False Positive Outputs
Closed this issue · 1 comments
Since about a week SSLyze reports include a lot of false positive results which seem to be related to a sslyze update which happened automatically as we pull in the latest release via pip.
This currently only affects the develop branch, as the master and tagged releases include a older version as they have been build prior to the update.
To fix this the result parsing needs to be changed to use the new json format introduced in SSLyze 2.1.1. Luckily most of the format seemed to have stayed stable, only some keys have been renamed.
The transformation logic has been adapted to reflect the changes.
To ensure that we don't experience any more "unexpected" sslyze updates i pinned the sslyze version we install to the current one.
I got an eye on new sslyze versions and will try to update the scanner wrapper as soon as possible.
I also did some mayor refactoring on how the test are written to make further migrations easier in the future. Basically we now test against actual scan reports which can be regenerated automatically instead of having manually mocked reports with changes made here and there.