title,body,link,tags,view_count,is_answered,score,answer_count
How to do security testing for API,"<p>I have API like </p>

<p>""/getXXXX?ABC=X7TRYUV&amp;Ab_DEF=true&amp;Ab_XYZ=true&amp;Ab_ExZ=ZXTY""</p>

<p>How can I check the vulnerability of the request parameters?</p>

<p>What type of strings  I can pass?</p>

<p>I ran the API in Wapiti and SQLMAP tool but found no issue.
manually i have tested it with by manipulating ""Ab_ExZ=ZXTY"" to 'CHR(91%2d1)'XTY</p>

<p>and It filter out the result as correct parameter where it should not filter out.</p>

<p>Thanks,
Bibek</p>
",https://stackoverflow.com/questions/59371162/how-to-do-security-testing-for-api,"['api', 'security', 'sql-injection', 'sqlmap', 'wapiti']",463,False,-3,1
"Can we replace the Static application security testing SAST Tool like (Fortify, Checkmarx and IBM Appscan) with SonarQube","<p>Can we replace the Static application security testing SAST Tool like (Fortify, Checkmarx and IBM Appscan) with SonarQube.</p>

<p>As per the SonarQube Roadmap Docs 8.1 (<a href=""https://docs.sonarqube.org/latest/"" rel=""nofollow noreferrer"">https://docs.sonarqube.org/latest/</a>) says it covered all the security rules originated from establish standard: CWE, SANS Top 25, and OWASP Top 10.  </p>
",https://stackoverflow.com/questions/59464809/can-we-replace-the-static-application-security-testing-sast-tool-like-fortify,"['sonarqube', 'owasp', 'fortify', 'checkmarx']",878,True,3,2
burp site displays the ajax call url of WebAPI and its paramters,"<p>I have created a ASP.Net MVC 5 application which includes WebAPI. Web API will be called via JS file by  passing url, parameters and result will be JSON.</p>

<p>While doing security testing in burp site tool the WebAPI URL, methods and parameters are displayed.</p>

<p>Kindly help me to not display the URL, methods &amp; parameters in security testing.</p>

<p>Thanks in advance.</p>

<p>This is happen in the security testing tool burpsuite.</p>

<p>WebAPI Controller method:</p>

<pre><code>[AcceptVerbs(""GET"")]
public JToken GetValues(string Code)
{
            return JToken.FromObject(TestManager.Instance.GetValues(Code));
        }
</code></pre>

<p>WebAPI call using JS File:</p>

<pre><code>Service = {
    // All Ajax function call
    getData: function (url, dataType, parameters, async, type) {
        var GridData = '';

        $.ajax({
            //url: url, dataType: dataType, type: type, data: JSON.stringify(parameters), async: async, success: function (data) {
            //    GridData = data;
            //},
            url: url, dataType: dataType, type: type, data: parameters, async: async, success: function (data) {
                GridData = data;
            },
            //error: function (error) {
            //    alert('Error occured');
            //}
            error: function (xhr, ajaxOptions, thrownError) {
                alert(xhr.responseJSON.ExceptionMessage);
            }
        });
        return GridData;
    }
}
</code></pre>

<p>Controller JS file calls the WebAPI JS page:</p>

<pre><code>var IsExists = Service.getData(window.rootUrl + 'api/MasterApi/GetValues', 'json', { Code: Code }, false, 'GET');
</code></pre>
",https://stackoverflow.com/questions/55495191/burp-site-displays-the-ajax-call-url-of-webapi-and-its-paramters,"['c#', 'asp.net-mvc', 'asp.net-web-api']",208,False,0,0
Selenium WebDriver IE Browser open display security setting page and closed,"<p>My automation testing for IE display security testing page and closed. What is the problem? </p>

<pre><code>    System.setProperty(""webdriver.ie.driver"", System.getProperty(""user.dir"") + "".//src//driver//IEDriverServer.exe"");
        DesiredCapabilities capabilities = DesiredCapabilities.internetExplorer();
        // this line of code is to resolve protected mode issue capabilities.setCapability(InternetExplorerDriver.INTRODUCE_FLAKINESS_BY_IGNORING_SECURITY_DOMAINS, true);
        capabilities.setCapability(InternetExplorerDriver.INTRODUCE_FLAKINESS_BY_IGNORING_SECURITY_DOMAINS, true);
        capabilities.setCapability(InternetExplorerDriver.IGNORE_ZOOM_SETTING, true);
        capabilities.setCapability(CapabilityType.ACCEPT_SSL_CERTS, true);

        driver = new InternetExplorerDriver(capabilities);
        driver.get(""https://10.204.137.86:5111/prweb/PRWebLDAP3/"");
</code></pre>

<p>Please help. </p>
",https://stackoverflow.com/questions/55410406/selenium-webdriver-ie-browser-open-display-security-setting-page-and-closed,"['java', 'selenium']",35,False,0,0
SOAP exception while using ZAP,"<p>I am using ZAP software for security testing on my system which has centos 7 configured. The issue is the software can not attack on the url and has error below -</p>

<pre><code>19713 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Spider initializing...
19740 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Starting spider...
43779 [ZAP-SpiderThreadPool-0-thread-1] INFO 
org.zaproxy.zap.spider.Spider  - Spidering process is complete. 
Shutting down...
43780 [ZAP-SpiderShutdownThread-0] INFO 
org.zaproxy.zap.extension.spider.SpiderThread  - Spider scanning 
complete: true
46259 [ZAP-QuickStart-AttackThread] ERROR 
 org.zaproxy.zap.ZAP$UncaughtExceptionLogger  - Exception in 
 thread ""ZAP-QuickStart-AttackThread""
 java.lang.NoClassDefFoundError: javax/xml/soap/SOAPException
    at java.base/java.lang.Class.getDeclaredConstructors0(Native 
  Method)
    at java.base/java.lang.Class.privateGetDeclaredConstructors(Class.java:3138)
    at java.base/java.lang.Class.getConstructor0(Class.java:3343)
    at java.base/java.lang.Class.getConstructor(Class.java:2152)
    at org.zaproxy.zap.control.AddOnLoaderUtils.loadAndInstantiateClassImpl(AddOnLoaderUtils.java:111)
    at org.zaproxy.zap.control.AddOnLoaderUtils.loadDeclaredClasses(AddOnLoaderUtils.java:151)
    at org.zaproxy.zap.control.AddOnLoaderUtils.getActiveScanRules(AddOnLoaderUtils.java:177)
    at org.zaproxy.zap.control.AddOnLoader.getActiveScanRules(AddOnLoader.java:791)
    at org.parosproxy.paros.core.scanner.PluginFactory.initPlugins(PluginFactory.java:100)
    at org.parosproxy.paros.core.scanner.PluginFactory.getLoadedPlugins(PluginFactory.java:132)
    at org.parosproxy.paros.core.scanner.PluginFactory.loadAllPlugin(PluginFactory.java:398)
    at org.zaproxy.zap.extension.ascan.ScanPolicy.&lt;init&gt;(ScanPolicy.java:31)
    at org.zaproxy.zap.extension.ascan.PolicyManager.loadPolicy(PolicyManager.java:142)
    at org.zaproxy.zap.extension.ascan.PolicyManager.loadPolicy(PolicyManager.java:129)
    at org.zaproxy.zap.extension.ascan.PolicyManager.getDefaultScanPolicy(PolicyManager.java:205)
    at org.zaproxy.zap.extension.ascan.ActiveScanController.startScan(ActiveScanController.java:161)
    at org.zaproxy.zap.extension.ascan.ExtensionActiveScan.startScan(ExtensionActiveScan.java:273)
    at org.zaproxy.zap.extension.ascan.ExtensionActiveScan.startScan(ExtensionActiveScan.java:238)
    at org.zaproxy.zap.extension.ascan.ExtensionActiveScan.startScan(ExtensionActiveScan.java:234)
    at org.zaproxy.zap.extension.quickstart.AttackThread.run(AttackThread.java:143)
 Caused by: java.lang.ClassNotFoundException
    at org.zaproxy.zap.control.AddOnClassLoader.findClass(AddOnClassLoader.java:256)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:588)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
    ... 20 more
</code></pre>
",https://stackoverflow.com/questions/54549176/soap-exception-while-using-zap,"['owasp', 'zap']",380,True,1,1
Bluetooth Low Energy fuzzing,"<p>Is there any existing SW for fuzzing BLE (Bluetooth Low Energy) gadgets from Windows/linux?</p>

<p>I only found the following, but it's not free:
<a href=""https://www.synopsys.com/software-integrity/security-testing/fuzz-testing/defensics.html?fs=bluetooth"" rel=""nofollow noreferrer"">https://www.synopsys.com/software-integrity/security-testing/fuzz-testing/defensics.html?fs=bluetooth</a></p>
",https://stackoverflow.com/questions/54584087/bluetooth-low-energy-fuzzing,['bluetooth-lowenergy'],1006,True,2,1
"Can we replace the Static application security testing SAST Tool like (Fortify, Checkmarx and IBM Appscan) with SonarQube","<p>Can we replace the Static application security testing SAST Tool like (Fortify, Checkmarx and IBM Appscan) with SonarQube.</p>

<p>As per the SonarQube Roadmap Docs 8.1 (<a href=""https://docs.sonarqube.org/latest/"" rel=""nofollow noreferrer"">https://docs.sonarqube.org/latest/</a>) says it covered all the security rules originated from establish standard: CWE, SANS Top 25, and OWASP Top 10.  </p>
",https://stackoverflow.com/questions/59464809/can-we-replace-the-static-application-security-testing-sast-tool-like-fortify,"['sonarqube', 'owasp', 'fortify', 'checkmarx']",878,True,3,2
Request tampering over SSL using man-in-the-middle attack,"<p>I am familiar with SSL/TLS and its mechanism to protect data sent over HTTP between the browser and the web server.  One of the issues identified by my security testing team is <strong>request tampering over SSL</strong> where they were able to modify the HTTP request payload of a POST request using <strong>man-in-the-middle attack</strong>.  The browser obviously did show a certificate validity warning and it was ignored.  </p>

<p>In my opinion, the application shouldn't handle or remediate such request tampering scenarios because SSL/TLS takes care of it.  Server side validation of data that matches any client side validation should suffice to ensure that the HTTP payload is valid.</p>

<p>So my question is basically to confirm my understanding about this.  Is request tampering using man-in-the-middle attack over SSL a valid security testing scenario? And should an application do any specific request encoding to protect from such attacks.</p>
",https://stackoverflow.com/questions/56954968/request-tampering-over-ssl-using-man-in-the-middle-attack,"['security', 'penetration-testing']",118,False,1,1
SSL : Certifcate Verify failed using Python Requests library,"<p>I am using owasp zap for security testing and i have made the following changes to the requests  </p>

<pre><code>requests.put(url=request_url, json=payload, headers=headers, proxies=PROXY, verify=CERT_PATH) 
</code></pre>

<p>where the CERT_PATH points to the directory of ZAP dynamic SSL Certificate. But I am getting Exception: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed. I tried reading the answers in stackoverflow but nothing useful. I dont have much background in security I am trying to read stuff but any help would be appreciated.</p>
",https://stackoverflow.com/questions/55424695/ssl-certifcate-verify-failed-using-python-requests-library,"['security', 'openssl', 'python-requests', 'ssl-certificate']",103,False,1,0
Angular application security error: Sanitizing unsafe style value,"<p>In my angular app, initially, I used <code>bypassSecurityTrustStyle(value: string)</code> and it worked but in security testing of my application, it gave error <code>Angular Usage of Unsafe DOM Sanitizer</code>. </p>

<p>In this <a href=""https://netbasal.com/angular-2-security-the-domsanitizer-service-2202c83bd90"" rel=""nofollow noreferrer"">blog</a>, it's beautifully explained why not to skip sanitization and how to manually sanitize a value. But I could not figure out <strong>how to sanitize a CSS styling manually using <code>SecurityContext.STYLE</code></strong></p>

<p><strong>Error:</strong> </p>

<blockquote>
  <p>WARNING: sanitizing unsafe style value linear-gradient(135deg, rgba(0,
  0, 0, 0.7) 100%, rgb(117, 79, 182) 100%) (see
  <a href=""http://g.co/ng/security#xss"" rel=""nofollow noreferrer"">http://g.co/ng/security#xss</a>)</p>
  
  <p>safeUrl unsafe</p>
</blockquote>

<p><div class=""snippet"" data-lang=""js"" data-hide=""true"" data-console=""true"" data-babel=""false"">
<div class=""snippet-code snippet-currently-hidden"">
<pre class=""snippet-code-js lang-js prettyprint-override""><code>getBgUrl(category: ICategory): SafeStyle {
  console.log('safeUrl', this.sanitizer.sanitize(SecurityContext.STYLE, `linear-gradient(135deg, rgba(0, 0, 0, 0.7) 100%, rgb(117, 79, 182) 100%)`));
  // return this.sanitizer.bypassSecurityTrustStyle(`linear-gradient(135deg, rgba(0, 0, 0, 0.7) 30%, ${this.gradientColors[category.id % 5]} 100%), url(${category.thumbnail})`);
} </code></pre>
</div>
</div>
</p>

<p><div class=""snippet"" data-lang=""js"" data-hide=""true"" data-console=""true"" data-babel=""false"">
<div class=""snippet-code snippet-currently-hidden"">
<pre class=""snippet-code-html lang-html prettyprint-override""><code>&lt;div class=""explore-grid""&gt;
&lt;mat-card 
  *ngFor=""let category of categories""
  [style.background-image]=""getBgUrl(category)""
  [routerLink]=""['/Category',category.id]""&gt;
    &lt;span&gt;{{category.name}}&lt;/span&gt;
&lt;/mat-card&gt;
&lt;/div&gt;</code></pre>
</div>
</div>
</p>
",https://stackoverflow.com/questions/56691811/angular-application-security-error-sanitizing-unsafe-style-value,"['javascript', 'angular', 'security', 'xss']",566,False,0,1
Aws Cognito : how to get the token for API command line testing?,"<p>I am attempting to authenticate a REST API in AWS API Gateway, which is protected by AWS Cognito through the command line to do some security testing of the API. So, i'm supposed to send the authentication token to get an answer, except i just can't figure out how to get that token!</p>

<p>Our Cognito User Pool is configured for Authorisation Code Grant Flow and Implicit Grant, but not for Client Credentials. Everything I found out during my research was about Client Credentials, so if anyone had a command line that actually works with these parameters it would be really nice!</p>
",https://stackoverflow.com/questions/55748978/aws-cognito-how-to-get-the-token-for-api-command-line-testing,['amazon-cognito'],12391,True,8,1
Is there a way to do cross site script (XSS) testing using JMeter,"<p>Given that JMeter is not a browser and only simulates the actions of a browser, has anyone ever attempted to do cross-site script testing using JMeter?. I was reading online some articles about how to do security testing using JMeter but I didn't come across any work elaborating any attempts to do cross-site script testing.</p>

<p>I have done performance testing using JMeter, but I can't think of any way performing an XSS test using JMeter. So would love to hear, ideas and thought in this regard, thanks.</p>
",https://stackoverflow.com/questions/56208569/is-there-a-way-to-do-cross-site-script-xss-testing-using-jmeter,"['jmeter', 'xss', 'security-testing']",305,True,0,1
Set up drivers for owasp zap in selenium using java,"<p>Hi I am trying to set up an automated framework using ZAP with my automated tests for a web application im tsting. But i cant seem to figure out how to start teh driver and open the website on chrome. Aparantly its quite easy and im trying to add</p>

<pre><code>Proxy proxy = new Proxy();
proxy.setAutodetect(false);
proxy.setProxyType(ProxyType.MANUAL);
proxy.setHttpProxy(""localhost:8080"")

DesiredCapabilites.setCapability(CapabilityType,PROXY.proxy);

driver = new RemoteWebDriver(service.getUrl(), capabilties);
</code></pre>

<p>to my code but cant seem to figure out how this class is meant to be added to the tests, should this be @BeforeTest and how could i add it to my tests? Any help appreciated, I havent done any security testing before and have no idea how to do it.</p>

<p>Tried this also</p>

<pre><code>    DesiredCapabilities dc;
    dc = DesiredCapabilities.firefox();
    System.setProperty(""http.proxyHost"", ""127.0.0.1"");
    System.setProperty(""http.proxyPort"", ""8080"");
    System.setProperty(""https.proxyHost"", ""127.0.0.1"");
    System.setProperty(""https.proxyPort"", ""8080"");
    FirefoxOptions options = new FirefoxOptions();
    options.addArguments(""start-maximized"");
    options.addArguments(""--disable-extensions"");
    dc.setCapability(FirefoxOptions.CAPABILTIES, options);
    FirefoxDriver driver = new FirefoxDriver(dc);
    driver.get(""web-game-stage.sportdec.com"");
</code></pre>
",https://stackoverflow.com/questions/54805455/set-up-drivers-for-owasp-zap-in-selenium-using-java,"['java', 'security', 'selenium-webdriver', 'automated-tests', 'zap']",849,True,0,1
How to make changes in Java classes of a jar file,"<p><strong>Issue</strong></p>

<p>I have arcGIS jar file integrated into one of my Android projects and want to make some modifications in the java classes within the jar file. I modified the jar using the decompiler tool Jd-GUI tool and able to edit the java class.
Now I am again creating the jar of the same folder with the updated class (OAuthView) in this case.</p>

<p>The problem here is after integrating this updated jar file in the same Android project I am unable to compile my project properly. </p>

<p><strong>Why I need to do changes in the arcGIS (esri) )OAuthView Java class:</strong> 
* The application is failed in the security testing
  Reason: Cross Site Scripting (Java Injection), the report said this line in OAuthView Class is creating an issue:</p>

<pre><code>setJavaScriptEnabled(true)
</code></pre>

<p><strong>What I am looking for:</strong>
Any possible way to overcome this issue.</p>

<p><strong>Screenshot (Error Log)</strong></p>

<p><a href=""https://i.stack.imgur.com/qfndu.png"" rel=""nofollow noreferrer""><img src=""https://i.stack.imgur.com/qfndu.png"" alt=""Error Log Screenshot""></a></p>
",https://stackoverflow.com/questions/56555886/how-to-make-changes-in-java-classes-of-a-jar-file,"['java', 'android', 'arcgis', 'esri']",1239,True,3,1
Can containerized tools run against a local machine?,"<p>I conduct security testing on programs and applications. Often, when I want to run a tool, I need to add libraries and other dependencies onto the system that I'm testing in order for the tool to work properly. Also, the test environment doesn't have internet access, which makes installing these dependencies more difficult. </p>

<p>I was thinking about containerizing multiple tools so that I could put them onto the systems that I'm testing and they will have all of their dependencies. I am considering doing this in Docker, so anytime you see a reference to a container it implies that it's a Docker container.</p>

<p>Some of the tools I would like to use are nmap, strace, wireshark, and others for monitoring network traffic, processes and memory.</p>

<p>My questions are:</p>

<ol>
<li>Can I run these tools ""locally"", or will there be networking required, as though they are coming from a different machine?</li>
<li>Is there anything required to put onto the test system for the container to run properly?</li>
</ol>
",https://stackoverflow.com/questions/58119639/can-containerized-tools-run-against-a-local-machine,"['docker', 'containers']",73,True,0,2
Gradle Multi-Project Integration Tests with Junit5,"<p>How can I create integrations tests using Gradle 5.2 and JUnit 5.3 in a multi-project build file?</p>

<p>This is my current build file:</p>

<pre><code>buildscript {
  repositories {
    maven {
      url ""https://plugins.gradle.org/m2/""
    }
  }
  dependencies {
    classpath ""gradle.plugin.com.github.spotbugs:spotbugs-gradle-plugin:1.6.10""
    classpath 'org.owasp:dependency-check-gradle:5.0.0-M2'
  }
}


allprojects {
  defaultTasks 'clean', 'build', 'publish', 'installDist'
  group = 'coyote'
  version = '0.1.0'
}

subprojects {

  apply plugin: 'java'
  apply plugin: 'jacoco'
  apply plugin: ""com.github.spotbugs""
  apply plugin: 'org.owasp.dependencycheck'
  apply plugin: 'maven-publish'
  apply plugin: 'application'
  apply plugin: 'eclipse'
  apply plugin: 'idea'

  repositories {
    jcenter()
    mavenCentral()
  }

  dependencies {
    testImplementation (""org.junit.jupiter:junit-jupiter-api:5.3.2"")
    testRuntimeOnly (""org.junit.jupiter:junit-jupiter-engine:5.3.2"")
    spotbugsPlugins (""com.h3xstream.findsecbugs:findsecbugs-plugin:1.8.0"")
  }

  tasks.withType(Test) {
    useJUnitPlatform()
  }

  apply from: ""$rootDir/integration-test.gradle""

  check.dependsOn jacocoTestCoverageVerification
  check.dependsOn dependencyCheckAnalyze

  spotbugs {
    effort = ""max""
    reportLevel = ""low""
    ignoreFailures = true
    showProgress = true
  }

  jacocoTestReport {
    reports {
      xml.enabled true
      html.enabled true
    }
  }

  check.dependsOn jacocoTestReport

  tasks.withType(com.github.spotbugs.SpotBugsTask) {
    reports {
      xml.enabled false
      html.enabled true
    }
  }

}
</code></pre>

<p>The <code>integration-test.gradle</code> file I am applying on line 46 contains the following:</p>

<pre><code>sourceSets {
    itest {
        compileClasspath += sourceSets.main.output + configurations.testCompile
        runtimeClasspath += output + compileClasspath + configurations.testRuntime
    }
}

idea {
    module {
        testSourceDirs += sourceSets.itest.java.srcDirs
        testResourceDirs += sourceSets.itest.resources.srcDirs
        scopes.TEST.plus += [configurations.itestCompile]
    }
}

task itest(type: Test) {
    description = 'Runs the integration tests.'
    group = 'verification'
    testClassesDirs = sourceSets.itest.output.classesDirs
    classpath = sourceSets.itest.runtimeClasspath
    outputs.upToDateWhen { false }
}
</code></pre>

<p>Everything seems to work well within Intellij, but JUnit5 is not being added to the classpath, so any tests in the <code>itest</code> directories cannot find the JUnit libraries. </p>

<p>Running <code>gradlew itest</code> fails with similar results with the JUnit classes not being found.</p>

<p>I have tried to add use <code>useJUnitPlatform()</code> directly in the <code>itest</code> task, but with no success. I have also tried placing everything in the <code>build.gradle</code> file with no success.</p>

<p>Eventually, I'd like to use the same pattern to define load and security testing, running them separately as part of a CI/CD pipeline so placing everything neatly in their own directories under their respective projects is preferred to mixing everything in one test directory and using tags.</p>

<p>This is also helping other teams model CI/CD practices, so using Gradle 5 and JUnit 5 as designed is preferred as opposed to work-arounds or hacks to make things work. It's acceptable to learn that these versions don't work together or that there are currently defects\issues preventing this approach. Hopefully this is not the issue and I'm just missing something simple.</p>
",https://stackoverflow.com/questions/55402064/gradle-multi-project-integration-tests-with-junit5,"['gradle', 'continuous-integration', 'integration-testing', 'junit5', 'continuous-delivery']",2455,True,4,1
Mock WebSecurity dependencies when testing controllers in Spring,"<p>To have fast tests for my controller I want to use <code>@WebMvcTest</code>. I wrote server-side unit tests for the controller. These are basically simple unit tests involving the sliced Spring application context:</p>

<pre><code>@WebMvcTest(DemoController.class)
class DemoControllerTests {

    @Autowired
    private MockMvc mockMvc;

    @Test
    @WithAnonymousUser
    void shouldNotHaveAccessWhenAnonymous() throws Exception {
        this.mockMvc.perform(get(""/""))
                .andExpect(status().isUnauthorized());
    }

    @Test
    @WithMockUser(username = ""pascal"", roles = ""USER"")
    void shouldHaveAccessWithUserRole() throws Exception {
        this.mockMvc.perform(get(""/hello""))
                .andExpect(status().isOk())
                .andExpect(content().string(""Hello""));
    }
}
</code></pre>

<p>The controller looks like this:</p>

<pre><code>@RestController
class DemoController {

    @GetMapping(""/hello"")
    public String hello() {
        return ""Hello"";
    }

    @PreAuthorize(""hasRole('ADMIN')"")
    @GetMapping(""/admin"")
    public String admin() {
        return ""Admin"";
    }

}
</code></pre>

<p>But as soon as is start involving more dependencies in my <code>WebSecurityConfig</code> like the <code>MyUserDetailsService</code> (which itself has a dependency on the <code>UserObjectRepository</code>) the problems start to appear. </p>

<pre><code>@Autowired
public WebSecurityConfig(final MyUserDetailsService myUserDetailsService) {
    this.myUserDetailsService = myUserDetailsService;
}
</code></pre>

<p>When I run the tests Spring cannot load the ApplicationContext (<code>NoSuchBeanDefinitionException: No qualifying bean of type 'com.example.demo.MyUserDetailsService' available</code>). </p>

<p>This does make sense when I take a look at the documentation of <code>@WebMvcTest</code>. It says that components, services, and repositories will not be auto-configured. But in the last section, it says that Spring Security will be auto-configured when using this annotation. Additional configuration is available using the <code>@AutoConfigureMockMvc</code>.</p>

<p>From my point of view there nothing special to do and even though I want to set the <code>secure</code> config in <code>@AutoConfigureMockMvc</code> it is enabled by default and deprecated. They mention that the <code>secure</code> property is deprecated since 2.1.0 in favor of Spring Security's testing support. But I cannot find more details about a dedicated Spring Security testing support regarding this topic (i already use <code>@WithMockUser</code> etc. in my tests)</p>

<pre><code> * &lt;p&gt;
 * Using this annotation will disable full auto-configuration and instead apply only
 * configuration relevant to MVC tests (i.e. {@code @Controller},
 * {@code @ControllerAdvice}, {@code @JsonComponent},
 * {@code Converter}/{@code GenericConverter}, {@code Filter}, {@code WebMvcConfigurer}
 * and {@code HandlerMethodArgumentResolver} beans but not {@code @Component},
 * {@code @Service} or {@code @Repository} beans).
 * &lt;p&gt;
 * By default, tests annotated with {@code @WebMvcTest} will also auto-configure Spring
 * Security and {@link MockMvc} (include support for HtmlUnit WebClient and Selenium
 * WebDriver). For more fine-grained control of MockMVC the
 * {@link AutoConfigureMockMvc @AutoConfigureMockMvc} annotation can be used.
 * &lt;p&gt;
</code></pre>

<p>The tests are fine in general. They test the controller methods and their method security configuration. The problems only start to roll in when I add more dependencies and separate classes which I then try to inject in my <code>WebSecurityConfig</code>.</p>

<p>How can I mock these dependencies so that my controller tests are working with a sliced context instead of starting the whole application context with <code>@SpringBootTest</code>?</p>
",https://stackoverflow.com/questions/57271558/mock-websecurity-dependencies-when-testing-controllers-in-spring,"['spring-mvc', 'testing', 'spring-security']",912,False,1,1
How to secure google API keys,"<p>I have been doing some security testing on an Android app.  One thing I am trying to wrap my head around is API key security; particularly google Places and Maps keys.  There are lots of posts that talk about the options, namely compiling keys into source, placing them in resource files, compiling them into a shared library, etc.  In my particular case, the Maps key is in the manifest file, and the Places key is in a shared library.  I created a signed APK to test how hard it would be to obtain and use one of the keys.  I did the following:</p>

<ul>
<li>Reverse engineered the APK using apktool,</li>
<li>Opened the manifest and grabbed the Maps key,</li>
<li>Created a fake version of the application with the same package structure as the original containing an activity with a google map fragment,</li>
<li>Put the Maps key in the fake manifest,</li>
<li>Ran the application, which displayed the map</li>
</ul>

<p>Then I:</p>

<ul>
<li>Created a new class in the fake app with the same package and name as the original with code to load the shared library from /data/data/[package name],</li>
<li>Copied the the shared library from the reverse engineered APK to the /data/data/[package name] folder of the fake app,</li>
<li>Ran the fake app, which then printed out the Locations API key</li>
</ul>

<p>So in the end, without much effort, I had both keys which I could then use in a fake version of the application.</p>

<p>I'm sure I must be missing something.  It looks like the only option for Maps is to store the key in the manifest.  What is stopping someone from doing what I did?  Surely it can't just be indifference.  I realize that someone would probably get caught if they tried to publish their app using a hijacked API key.  However, someone could create an app and have people side load it.  It would be a huge disruption for customers if the company had to change a hijacked key every time someone messed with it.</p>
",https://stackoverflow.com/questions/56482557/how-to-secure-google-api-keys,"['android', 'google-maps', 'google-places']",1048,True,2,2
