rfc-st/humble

Fix humble scanner output if target not available

manuel-sommer opened this issue · 3 comments

I am using v 1.30 of Humble and tried out the JSON output.

In case the target is not reachable, the output of "Missing Security Headers" should be empty. Right now the output indicates that the target is available.

See at the following output example:

https://github.com/DefectDojo/django-DefectDojo/pull/8989/files#diff-ff6a401d1d37c4f253ab3df1e2c0963f254bb27a23d687542eaf105766f9608d

rfc-st commented

Hi there!,

The main problems seems to be that this function is not even reached:

def handle_http_exceptions(r, exception_d):

The controls I had implemented to detect HTTP 404 codes, URLs without schema, etc ... no longer work:

humble/humble.py

Line 1059 in cd35be6

exception_d = {

And I think it's all related to this commit: 57a9125

I have to check it calmly and fix it.

Thanks for reporting it!.

rfc-st commented

Hi there!,

Have a look at: bf288d2

Now, in case the URL does not exist or its scheme is incorrect (ex: http///, https//) the concrete error message is indicated, without generating any file including incorrect information.

I think this is the correct approach ... if the URL is incorrect nothing should be exported to any file in any case.

Please take a look at it, to confirm that I can close this issue.

Thank you!

Works fine again, thank you :-)