Expected results file extensions? about benchmarkjava

[davewichers]

@LuisVentuzelos - I just checked in changes to all the .html files that had Cookies.set() calls in them to add the missing "secure: true" attribute. I'm going to close this issue now, but if you see any problems, let me know.

[davewichers]

The OWASP Benchmark currently only has deliberate vulns in the Java code. Any vulns in the HTML or JavaScript for the UI you might find are incidental (i.e., not deliberate) and are not scored. If you do find html/JS vulns, please let me know what they are as I might try to fix them. I do try to eliminate unintended vulns, leaving only the intentional ones to be scored.

[LuisVentuzelos]

Following up on this issue we found an potencial Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability on the OWASP Project in Javascript on the following files:

• BenchmarkTest00088.html

• BenchmarkTest00089.html

• BenchmarkTest01862.html

• BenchmarkTest01863.html

For example on the file BenchmarkTest01862.html we have the following function

function setCookie(cname, cvalue, exdays) { Cookies.set(cname, cvalue,{ path: 'BenchmarkTest01862', version: 1 }); $("#cValue").text(document.cookie); }

this function doesn't use the secure protocol flag

We can see this in the documentation:
https://github.com/js-cookie/js-cookie

Can you look into this?

I created a Pull Request to bypass this issue on our solution.

[davewichers]

There are no intentional vulnerabilities in the .html code, and we don't score them. I've accepted your pull request. Is there anything else you suggest I do related to this? We could fix the .html to eliminate the unintentional vulnerabilities. I do that all the time when tools point out vulns that weren't intended to be there on purpose. If you think I should fix it, would specific change to the code snippet above should I make?

[LuisVentuzelos]

Thanks Dave :)

Simply adding a secure: true to the set cookie function should be enough . That way we guarantee that the cookie transmission requires a secure protocol

Example:

function setCookie(cname, cvalue, exdays) { Cookies.set(cname, cvalue,{ path: 'BenchmarkTest00077', version: 1, secure: true }); $("#cValue").text(document.cookie); }

[LuisVentuzelos]

Thanks Dave!
I'll let you know if I have any more issues :)