title,body,link,tags,view_count,is_answered,score,answer_count
Google Home Security Testing,"<p>I want to develop actions for Google Home but would like to know whether user interacting with the device is the same person whose account is linked with my service. As my service will include confidential information and money transfer capabilities as well so don't want the device to be misused by someone to know confidential information or for transferring money. So is there any security measures for this in Google Home?</p>
",https://stackoverflow.com/questions/41457772/google-home-security-testing,['actions-on-google'],103,FALSE,0,1
Integrating security testing to CI pipeline,"<p>Is there anyway that we can run a static analysis on each commit to identify security issues in a web application ? </p>

<p>Web application is built using .Net framework 4.0 
Jenkins is used for CI
I have already gone through Owasp Zap tool. there are two options that i could find,
 1. Writing a selenium script to automate the login for the application and setting up the OWASP Zap in the build server.
 2. Configuring OWASP Zap tools authorization mechanism to login to web application. </p>

<p>I quite like to go with the 2nd approach. </p>
",https://stackoverflow.com/questions/42031621/integrating-security-testing-to-ci-pipeline,"['security', 'web', 'continuous-integration']",314,TRUE,-1,1
How to perform the security testing using selenium?,"<p>I already develop a Selenium code to perform the web application testing. But i need to perform the security testing for the same application. So Please suggest me how to perform the security testing with selenium code .</p>

<p>Please help to integrate the selenium with ZAP.</p>
",https://stackoverflow.com/questions/43601784/how-to-perform-the-security-testing-using-selenium,"['security', 'selenium', 'testing', 'zap']",1165,TRUE,1,1
Is adb tool is used for security testing?,"<p>Is adb tool is used for security testing?</p>

<p>Hi All,
        Is adb tool is used for security testing of mobile applications?
can any one help me out and is it possible to run on ubuntu?</p>
",https://stackoverflow.com/questions/43798348/is-adb-tool-is-used-for-security-testing,"['android', 'android-emulator', 'security-testing']",416,FALSE,-1,1
How to do Pen testing / Security testing on Microservices?,"<p>Wanted to test microservices for security requirements and did some google and found some good blogs e.g URL: <a href=""https://www.imbalife.com/sql-injection"" rel=""nofollow noreferrer"">https://www.imbalife.com/sql-injection</a>.   </p>

<p>Eg.SQL Injection Vulnerable Dorks.
inurl:index.php?id=</p>

<p>How to test if URL don't have any PHP stuff. And check for Vulnerability.
I am new in this security testing area. Please help me.<br>
Thank you</p>
",https://stackoverflow.com/questions/41809373/how-to-do-pen-testing-security-testing-on-microservices,"['testing', 'sql-injection', 'microservices', 'penetration-testing', 'security-testing']",1541,TRUE,0,1
Can SonarQube be used as a Static Application Security Testing (SAST) tool?,"<p>I'm looking for a Static Application Security Testing (SAST) tool and I can't afford the commercial products (eg. Checkmarx). </p>

<p>SonarQube is a great static code analysis tool but I notice that there is only a few rules of the ""Vulnerabilities"" type (""Vulnerabilities"" equals ""Security"", am I right?). </p>

<p>I plan to extend some custom plugins including a lot of vulnerabilities rules (maybe hundreds of rules for C/C++, Java, and other languages that SonarQube supports). </p>

<p>Is that a practicable way to make SonarQube a ""Checkmarx like"" tool? Or is SonarQube suitable for static security testing? (I'm not sure if Sonar Scanner is suitable for scanning security problems)</p>

<p>Thanks a lot!</p>
",https://stackoverflow.com/questions/47471078/can-sonarqube-be-used-as-a-static-application-security-testing-sast-tool,"['sonarqube', 'code-analysis', 'static-analysis', 'sonarqube-scan', 'security-testing']",14755,TRUE,9,4
Set Secure Flag For Cookies In Flask-Security,"<p>I am doing server security testing and at every server security testing website it tells me that cookies are being created without the <code>secure flag</code></p>

<p>The message is specifically:</p>

<pre><code>The cookie is missing the Secure flag, make sure it does not store sensitive information.
</code></pre>

<p>I am using Flask and Flask-Security for creating sessions. I've looked through the docs but cannot find anything on the secure flag. </p>

<p>Does anyone know if this has to be within flask-security or outside? If in flask-security, how do I add this secure flag?</p>
",https://stackoverflow.com/questions/43966087/set-secure-flag-for-cookies-in-flask-security,"['security', 'cookies', 'flask', 'session-cookies', 'flask-security']",474,FALSE,1,0
Checkmarx Integration in Gitlab Continuous Integration,"<p>Is it possible to integrate Checkmarx Static Application Security Testing (SAST) tool into Gitlab Continuous Integration (CI) Pipeline for static security scanning?</p>
",https://stackoverflow.com/questions/45737060/checkmarx-integration-in-gitlab-continuous-integration,"['continuous-integration', 'gitlab', 'checkmarx']",3537,TRUE,4,3
Key Management: Hardcode Encryption Key In AFNetworkingReachibilityManager,"<p>We did review our app for security testing and response we got issue in AFNetworkingReachbilityManager class for Hardcode Encryption Key. Any Idea how to fix this security issue.</p>

<p>Here is the code where they point out hardcode encryption key.</p>

<pre><code>+ (NSSet *)keyPathsForValuesAffectingValueForKey:(NSString *)key {
   if ([key isEqualToString:@""reachable""] || [key 
      isEqualToString:@""reachableViaWWAN""] || [key 
      isEqualToString:@""reachableViaWiFi""]) {
     return [NSSet setWithObject:@""networkReachabilityStatus""];
  }

     return [super keyPathsForValuesAffectingValueForKey:key];
  }
</code></pre>
",https://stackoverflow.com/questions/45078721/key-management-hardcode-encryption-key-in-afnetworkingreachibilitymanager,"['ios', 'encryption', 'fortify', 'afnetworking-3']",1676,FALSE,2,0
How to integrate selenium and ZAP,"<p>I am planning to automate security testing for a web application.
I have the selenium code which is developed using JAVA language, now I need to integrate with ZAP. </p>

<p>Kindly help me how to integrate these two and generate the reports for the same.</p>
",https://stackoverflow.com/questions/47882466/how-to-integrate-selenium-and-zap,"['java', 'selenium', 'security', 'zap', 'zapproxy']",2340,TRUE,1,1
Do not allow cross-domain redirection intentionally – Struts2 web application url redirection issue,"<p>I have developed a web application using JSP + Struts2 + Hibernate with MYSQL as the back-end. While performing security testing of my application URL redirects to cross – domain websites. For an example, I am running my application in Google chrome browser </p>

<p>localhost:8080/test/welcome.action</p>

<p>It works fine. While entering redirect:<a href=""http://google.com"" rel=""nofollow noreferrer"">http://google.com</a> application allowing to redirect google home page instead of application home page or custom page. </p>

<p>localhost:8080/test/welcome.action?redirect:<a href=""http://google.com"" rel=""nofollow noreferrer"">http://google.com</a></p>

<p>The above action should not be allowed in security testing, because hackers can get the data(session information) from my application to some other application.</p>

<p>I need solution to stop above redirect to some other URL. Please advise or suggest me how can I prevent to show my application home page instead of cross-domain page.</p>
",https://stackoverflow.com/questions/44827467/do-not-allow-cross-domain-redirection-intentionally-struts2-web-application-ur,"['java', 'mysql', 'hibernate', 'struts2', 'tomcat7']",231,FALSE,-1,1
SQL injection in GraphQL,"<p>I am working with GraphQL(Apollo GraphQL), Currently, i am doing security testing of my endpoints using owasp security tool(<strong>OWASP ZAP</strong>).
I getting alerted like sql injection in endpoints(<strong>SQL injection may be possible.</strong>).How to resolve sql injection in GraphQL.Any suggestion please ,Thanks in advance.</p>
",https://stackoverflow.com/questions/45518206/sql-injection-in-graphql,"['security', 'graphql', 'owasp', 'apollo-server', 'graphql-java']",1082,FALSE,0,0
out of scope error shown in ajax spider attack in zap,"<p>I am using OWASP ZAP for security testing. I tried to do Ajax spider attack on my admin dashboard page. But in the message, out of scope is shown and browser is also not opening. What shall I do to fix this and open browser and to perform this test?</p>

<p><a href=""https://i.stack.imgur.com/d5mAC.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/d5mAC.png"" alt=""error message""></a></p>
",https://stackoverflow.com/questions/45875420/out-of-scope-error-shown-in-ajax-spider-attack-in-zap,"['owasp', 'zap']",1744,TRUE,1,2
How to enable pulg and hack feature in OWASP ZAP,"<p>I have recently downloaded OWASP ZAP to perform security testing. But there is no option for plug and hack feature so that I can incorporate it with Firefox? Can anyone tell me why is it not there and how can I add it?</p>

<p>ZAP version 2.6.0
Ubuntu 16.04</p>

<p><a href=""https://i.stack.imgur.com/JAecP.png"" rel=""nofollow noreferrer"">No plug and hack feature</a></p>
",https://stackoverflow.com/questions/45815426/how-to-enable-pulg-and-hack-feature-in-owasp-zap,['owasp'],707,TRUE,-2,2
SessionID is not shown in URL,"<p>I would like to have the SessionID visible in the URL (for some security testing, I know it should not be!), so I set the PHP Settings accordingly:</p>

<pre><code>session.use_cookies Off
session.use_only_cookies    Off
session.use_trans_sid   1
</code></pre>

<p>However, when I access my page, I still get no SID in URL and I see the following HTTP Header:</p>

<p>Cookie:PHPSESSID=sr50lafvtu9vkm0dcnc4m4lhm2</p>

<p>What am I missing?</p>
",https://stackoverflow.com/questions/44756989/sessionid-is-not-shown-in-url,"['php', 'apache']",48,FALSE,0,0
Fixing XSS security issue in php,"<p>During security testing I am constantly getting Cross site scripting [stored] issue as-
URL encoded POST input textsize was set to Largest_935538'():;916159
The input is reflected inside <code>&lt;script&gt;</code> tag between single quotes.</p>

<p>Affected file- change.php</p>

<p>After tiresome efforts I could find any clue to resolve, PFB is code for your reference, can someone guide me on fixing this issue-</p>

<pre><code>&lt;?php
include(""global/user_global.php"");
session_cache_limiter('nocache');

$color_array    =   array(""blue"",""brown"",""black"",""high"",""style"");
if(isset($_SESSION[""lang""]))
{
    if($_SESSION[""lang""]==""hindi"")


{
        $logo       =   array(""logo_hindi_blue.png"",""logo_hindi_high.png"");
    }
    else
    {
        $logo       =   array(""logo_eng_blue.png"",""logo_eng_high.png"");
    }
}
else
{
    $logo       =   array(""logo_eng_blue.png"",""logo_eng_high.png"");
}
$referer        =   ""$master_url"";

if(isset($_REQUEST[""font_action""]))

{
    $theme              =   $_REQUEST[""theme""];
    $textsize           =   $_REQUEST[""textsize""];
    if ($textsize=="""")
    {
        $_SESSION[""fonts""]  =   ""Medium"";
    }
    else
    {
        $_SESSION[""fonts""]  =   $textsize;
    }
    if($theme=="""")
    {
        $_SESSION[""theme""]  =   ""style.css"";    
    }
    else
    {
        $_SESSION[""theme""]  =   $theme."".css"";
    }
}
else
{
    $theme          =   $_REQUEST[""theme""];
    $lg             =   $_REQUEST[""lg""];
    $found  =   in_array(""$theme"",$color_array);


if($found)
    {
        if(isset($_SESSION[""theme""]))
        {
            $_SESSION[""theme""]      =   $theme."".css"";
            $_SESSION[""logo""]       =   $logo[$lg];
        }
        else
        {
            $_SESSION[""theme""]      =   ""style.css"";
        }
    }
    else
    {
        $_SESSION[""theme""]      =   ""style.css"";
    }
}
header(""Location: $master_url"");
exit();
?&gt;
</code></pre>
",https://stackoverflow.com/questions/43009463/fixing-xss-security-issue-in-php,"['php', 'security', 'xss']",87,TRUE,-2,1
Prevention from XML injection in angularJS spring project,"<p>I have designed a web based project using spring and hibernate &amp; angularJs. In the security testing which I am completely unaware of I got that there are XML injection vulneribilities especially on GET requests.</p>

<p>There are some of  instances of this issue: </p>

<pre><code>/MyProject/auditlog/getrecords [currentPage JSON parameter]
/MyProject/auditlog/getrecords [fromDate JSON parameter]
/MyProject/auditlog/getrecords [isApp JSON parameter]
</code></pre>

<p>So, I think think it can be solved at front-end angular side?</p>

<p>And how can I fix this security bug. Please help.</p>
",https://stackoverflow.com/questions/45281250/prevention-from-xml-injection-in-angularjs-spring-project,"['xml', 'security', 'code-injection', 'sanitization', 'html-sanitizing']",204,FALSE,0,1
How to return the socket status for the validating the port scanning,"<p>As a part of security testing, I am developing a script which check the connected port in the host and return <code>0</code> if the status is <code>true</code> (if its connected to the port) or else it return some error code.. so I need to include that condition in the below code under the <code>def getPort_on_host()</code> where the <code>result ==</code> should return the connected ports ..</p>

<p>Would be great if anyone can help me  out here...</p>

<pre><code>import socket

class A:

    s= socket.socket(socket.AF_INET,socket.SOCK_STREAM)

    def getAddress():
    host= raw_input(""Enter the Host name :"" )
    result = s.gethostbyname(host)
    return result

    def getPort_on_host():
    portlist =[20,23,80,912,135,445,20]
    for port in portlist:
            result = s.connect_ex((getAddress,port))

            if result ==""""

            print result
            return port
            s.close()

    def getService():
            status = s.getserverbyport(getPOrt_on_host)
            print status
</code></pre>
",https://stackoverflow.com/questions/44054463/how-to-return-the-socket-status-for-the-validating-the-port-scanning,['python'],94,FALSE,1,1
How to decode data from scapy Dot11 Packet,"<p>I am writing a program that captures Dot11 Packets for network security testing, in these captured packets I get data as in the following for example: </p>

<pre><code>&lt;RadioTap  version=0 pad=0 len=36    present=TSFT+Flags+Rate+Channel+dBm_AntSignal+b14+b29+Ext notdecoded=' \x08\x00\x00\x00\x00\x00\x00\xd5~\xbb*\x00\x00\x00\x00\x10\x02\x99\t\xa0\x00\xbd\x00\x00\x00\xbd\x00' |&lt;Dot11  subtype=11L type=Management proto=0L FCfield=retry ID=14849 addr1=48:ee:0c:f4:b7:ea addr2=00:26:82:8e:9a:d4 addr3=48:ee:0c:f4:b7:ea SC=46176 addr4=None |&lt;Dot11Auth  algo=open seqnum=1 status=success |&lt;Dot11Elt  ID=220 len=46 info='7\x94' |&gt;&gt;&gt;&gt;
</code></pre>

<p>I would like to better understand the part that reads:</p>

<pre><code>\x08\x00\x00\x00\x00\x00\x00\xd5~\xbb*\x00\x00\x00\x00\x10\x02\x99\t\xa0\x00\xbd\x00\x00\x00\xbd\x00
</code></pre>

<p>I get these types of packets in many different captures, I want to be able to 'decode' them to read the data. Is there a way to do this, perhaps a code sample?</p>
",https://stackoverflow.com/questions/47228102/how-to-decode-data-from-scapy-dot11-packet,"['python', 'networking', 'scapy', 'network-security']",5451,TRUE,0,3
How to do cross site scripting for Json in soap ui?,"<p>Below is my Json request.</p>

<pre><code>{""description"":""${#TestCase#description}"",""assignedToName"":null,""title"":""${#TestCase#title}"",""priority"":""2""}
</code></pre>

<p>In this description and title are user input field. I am trying to do cross site scripting and SQL Injection for these fields.</p>

<p>When Creating security Testing, i did not see these description and title two properties in the parameters drop down.</p>

<p>It seems that i need to give the Xpath for the json request to do XSS on iteration basis. I have $.description (JsonPath) and /description.. Both not working for me.</p>

<p>How to do that?</p>

<p>Thanks</p>
",https://stackoverflow.com/questions/43753321/how-to-do-cross-site-scripting-for-json-in-soap-ui,['soapui'],614,FALSE,7,1
How a jar can propagate a vulnerability in a web application where it is used?,"<p>I have a Spring MVC web application protected with Spring Security. Life seems so calm until I was forced to do a Static Application Security Testing (SAST) and the tool threw a bunch of security issues. Have a look at here:</p>
<p><a href=""https://i.stack.imgur.com/NiYwl.jpg"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/NiYwl.jpg"" alt=""enter image description here"" /></a></p>
<p>I have gone through all CVEs and got a rough picture about the vulnerabilities. I have a few queries:</p>
<ol>
<li><p>How a web application is vulnerable to such exploitation, when a security framework like (Spring Security) is integrated with it?</p>
</li>
<li><p>Can I ignore all those vulnerabilities since Spring Security might have some sort of workaround for all those vulnerabilities?</p>
</li>
</ol>
",https://stackoverflow.com/questions/46707284/how-a-jar-can-propagate-a-vulnerability-in-a-web-application-where-it-is-used,"['spring', 'spring-mvc', 'spring-security', 'jar']",783,TRUE,12,1
Unable to practice Sql Injection (blind) on DVWA 1.10,"<p>I am practicing for Security Testing. I came across DVWA and I started practicing for Sql Injection. I was doing fine till I started with SQL Injection (blind). No matter which query I try I am not getting the desired result.
For eg : </p>

<p><code>1' and 1=0 union select null,table_name from information_schema.tables#</code> </p>

<p>simply returns <strong><em>User ID exists in the database.</em></strong></p>

<p>I have set the DVWA Security to Low. Also made sure there are no errors on setup page of the application under <strong>Setup Check</strong> section.</p>

<p>Following are environment details:</p>

<p>Operating system: Windows</p>

<p>Backend database: MySQL</p>

<p>PHP version: 5.6.16</p>
",https://stackoverflow.com/questions/45546208/unable-to-practice-sql-injection-blind-on-dvwa-1-10,['sql-injection'],1486,FALSE,0,1
X-Frame-Options Header Not Set in Apache Tomcat 8.5.9,"<p>I am using Apache Tomcat 8.5.9 server for Java Web application with struts2, spring and spring-security. While doing security testing using ""<strong>Zap 2.7.0 security scanning Tool</strong>"" I got following errors in a scanning report of my web application.</p>

<ol>
<li>X-Frame-Options Header Not Set</li>
<li>Web Browser XSS Protection Not Enabled</li>
<li>X-Content-Type-Options Header Missing</li>
</ol>

<p>For this I used the following code in Apache Tomcat 8.5.9 server's <strong>web.xml</strong> file in conf folder. </p>

<pre><code>&lt;filter&gt;
    &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.catalina.filters.HttpHeaderSecurityFilter&lt;/filter-class&gt;
    &lt;async-supported&gt;true&lt;/async-supported&gt; 
    &lt;init-param&gt;
    &lt;param-name&gt;antiClickJackingEnabled&lt;/param-name&gt;
    &lt;param-value&gt;true&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
    &lt;param-name&gt;antiClickJackingOption&lt;/param-name&gt;
    &lt;param-value&gt;SAMEORIGIN&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
    &lt;param-name&gt;xssProtectionEnabled&lt;/param-name&gt;
    &lt;param-value&gt;true&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
    &lt;param-name&gt;blockContentTypeSniffingEnabled&lt;/param-name&gt;
    &lt;param-value&gt;true&lt;/param-value&gt;
    &lt;/init-param&gt;   
&lt;/filter&gt;
&lt;filter-mapping&gt; 
&lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt; 
&lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;    
&lt;/filter-mapping&gt;
</code></pre>

<p>Even after using the above code errors are not getting fixed. But it is working fine when I try to use above code in Apache Tomcat 7.0.5</p>

<p>Can anyone tell what am I missing in Apache Tomcat 8.5.9 server.   </p>
",https://stackoverflow.com/questions/48003553/x-frame-options-header-not-set-in-apache-tomcat-8-5-9,"['java', 'apache', 'security', 'tomcat', 'httpresponse']",8421,TRUE,4,1
Managing long chain of dependencies for vulnerability/bug fixes,"<p>I use gulp in my Node project and I was using gulp-nodemon for running nodemon within which in turn requires some dependencies which inturn requires dependencies and so on.</p>

<p>I was doing some security testing on my project using nsp and found out a vulnerability in my dependency brace-expansion and the resolution was to upgrade my package version to 1.1.7 or later: <a href=""https://nodesecurity.io/advisories/338"" rel=""nofollow noreferrer"">https://nodesecurity.io/advisories/338</a></p>

<p>The dependency tree is like this:</p>

<p><code>↳ gulp-nodemon 2.2.1
 ↳ gulp 3.9.1
  ↳ vinyl-fs 0.3.14
   ↳ glob-stream 3.1.18
    ↳ glob 4.5.3
     ↳ minimatch 2.0.10
      ↳ brace-expansion 1.1.6</code></p>

<p>So, how do I solve such problem cause, I guess I have to coordinate with all the people involved in the chain to fix this and some of them are inactive.</p>

<p>Is there any elegant way to fix these issues involved with chained dependencies?</p>
",https://stackoverflow.com/questions/48012456/managing-long-chain-of-dependencies-for-vulnerability-bug-fixes,"['node.js', 'security', 'npm']",233,TRUE,0,1
Security flag fstack-protector Realm library Android,"<p>I developed an android application and a security team realized a security testing and sent me a vulnerability that doesn't have ""-fstack-protector"" option the Realm library.
the original message:
""stack canaries can greatly increase the difficulty of exploiting a stack buffer overflow because it forces the attacker to gain control of the instruction pointer by some non-traditional means such as corrupting other important variables on the stack.
Built with option -fstack-protector""</p>

<p>ib/x86_64/libtool-checker.so lib/x86_64/librealm-jni.so lib/x86/libcrashlytics-envelope.so lib/x86/librealm-jni.so 
lib/armeabi/librealm-jni.so lib/armeabi-v7a/librealm-jni.so lib/arm64-v8a/librealm-jni.so lib/mips/librealm- jni.so</p>

<p>my question is if a reason why doesn't it have it? or what can i do? or if 
exists a risk?</p>
",https://stackoverflow.com/questions/43615355/security-flag-fstack-protector-realm-library-android,"['java', 'android', 'realm']",1292,TRUE,3,1
Use @WithMockUser (with @SpringBootTest) inside an oAuth2 Resource Server Application,"<p><strong>Environment</strong>:
I have a spring boot based microservice architecture application consisting of multiple infrastructural services and resource services (containing the business logic). Authorization and authentication is handled by an oAuth2-Service managing the user entities and creating JWT tokens for the clients.</p>

<p>To test a single microservice application in its entirety i tried to build tests with <em>testNG</em>, <em>spring.boot.test</em>, <em>org.springframework.security.test</em> ...</p>

<pre><code>@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.MOCK, properties = {""spring.cloud.discovery.enabled=false"", ""spring.cloud.config.enabled=false"", ""spring.profiles.active=test""})
@AutoConfigureMockMvc
@Test
public class ArtistControllerTest extends AbstractTestNGSpringContextTests {

  @Autowired
  private MockMvc mvc;

  @BeforeClass
  @Transactional
  public void setUp() {
    // nothing to do
  }

  @AfterClass
  @Transactional
  public void tearDown() {
    // nothing to do here
  }

  @Test
  @WithMockUser(authorities = {""READ"", ""WRITE""})
  public void getAllTest() throws Exception {

    // EXPECT HTTP STATUS 200
    // BUT GET 401
    this.mvc.perform(get(""/"")
            .accept(MediaType.APPLICATION_JSON))
            .andExpect(status().isOk())
  }
}
</code></pre>

<p>where the security (resource server) config is the following</p>

<pre><code>@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

  // get the configured token store
  @Autowired
  TokenStore tokenStore;

  // get the configured token converter
  @Autowired
  JwtAccessTokenConverter tokenConverter;

  /**
   * !!! configuration of springs http security !!!
   */
  @Override
  public void configure(HttpSecurity http) throws Exception {
      http
            .csrf().disable()
            .authorizeRequests()
            .antMatchers(""/**"").authenticated();
  }

  /**
   * configuration of springs resource server security
   */
  @Override
  public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    // set the configured tokenStore to this resourceServer
    resources.resourceId(""artist"").tokenStore(tokenStore);
  }

}
</code></pre>

<p>and the following method based security check annotated inside the controller class</p>

<pre><code>@PreAuthorize(""hasAuthority('READ')"")
@RequestMapping(value = ""/"", method = RequestMethod.GET)
public List&lt;Foo&gt; getAll(Principal user) {
    List&lt;Foo&gt; foos = fooRepository.findAll();
    return foos;
}
</code></pre>

<p>I thought that would work but when running the test i only get an assertion error </p>

<pre><code>java.lang.AssertionError: Status 
Expected :200
Actual   :401
</code></pre>

<p><br>
<strong>Question</strong>:
Is there something totally obvious that i am doing wrong? Or is @WithMockUser not going to work with @SpringBootTest and @AutoConfigureMockMvc in an oAuth2 environment? If this is the case... what would be the best approach for testing route and method based security configurations as part of such an (integration) test like this one?</p>

<p><br>
<strong>Appendix</strong>:
I also tried different approaches like something like the following... but it led to the same result :(</p>

<pre><code>this.mvc.perform(get(""/"")
        .with(user(""admin"").roles(""READ"",""WRITE"").authorities(() -&gt; ""READ"", () -&gt; ""WRITE""))
        .accept(MediaType.APPLICATION_JSON))
</code></pre>

<p><strong>see</strong>:<br>
<a href=""http://docs.spring.io/spring-security/site/docs/current/reference/html/test-method.html"" rel=""noreferrer"">spring security testing</a><br>
<a href=""https://spring.io/blog/2016/04/15/testing-improvements-in-spring-boot-1-4"" rel=""noreferrer"">spring boot 1.4 testing</a><br></p>
",https://stackoverflow.com/questions/41824885/use-withmockuser-with-springboottest-inside-an-oauth2-resource-server-applic,"['java', 'spring-mvc', 'spring-boot', 'spring-security', 'spring-test-mvc']",29477,TRUE,20,3
Anchor hidden text box ontop of visible text box in html,"<p>I'm doing some security testing of a website, and I'm testing specifically for UI redressing that involves an underlying website contained in an iframe with a hidden form on top of the website. The idea is that a hidden textbox would overlay a real textbox in the website (with the goal of a 3rd party obtaining this information). I'm having trouble lining up my hidden objects with the objects that are actually on the web page. Is there some sort of anchoring option in HTML or should I manually include breaks and line it up?</p>

<p>Thank you!</p>

<p><strong>*Edit:</strong> Code below - the opacity at this moment is irrelevant and would be changed once I get them lined up correctly. On the webpage itself are two text boxes with a submit button below them, and I want my text boxes (textbox1 and textbox2) and the submit button to line up with those on the real webpage.</p>

<p><div class=""snippet"" data-lang=""js"" data-hide=""false"" data-console=""true"" data-babel=""false"">
<div class=""snippet-code"">
<pre class=""snippet-code-html lang-html prettyprint-override""><code>&lt;div style=""opacity:0.9; position:absolute; top:0; left:0; width:99%; height:99%; z-index=2""&gt;
  &lt;iframe src=""http://website-url-goes-here.com"" width=""100%"" height=""100%""&gt;&lt;/iframe&gt;
&lt;/div&gt;

&lt;div style=""opacity:0.5; z-index=1""&gt;
  &lt;form action=""test.php"" method=""post""&gt;
    &lt;input text=""	"" name=""textbox1""&gt;
    &lt;BR&gt;
    &lt;input text=""	"" name=""textbox2""&gt;
    &lt;BR&gt;
    &lt;input type=""submit"" value=""submit""&gt;
  &lt;/form&gt;
&lt;/div&gt;</code></pre>
</div>
</div>
</p>
",https://stackoverflow.com/questions/44933341/anchor-hidden-text-box-ontop-of-visible-text-box-in-html,"['html', 'css', 'iframe', 'clickjacking']",173,FALSE,0,0
How to set up ZAP plugin in Jenkins,"<p>I have a problem on Zap plugin of Jenkins. Assume I have my selenium UI testing code, it will launch a browser and set a proxy automatically. What I need is to launch the test from Jenkins, and use the zap plugin to open the zap proxy and generate report.</p>

<p>The process in Jenkins should be :
1. Open ZAP proxy, add alert filter to ZAP.
2. Execute UI test (which will go through the ZAP proxy automatically)
3. ZAP generate report and send back to Jenkins.
4. Shut down ZAP proxy.</p>

<p>My confusion is when I use the zap plugin in Jenkins, there is a <strong>starting point</strong> which is necessary to put. But I don't want an active scanning, I only need a passive scanning from what go through the zap proxy by UI test. Is there a way to walk around it?</p>

<p>I found another way by using ZAP API to do the job <a href=""https://medium.com/@PrakhashS/security-testing-for-apis-using-zap-5df8ec07a131"" rel=""nofollow noreferrer"">https://medium.com/@PrakhashS/security-testing-for-apis-using-zap-5df8ec07a131</a>. But I don't manage to make a alert filter by API. Can someone help?</p>

<p>I am newbie of Jenkins, I would like to know which way is proposed to meet my need. By executing zap from zap plugin, or by executing shell from zap API?</p>

<p>Thank you!</p>
",https://stackoverflow.com/questions/43887581/how-to-set-up-zap-plugin-in-jenkins,"['selenium', 'jenkins', 'zap']",1485,TRUE,0,2
springSecurityFilterChain bean not found using MockMVC and @ComponentScan,"<p>I'm testing a spring rest controller using spring MockMVC.
I am able to execute mock http requests and verify the response.
My setup autowires the WebApplicationContext: </p>

<pre><code>@RunWith(SpringRunner.class)
@WebAppConfiguration
@ContextConfiguration
public class MyTestClass {

@Autowired
private WebApplicationContext webAppContext;

private MockMvc mockMvc;

@Before
public void setup() {
    this.mockMvc = MockMvcBuilders.webAppContextSetup(this.webAppContext)
            .apply(springSecurity()).build();
}
</code></pre>

<p>To tell MockMVC what controllers to initialize and add to the context I have an internal config class:</p>

<pre><code>@Configuration
@ComponentScan(
        basePackages = {""com.acme""},
        useDefaultFilters = false,
        includeFilters = {@ComponentScan.Filter(type = FilterType.ASSIGNABLE_TYPE, value={MyRestController.class, MyRestControllerDependency.class})
        })
@EnableWebMvc
static class MyTestClassConfig implements WebMvcConfigurer {

    @Bean
    public MyClassRepository myClassRepository() {
        return Mockito.mock(MyClassRepository.class);
    }
</code></pre>

<p>And this works like a charm. MockMVC spins up a container with a context that loaded MyRestController and serves the urls mapped by MyRestController.
Now, some of MyRestControllers methods are annotated with: <code>@PreAuthorize(""hasAuthority('ADMINISTRATOR')"")</code> so the next step is to test that.</p>

<p>Reading the Integration part of the Spring security testing guide
<a href=""https://docs.spring.io/spring-security/site/docs/current/reference/html/test-mockmvc.html#test-mockmvc-setup"" rel=""nofollow noreferrer"">spring security and test-mockmvc</a>
 it seems all I should do is call the org.springframework.security.test.web.servlet.setup.springSecurity() in the MockMvcBuilders <code>.apply()</code> function calls. </p>

<p>This does not work, I get:</p>

<pre><code>java.lang.IllegalStateException: springSecurityFilterChain cannot be null. Ensure a Bean with the name springSecurityFilterChain implementing Filter is present or inject the Filter to be used.
</code></pre>

<p>I tried adding a bean definition to my internal config class like so:</p>

<pre><code>    Filter springSecurityFilterChain() {
        return new FilterChainProxy();
    }
</code></pre>

<p>While this does provide a springSecurityFilterChain, the instance is empty and when I run the test I get a NPE:</p>

<pre><code>java.lang.NullPointerException
at org.springframework.security.web.FilterChainProxy.getFilters(FilterChainProxy.java:224)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
</code></pre>

<p>Which, is understandable, by instantiating the FilterChainProxy directly, it is indeed empty.</p>

<p>I suspect I need to configure my component scan to include springs' instances of the FilterChainProxy. <em>If</em> that is the issue, I don't know what classes I should include. I have tried including all the classes:</p>

<pre><code>        includeFilters = {@ComponentScan.Filter(type = FilterType.ASSIGNABLE_TYPE, value={TenantAPI.class, TenantManager.class}),
                          @ComponentScan.Filter(type = FilterType.REGEX, pattern=""^org\\.springframework\\.security.*"")})
</code></pre>

<p>But this gives the same error: ""Ensure a Bean with the name springSecurity.."" as when I run the test without the additional Regex filter. </p>

<p>Does anyone know how I can get the springSecurityFilterChain when I am being picky with the internal classes I let MockMVC instantiate?  </p>
",https://stackoverflow.com/questions/46936469/springsecurityfilterchain-bean-not-found-using-mockmvc-and-componentscan,"['java', 'spring', 'unit-testing', 'spring-mvc', 'spring-security']",3488,TRUE,2,1
Zap Vaadin setup issues,"<p>Being absolutely new to security testing, I am trying to run basic steps and then trying to run a spider and active scan. I have seen couple of videos from <code>owasp</code> &amp; <code>youtube</code> and tried to make sense of the included ZAP documentation. However, I don't think ZAP is logged in while making the spider crawl or active scans.</p>
<p>Mine is a <code>Java</code> + <code>Vaadin &amp; Spring</code> based application and the POST URL's don't change on making any kind of request. Just the request parameters change. POST URL's are always</p>
<blockquote>
<p>http://example.com/UIDL/?v-uiId=0</p>
</blockquote>
<p>I have used</p>
<ul>
<li>Set Active Session under HTTP session, before running the spider/active scan</li>
<li>have setup the context(though very few URL's appear under Sites),</li>
<li>I have also tried to update structure parameter with words like &quot;page&quot;, &quot;UIDL&quot; etc. which i could see in the URL's</li>
<li>I have also tried to exclude logout URL, but since all the POST URL's are the same, the spider and active scan don't really do anything, in that case.</li>
<li>On right clicking i got an option to select the request as Form based Authentication.</li>
</ul>
<p>I have tried that as well, however, it populates the &quot;Login Request POST data&quot; with vaues like</p>
<blockquote>
<p>12929ddf-5d7f-4264-b810-2fa8f38eca6f[[&quot;597&quot;,&quot;v&quot;,&quot;v&quot;,[&quot;pagelength&quot;,[&quot;i&quot;,&quot;28&quot;]]],[&quot;597&quot;,&quot;v&quot;,&quot;v&quot;,[&quot;firstToBeRendered&quot;,[&quot;i&quot;,&quot;0&quot;]]],[&quot;597&quot;,&quot;v&quot;,&quot;v&quot;,[&quot;lastToBeRendered&quot;,[&quot;i&quot;,&quot;26&quot;]]],[&quot;597&quot;,&quot;v&quot;,&quot;v&quot;,[&quot;reqfirstrow&quot;,[&quot;i&quot;,&quot;15&quot;]]],[&quot;597&quot;,&quot;v&quot;,&quot;v&quot;,[&quot;reqrows&quot;,[&quot;i&quot;,&quot;12&quot;]]]]</p>
</blockquote>
<p>and fills the username/password fields with exactly the same.</p>
<p>One last thing, do we really need to disable the <code>XSRF</code> to be able to use ZAP properly with <code>Java/Vaadin</code> applications?</p>
<p>I am simply trying to get it working and then continue learning from there. Would appreciate if anyone can please help me with the correct setup.</p>
<p><a href=""https://i.stack.imgur.com/9Hzop.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/9Hzop.png"" alt=""enter image description here"" /></a></p>
",https://stackoverflow.com/questions/41605847/zap-vaadin-setup-issues,"['authentication', 'owasp', 'zap']",71,FALSE,0,0
Why does my synchronous jQuery AJAX callback not work?,"<p>I want learn about jQuery AJAX using callbacks. So I create this as example.</p>

<pre><code>&lt;?php 
  sleep($_POST['sleep']);
  echo 'sleep for '.$_POST['sleep'] .'sec';
?&gt;
</code></pre>

<pre class=""lang-js prettyprint-override""><code>$(function () {
  var timer = [5,2,3,1,4];

  function sleep(timer) {
    $.ajax({
      url: 'ajax.php',
      data: { sleep: timer },
      type: 'post',
      success: function(d){
        console.log(d);
      },
      error: function(d){
        console.log(d);
      }
    });
  } 

  $('#ajax').click(function(){
    $.each(timer, function(i, e) {
      sleep(e);
    })
  });
});
</code></pre>

<p>Result: <code>1,2,3,4,5</code>
What I want is : <code>5,2,3,1,4</code> (synchronous)</p>

<p>I know I can using <code>async: false;</code> but this will hang up my browser and this is deprecated too. So I want to learn to doing sync using callback</p>

<p>Here is my fail script:</p>

<pre><code>&lt;script src=""http://code.jquery.com/jquery-1.12.4.js"" type=""text/javascript""&gt;&lt;/script&gt;
&lt;script lang=""javascript"" type=""text/javascript""&gt;
$(function () {
  var timer = [5,2,3,1,4];

  $.each(timer, function(i, e) {
    sleep(e, function(d) {
      console.log(d);
    });
  });

  function sleep(sleepTimer, callback) {
    $.ajax({
      url: 'ajax.php',
      data: { sleep: sleepTimer },
      type: 'post',
      success: callback,
      error: function(data){
        console.log(data);
      }
    });
  } 
});
&lt;/script&gt;
</code></pre>

<p>Result: <code>1,2,3,4,5</code> instead <code>5,2,3,1,4</code></p>

<p>What am I doing wrong?</p>

<p><strong>UPDATE:</strong>
Thanks to people who remind me how bad is this. But i dont have any choice right now. My friends need my help to edit his drupal page. He only have admin previledge (not sysadmin). <strong>i only can edit view but cannot edit the controllers</strong>. why?</p>

<ol>
<li>only headquarters IT staff who allowed to do that.</li>
<li>need bureaucracy and administration (user requirement, meeting, Quality Assurance [security testing + stress test). and the funny thing is, they check all the apps, not just the page which will affected by my script change only</li>
<li>need time. 1 month is the fastest for non security change</li>
</ol>

<p>hei.. this sounds funny right? even you just add 1 space, we need number 2 requirement that was they (headquarters staff) said. this true story. i know this because i'm in the same ministry with him.</p>

<p>the script is just download single file by click (of hundred), my friend wants me to add checkbox to allow his team to batch download. i can add checkbox, and download them by sequence (this is what i trying to do with synchronous ajax). but since this will hang up their browser, so i need the right way to doing this.</p>

<p>i have 2 choice here: using phantomjs (medium) or synchronous ajax (easy)</p>

<ul>
<li>1st reason: since he will not pay me, ofc i choose the easy path. </li>
<li>2nd reason: i always avoid to use sync ajax as possible, but now i want to know how to doing sync ajax using callbacks.</li>
</ul>
",https://stackoverflow.com/questions/47555533/why-does-my-synchronous-jquery-ajax-callback-not-work,"['jquery', 'ajax', 'synchronous']",267,TRUE,0,1
