Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to start a repeater #146

Closed
derevnjuk opened this issue Dec 20, 2022 · 0 comments · Fixed by #147
Closed

Unable to start a repeater #146

derevnjuk opened this issue Dec 20, 2022 · 0 comments · Fixed by #147
Assignees
Labels
Priority: high Type: bug Something isn't working

Comments

@derevnjuk
Copy link
Member

derevnjuk commented Dec 20, 2022

SecTester crashes while starting a new repeater on https://app.neuralegion.com/ due to an empty response body on POST /api/v1/repeaters

Precondition:

  1. Create a Bright API key (https://docs.brightsec.com/docs/manage-your-personal-account#manage-your-personal-api-keys-authentication-tokens) with all available scopes.
  2. Put created API key under BRIGHT_TOKEN env variable.

Steps to reproduce:

  1. Configure SecTester using the XUnit test framework as follows (https://github.com/NeuraLegion/sectester-net/tree/master/src/SecTester.Runner#setup):
using SecTester.Runner;
using SecTester.Scan;
using SecTester.Scan.Models;

public class Tests : IAsyncLifetime
{
  private const string Hostname = "app.brightsec.com";
  private readonly Configuration _config = new(Hostname, logLevel: LogLevel.Trace);

  private readonly SecRunner _runner;
  private readonly ScanSettingsBuilder _settings = new ScanSettingsBuilder()
    .WithTests(new List<TestType> { TestType.RetireJs });

  public async Task InitializeAsync()
  { 
    _runner = await SecRunner.Create(_config);
    await _runner.Init();
  }

  public async Task DisposeAsync()
  {
    await _runner.DisposeAsync();
    GC.SuppressFinalize(this);
  }
}
  1. Implement a test against any target:
// ...

public class Tests : IAsyncLifetime
{
  // ...
   [Fact]
  public async Task ShouldNotHaveJsVulnerability()
  {
    var target = new Target("https://qa.brokencrystals.com/vendor/fullcalendar-3.10.0/lib/moment.min.js")
      .WithHeaders(new Dictionary<string, IEnumerable<string>>
      {
        { "Accept-Encoding", new[] { "identity" } }
      });

    await _runner
      .CreateScan(_settings)
      .Threshold(Severity.Medium)
      .Timeout(TimeSpan.FromMinutes(50))
      .Run(target);
  }
}
  1. Run the test by issuing the following command:
$ dotnet test -c Debug --nologo --logger "console;verbosity=detailed" --filter "DisplayName~ShouldNotHaveJsVulnerability"

Expected result: scan has been started without any issues.

Actual result: unable to start a repeater, tests crashes with the following stack trace:

[xUnit.net](http://xunit.net/) 00:00:03.12]     App.SecurityTests.AppTests.Get_Users_ShouldNotHaveSqli [FAIL]
  Failed App.SecurityTests.AppTests.Post_Users_ShouldNotHaveXss [1 ms]
  Error Message:
   System.Text.Json.JsonException : The input does not contain any JSON tokens. Expected the input to start with a valid JSON token, when isFinalBlock is true. Path: $ | LineNumber: 0 | BytePositionInLine: 0.
---- System.Text.Json.JsonReaderException : The input does not contain any JSON tokens. Expected the input to start with a valid JSON token, when isFinalBlock is true. LineNumber: 0 | BytePositionInLine: 0.
  Stack Trace:
     at System.Text.Json.ThrowHelper.ReThrowWithPath(ReadStack& state, JsonReaderException ex)
   at System.Text.Json.Serialization.JsonConverter`1.ReadCore(Utf8JsonReader& reader, JsonSerializerOptions options, ReadStack& state)
   at System.Text.Json.Serialization.JsonConverter`1.ReadCoreAsObject(Utf8JsonReader& reader, JsonSerializerOptions options, ReadStack& state)
   at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 utf8Json, JsonTypeInfo jsonTypeInfo, Nullable`1 actualByteCount)
   at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 json, JsonTypeInfo jsonTypeInfo)
   at System.Text.Json.JsonSerializer.Deserialize(String json, Type returnType, JsonSerializerOptions options)
   at SecTester.Bus.Dispatchers.MessageSerializer.Deserialize(String data, Type type) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Bus/Dispatchers/MessageSerializer.cs:line 26
   at SecTester.Bus.Dispatchers.MessageSerializer.Deserialize[T](String data) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Bus/Dispatchers/MessageSerializer.cs:line 24
   at SecTester.Bus.Dispatchers.HttpCommandDispatcher.ParserResponse[TResult](HttpResponseMessage res) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Bus/Dispatchers/HttpCommandDispatcher.cs:line 59
   at SecTester.Bus.Dispatchers.HttpCommandDispatcher.Execute[TResult](Command`1 message) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Bus/Dispatchers/HttpCommandDispatcher.cs:line 46
   at SecTester.Repeater.Api.DefaultRepeaters.CreateRepeater(String name, String description) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Repeater/Api/DefaultRepeaters.cs:line 20
   at SecTester.Repeater.DefaultRepeaterFactory.CreateRepeater(RepeaterOptions options) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Repeater/DefaultRepeaterFactory.cs:line 36
   at SecTester.Runner.SecRunner.Init(RepeaterOptions options, CancellationToken cancellationToken) in /home/runner/work/sectester-net/sectester-net/src/SecTester.Runner/SecRunner.cs:line 74
   at App.SecurityTests.AppTests.InitializeAsync() in /home/git-bob/sectestering2/sectester-net-demo/test/App.SecurityTests/AppTests.cs:line 20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Priority: high Type: bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant