oshp / oshp-validator Goto Github PK

Describe the bug
A clear and concise description of what the bug is.

Expected behavior
An alignment between this validator and the OWASP public recommendations.

Screenshots
If applicable, add screenshots to help explain your problem.

See here:
used by OSHP validator: https://raw.githubusercontent.com/OWASP/www-project-secure-headers/master/ci/headers_add.json
OWASP recommendations: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#recommendation_6

Additional context
Recommendations of OSHP-validator should be aligned with the "official" OWASP recommendations here: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#recommendation_6

When using this tool against my company's website, I noticed that X-Frame-Options fails unless the header explicitly matches the literal value deny. I think this should be relaxed a bit to also succeed on DENY, as this is a valid option and matches more directly the variable outlined in the original RFC.

Changing this assertion to a ShouldBeIn to succeed on both values would be the best option in my mind. I will go ahead and open a PR to change this assertion

ShouldEqual "max-age=31536000 ; includeSubDomains"

should be changed to

ShouldEqual "max-age=31536000; includeSubDomains"

without the space.

IIS sends it without space, Mozilla documentation describes the syntax without space characeter as well:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

Describe the bug

Currently the test suite is not a valid YAML file, due to missing quoting of variables.

To Reproduce
Steps to reproduce the behavior:

1. Go to e.g. https://www.yamllint.com/
2. Paste test_suite.yml
3. Click Go button

Expected behavior

In case the file is valid YAML, we can script updates on it to adapt to specific needs while still receiving upstream updates. Also, formatting in IDE seems not to work on an invalid file.

Screenshots

Desktop (please complete the following information):
N/A

Smartphone (please complete the following information):
N/A

Additional context
N/A