `/admin/users`. - Auth: Register/login/verify flows; session cookie (`session_token`), NavBar shows email+role badge. Roles: USER, ADMIN, USER_MODERATOR (approve users), LISTING_MODERATOR (approve listings). Admin can change roles at `/admin/users`.
- Listing flow: create listing (session required), pending/published with admin/moderator approvals; pages for “My listings,” “New listing,” “Profile.” Quick actions tile removed; all actions in navbar. - Listing flow: create listing (session required), pending/published with admin/moderator approvals; pages for “My listings,” “New listing,” “Profile.” Quick actions tile removed; all actions in navbar.

1
docs/index.html
View file

@ -18,6 +18,7 @@
<li><a href="./build.html">Build &amp; Deploy</a></li> <li><a href="./build.html">Build &amp; Deploy</a></li>
<li><a href="./architecture.html">Logical Architecture</a></li> <li><a href="./architecture.html">Logical Architecture</a></li>
<li><a href="./sequences.html">Feature Sequences</a></li> <li><a href="./sequences.html">Feature Sequences</a></li>
<li><a href="./security.html">Security Testing</a></li>
</ul> </ul>
</section> </section>
<section class="card"> <section class="card">

43
docs/security.html Normal file
View file

@ -0,0 +1,43 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<title>Security Testing</title>
<link rel="stylesheet" href="./style.css" />
</head>
<body>
<header>
<h1>Security Testing</h1>
<div class="meta">Quick OWASP ZAP baseline checks against any deployed environment.</div>
</header>
<main class="grid">
<section class="card">
<h2>Baseline scan</h2>
<ul>
<li>Script: <code>scripts/zap-baseline.sh</code></li>
<li>Default target: <code>https://test.lomavuokraus.fi</code> (override with <code>TARGET</code>).</li>
<li>Reports: <code>reports/security/zap-report.html</code> (also JSON/XML).</li>
<li>Example: <code>TARGET=https://staging.lomavuokraus.fi ./scripts/zap-baseline.sh</code></li>
<li>Duration: ~5 minutes by default (<code>TIMEOUT_MINUTES</code> env).</li>
<li>Docker image: <code>owasp/zap2docker-stable</code> (override with <code>ZAP_IMAGE</code>).</li>
</ul>
</section>
<section class="card">
<h2>Auth considerations</h2>
<ul>
<li>The baseline scan is unauthenticated; it covers public pages and APIs.</li>
<li>For authenticated testing, generate a session cookie manually and pass via <code>-z</code> extras in the script or run an active scan with a ZAP context file.</li>
<li>Keep admin creds out of the script; prefer test accounts and the testing environment.</li>
</ul>
</section>
<section class="card">
<h2>Next steps</h2>
<ul>
<li>Add ZAP active scans with context + logged-in session for deeper coverage.</li>
<li>Consider scheduling scans against test env before releases.</li>
<li>Track findings in issues; rerun after auth/role changes.</li>
</ul>
</section>
</main>
</body>
</html>

26
scripts/zap-baseline.sh Executable file
View file

@ -0,0 +1,26 @@
#!/usr/bin/env bash
set -euo pipefail
# Lightweight OWASP ZAP baseline scan.
# Usage: TARGET=https://test.lomavuokraus.fi ./scripts/zap-baseline.sh
TARGET="${TARGET:-https://test.lomavuokraus.fi}"
ZAP_IMAGE="${ZAP_IMAGE:-owasp/zap2docker-stable}"
REPORT_DIR="${REPORT_DIR:-reports/security}"
TIMEOUT_MINUTES="${TIMEOUT_MINUTES:-5}"
mkdir -p "$REPORT_DIR"
echo "Running ZAP baseline against $TARGET (timeout ${TIMEOUT_MINUTES}m)..."
docker run --rm \
-u "$(id -u)":"$(id -g)" \
-v "$PWD/$REPORT_DIR":/zap/wrk \
"$ZAP_IMAGE" zap-baseline.py \
-t "$TARGET" \
-x zap-report.xml \
-r zap-report.html \
-J zap-report.json \
-I \
-m "$TIMEOUT_MINUTES"
echo "Reports written to $REPORT_DIR (zap-report.html, zap-report.xml, zap-report.json)"