🐛 fix Acunetix date #11206

[manuel-sommer]

#11206

[dryrunsecurity]

DryRun Security Summary

This pull request focuses on improving the parsing and handling of Acunetix security scan reports within the Dojo application security platform, including updates to date parsing logic, addition of a new test case, and addressing a security vulnerability related to the PHPSESSID cookie.

Expand for full summary

Summary:

The code changes in this pull request appear to be focused on improving the parsing and handling of Acunetix security scan reports within the Dojo application security platform. The key changes include:

1. Updating the date parsing logic in the parse_acunetix_xml.py and parse_acunetix360_json.py files to correctly handle the date format used in the Acunetix reports.
2. Adding a new test case in the test_acunetix_parser.py file to verify the parsing of an Acunetix scan file with a specific issue (ID 11206).
3. Addressing a security vulnerability identified by the Acunetix360 scanner, where the PHPSESSID cookie was not marked as HttpOnly, which could potentially lead to session hijacking attacks.

From an application security perspective, these changes are generally positive and help to improve the accuracy, reliability, and security of the Acunetix report parsing functionality within the Dojo platform. The changes do not appear to introduce any significant security risks or concerns.

Files Changed:

1. dojo/tools/acunetix/parse_acunetix_xml.py: The changes in this file update the date parsing logic to correctly handle the "DD/MM/YYYY" date format used in Acunetix XML reports.
2. unittests/tools/test_acunetix_parser.py: The changes in this file add a new test case to verify the parsing of an Acunetix scan file with a specific issue (ID 11206).
3. unittests/scans/acunetix/issue_11206.json: This file provides details about a security vulnerability identified by the Acunetix360 scanner, where the PHPSESSID cookie was not marked as HttpOnly.
4. dojo/tools/acunetix/parse_acunetix360_json.py: The changes in this file update the date parsing logic to correctly handle the "DD/MM/YYYY" date format used in Acunetix JSON reports.

Code Analysis

We ran 9 analyzers against 4 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[cneill]

I checked some of our example scan files to be sure this wasn't a user-configurable thing that would vary based on the user's timezone/preferences, and it at least appears that this is consistent. Unfortunately, changing this behavior didn't trigger any unit test failures, meaning we're not evaluating it at all today. Would you mind adding some test cases, @manuel-sommer ?

[cneill]

Thanks! 😄

[mtesauro]

Approved