chore: Enhance documentation for E2E testing:
- Added clarity and structure to README files, including recent updates and getting started sections. - Improved manual verification documentation for CrowdSec authentication, emphasizing expected outputs and success criteria. - Updated debugging guide with detailed output examples and automatic trace capture information. - Refined best practices for E2E tests, focusing on efficient polling, locator strategies, and state management. - Documented triage report for DNS Provider feature tests, highlighting issues fixed and test results before and after improvements. - Revised E2E test writing guide to include when to use specific helper functions and patterns for better test reliability. - Enhanced troubleshooting documentation with clear resolutions for common issues, including timeout and token configuration problems. - Updated tests README to provide quick links and best practices for writing robust tests.
This commit is contained in:
@@ -29,11 +29,13 @@
|
||||
The golang.org/x/crypto/ssh package contains a vulnerability where improper use of the ServerConfig.PublicKeyCallback function could lead to authorization bypass. This is particularly critical for applications using SSH key-based authentication.
|
||||
|
||||
**Risk Assessment:**
|
||||
|
||||
- **Likelihood:** Medium (requires specific misuse pattern)
|
||||
- **Impact:** High (authorization bypass possible)
|
||||
- **Overall Risk:** HIGH
|
||||
|
||||
**Remediation:**
|
||||
|
||||
```bash
|
||||
# Update crypto package to latest version
|
||||
go get -u golang.org/x/crypto@latest
|
||||
@@ -46,6 +48,7 @@ go list -m golang.org/x/crypto
|
||||
```
|
||||
|
||||
**Verification Steps:**
|
||||
|
||||
1. Run: `go mod tidy`
|
||||
2. Run: `trivy fs . --severity CRITICAL --format json | jq '.Results[] | select(.Vulnerabilities!=null) | .Vulnerabilities[] | select(.VulnerabilityID=="CVE-2024-45337")'`
|
||||
3. Confirm vulnerability no longer appears
|
||||
@@ -249,6 +252,7 @@ git push
|
||||
### Automated Dependency Updates
|
||||
|
||||
**Recommended Setup:**
|
||||
|
||||
1. Enable Dependabot on GitHub
|
||||
2. Set up automatic PR creation for security updates
|
||||
3. Configure CI to run on dependency PRs
|
||||
@@ -257,6 +261,7 @@ git push
|
||||
### Configuration
|
||||
|
||||
**.github/dependabot.yml:**
|
||||
|
||||
```yaml
|
||||
version: 2
|
||||
updates:
|
||||
@@ -305,6 +310,7 @@ updates:
|
||||
## Timeline & Tracking
|
||||
|
||||
### Phase 1: Immediate (Today)
|
||||
|
||||
- [ ] Review this report
|
||||
- [ ] Run remediation steps
|
||||
- [ ] Verify updates resolve CVEs
|
||||
@@ -312,12 +318,14 @@ updates:
|
||||
- [ ] Commit and push updates
|
||||
|
||||
### Phase 2: Within 1 Week
|
||||
|
||||
- [ ] Test updated dependencies
|
||||
- [ ] Run full E2E test suite
|
||||
- [ ] Performance verification
|
||||
- [ ] Deploy to staging
|
||||
|
||||
### Phase 3: Within 2 Weeks
|
||||
|
||||
- [ ] Deploy to production
|
||||
- [ ] Monitor for issues
|
||||
- [ ] Set up automated scanning
|
||||
|
||||
Reference in New Issue
Block a user