mozilla / stooge Goto Github PK

View Code? Open in Web Editor NEW

7.0 11.0 6.0 1.08 MB

Mozilla Stooge

License: Mozilla Public License 2.0

Python 2.54% CSS 2.69% JavaScript 94.77%

stooge's Introduction

This is Stooge. Work in progress.

Run Book

requirements

rabbitmq
mongodb
memcache

installation ...

start

$ cd /home/stooge

$ tmux
$ source env/bin/activate && ~/moz-stooge/scripts/stooge-scanner
$ source env/bin/activate && ~/moz-stooge/scripts/stooge-web -p 9090 -c /home/stooge/stooge.cfg

adding new sites

$ mongo stooge
$ db.sites.insert({owner:"yourorg",type:"production",url:"http://www.example.com"})

stooge's People

Contributors

Stargazers

Watchers

Forkers

rillian caseybecking freddyb ygjb april mozilla-github-standards

stooge's Issues

All info logging in the scanner should be debug logging

Basically, the scanner should be completely quiet. Unless something unexpected happens.

TypeError: unhashable type: 'list'

[2014-05-09 17:25:55,569: ERROR/Worker-2] stooge.scanner.tasks.bugcount_task[3c54bed2-b850-4e64-a0f8-da146d4c4f9f]: Error while counting websec bugs
Traceback (most recent call last):
  File "/home/sarentz/stooge/stooge/scanner/tasks.py", line 200, in bugcount_task
    n = count_websec_bugs(bugzilla_username, bugzilla_password, site["url"])
  File "/home/sarentz/stooge/stooge/scanner/tasks.py", line 172, in count_websec_bugs
    bug_ids.add([bug['id'] for bug in _websec_bugs_via_component(credentials, url.hostname)])
TypeError: unhashable type: 'list'

Cache today's scan

Do not hit MongoDB every single time. It is better to cache that data in memcache or redis.

Exception in checks.final_response()

[2014-05-22 15:51:05,648: ERROR/Worker-8] stooge.scanner.tasks.check_task[6d8bfe56-4c35-4cfc-aea1-86a6e7dbc329]: Error while executing checks
Traceback (most recent call last):
  File "/home/sarentz/stooge/stooge/scanner/tasks.py", line 125, in check_task
    results = execute_checks_against_responses(site)
  File "/home/sarentz/stooge/stooge/scanner/checks.py", line 132, in execute_checks_against_responses
    results["basic"].append({"name": check.__name__, "result": check(site, results, site["responses"]["http"], site["responses"]["https"])})
  File "/home/sarentz/stooge/stooge/scanner/checks.py", line 34, in xfo
    r = final_response(http_responses, https_responses)
  File "/home/sarentz/stooge/stooge/scanner/checks.py", line 14, in final_response
    return http_responses[-1]
IndexError: list index out of range

Peekaboo on stooge

https://peekaboo.allizom.org and https://peekaboo.mozilla.org

Display the scan state

If a scan is still in progress, show a little label on the page to let the user know.

Create supervisor scripts for stooge-web and stooge-scanner

Create supervisor scripts for stooge-web and stooge-scanner so that they can start when the machine boots.

Disable caching in dev mode

Because it is impossible to test with caching enabled.

Static content and templates are not packaged

Need to add a MANIFEST.in and add the static and templates packages to setup.py.

Link the bug count to Bugzilla

Link to a query that displays the websec bugs for the specific site. Should look in both whiteboard and component. Using same queries Stooge does. Is that possible?

Create a landing page that contains some charts

Charts with the number of sites supporting CSP, etc.

Add links to each result test label

The dashboard is nice, but when I look at my rows (e.g., developer.mozilla.org and hacks.mozilla.org), what I really want is to click any of the .test-label-fail items to see exactly what I need to do to fix it.

Super Combo Bonus Round:
Make the link go straight to a bugzilla form: "File this failure as a security bug for this site"

Integrate Mozillians API

Integrate the Mozillians API so that we can also let vetted Mozillians in.

Display the last scan that is tagged as nightly

Right now we just pick the last scan done. For the web UI that needs to change to the last scan tagged with nightly.

SSLLabs check is not working on production

The grade is missing. No exceptions in the log.

Make the login screen pretty

Make the login screen pretty and add a message when you are not allowed to login.

Differentiate between APIs and Sites

Add a way to classify the type of a site. Could be as simple as api and web. Certain checks make no sense on API-only sites and can then be skipped.

Better description and/or links to docs for the several items

For folks like me, descriptions like "Does the server send a correct X-Content-Type-Options header?" are rather useless.

It'd be great if the legend could hint at the difference between doing it or not, and include links to further description on how to make the box green, if it's considered to be actually an issue.

acronyms should have a title attribute that allows a tooltip

Some people don't get "XFO" intuitively. Expanding that with a simple tooltip that says "X-Frame-Options" would be nice.

Signing out does not redirect to the login page

Signing out does not redirect to the login page.

Add a new check to find out if CSP is reporting somewhere

Ideally we later change that to see if the site is reporting CSP violations to our reporting server.

Show a summary above the results

Show a summary above the results with each check and the percentage of hosts that pass/fail. Should filter to your current selection.

Add a proper CSP validator

Steal the one from Minion?

Add way to easily filter the list of sites

Add a text field and use Angular filtering to limit the sites to those matching.

air.mozilla.org on stooge

What do I need to do to get air.mozilla.org on?
And air-dev.allizom.org and air.allizom.org

I have some more sites that should maybe be on there. Is there a way to submit URLs?

CODE_OF_CONDUCT.md file missing

As of January 1 2019, Mozilla requires that all GitHub projects include this CODE_OF_CONDUCT.md file in the project root. The file has two parts:

Required Text - All text under the headings Community Participation Guidelines and How to Report, are required, and should not be altered.
Optional Text - The Project Specific Etiquette heading provides a space to speak more specifically about ways people can work effectively and inclusively together. Some examples of those can be found on the Firefox Debugger project, and Common Voice. (The optional part is commented out in the raw template file, and will not be visible until you modify and uncomment that part.)

If you have any questions about this file, or Code of Conduct policies and procedures, please see Mozilla-GitHub-Standards or email [email protected].

(Message COC001)