GitHub Actions
0003b6ac7f
- Added GeoIP integration (Issue #16) with service and access list updates. - Fixed rate limiting burst field usage and added bypass list support (Issue #19). - Implemented CrowdSec bouncer integration (Issue #17) with registration and health checks. - Enhanced WAF integration (Issue #18) with per-host toggle, paranoia levels, and rule exclusions. - Updated documentation and added new API routes for GeoIP, rate limits, and WAF exclusions. chore: Add QA report for race and test failures - Documented findings from race condition tests and WebSocket test flakiness. - Identified issues with CrowdSec registration tests in non-bash environments. - Noted security status contract mismatches and missing table errors in handler/service tests. audit: Conduct full QA audit of security phases - Verified all security implementation phases with comprehensive testing. - Resolved linting issues and ensured codebase health. - Documented test results and issues found during the audit.
209 lines
6.1 KiB
Markdown
209 lines
6.1 KiB
Markdown
# QA Security Audit Report
|
|
|
|
**Date:** December 12, 2025
|
|
**Auditor:** QA_Security Agent
|
|
**Scope:** Full QA Audit of Security Phases 1-4
|
|
|
|
---
|
|
|
|
## Executive Summary
|
|
|
|
All security implementation phases have been verified with comprehensive testing. All tests pass and all lint issues have been resolved. The codebase is in a healthy state.
|
|
|
|
**Overall Status: ✅ PASS**
|
|
|
|
---
|
|
|
|
## Phases Audited
|
|
|
|
| Phase | Feature | Issue | Status |
|
|
|-------|---------|-------|--------|
|
|
| 1 | GeoIP Integration | #16 | ✅ Verified |
|
|
| 2 | Rate Limit Fix | #19 | ✅ Verified |
|
|
| 3 | CrowdSec Bouncer | #17 | ✅ Verified |
|
|
| 4 | WAF Integration | #18 | ✅ Verified |
|
|
|
|
---
|
|
|
|
## Test Results Summary
|
|
|
|
### Backend Tests (Go)
|
|
- **Status:** ✅ PASS
|
|
- **Total Packages:** 18 packages tested
|
|
- **Coverage:** 83.0%
|
|
- **Test Time:** ~55 seconds
|
|
|
|
### Frontend Tests (Vitest)
|
|
- **Status:** ✅ PASS
|
|
- **Total Tests:** 730
|
|
- **Passed:** 728
|
|
- **Skipped:** 2
|
|
- **Test Time:** ~57 seconds
|
|
|
|
### Pre-commit Checks
|
|
- **Status:** ✅ PASS (all hooks)
|
|
- Go Vet: Passed
|
|
- Version Check: Passed
|
|
- Frontend TypeScript Check: Passed
|
|
- Frontend Lint (Fix): Passed
|
|
|
|
### GolangCI-Lint
|
|
- **Status:** ✅ PASS (0 issues)
|
|
- All lint issues resolved during audit
|
|
|
|
### Build Verification
|
|
- **Backend Build:** ✅ PASS
|
|
- **Frontend Build:** ✅ PASS
|
|
- **TypeScript Check:** ✅ PASS
|
|
|
|
---
|
|
|
|
## Issues Found and Fixed During Audit
|
|
|
|
10 linting issues were identified and fixed:
|
|
|
|
1. **httpNoBody Issues (6 instances)** - Using `nil` instead of `http.NoBody` for GET/HEAD request bodies
|
|
2. **assignOp Issues (2 instances)** - Using `p = p + "/32"` instead of `p += "/32"`
|
|
3. **filepathJoin Issue (1 instance)** - Path separator in string passed to `filepath.Join`
|
|
4. **ineffassign Issue (1 instance)** - Ineffectual assignment to `lapiURL`
|
|
5. **staticcheck Issue (1 instance)** - Type conversion optimization
|
|
6. **unused Code (2 instances)** - Unused mock code removed
|
|
|
|
### Files Modified
|
|
- `internal/api/handlers/crowdsec_handler.go`
|
|
- `internal/api/handlers/security_handler.go`
|
|
- `internal/caddy/config.go`
|
|
- `internal/crowdsec/registration.go`
|
|
- `internal/services/geoip_service_test.go`
|
|
- `internal/services/access_list_service_test.go`
|
|
|
|
---
|
|
|
|
## Previous Report: WAF to Coraza Rename
|
|
|
|
**Status: ✅ PASS**
|
|
|
|
All tests pass after fixing test assertions to match the new UI. The rename from "WAF (Coraza)" to "Coraza" has been successfully implemented and verified.
|
|
|
|
---
|
|
|
|
## Test Results
|
|
|
|
### TypeScript Compilation
|
|
|
|
| Check | Status |
|
|
|-------|--------|
|
|
| `npm run type-check` | ✅ PASS |
|
|
|
|
**Output:** Clean compilation with no errors.
|
|
|
|
### Frontend Unit Tests
|
|
|
|
| Metric | Count |
|
|
|--------|-------|
|
|
| Test Files | 84 |
|
|
| Tests Passed | 728 |
|
|
| Tests Skipped | 2 |
|
|
| Tests Failed | 0 |
|
|
| Duration | ~61s |
|
|
|
|
**Initial Run:** 4 failures related to outdated test assertions
|
|
**After Fix:** All 728 tests passing
|
|
|
|
#### Issues Found and Fixed
|
|
|
|
1. **Security.test.tsx - Line 281**
|
|
- **Issue:** Test expected card title `'WAF (Coraza)'` but UI shows `'Coraza'`
|
|
- **Severity:** Low (test sync issue)
|
|
- **Fix:** Updated assertion to expect `'Coraza'`
|
|
|
|
2. **Security.test.tsx - Lines 252-267 (WAF Controls describe block)**
|
|
- **Issue:** Tests for `waf-mode-select` and `waf-ruleset-select` dropdowns that were removed from the Security page
|
|
- **Severity:** Low (removed UI elements)
|
|
- **Fix:** Removed the `WAF Controls` test suite as dropdowns are now on dedicated `/security/waf` page
|
|
|
|
### Lint Results
|
|
|
|
| Tool | Errors | Warnings |
|
|
|------|--------|----------|
|
|
| ESLint | 0 | 5 |
|
|
|
|
**Warnings (pre-existing, not related to this change):**
|
|
|
|
- `CrowdSecConfig.tsx:212` - React Hook useEffect missing dependencies
|
|
- `CrowdSecConfig.tsx:715` - Unexpected any type
|
|
- `CrowdSecConfig.spec.tsx:258,284,317` - Unexpected any types in tests
|
|
|
|
### Pre-commit Hooks
|
|
|
|
| Hook | Status |
|
|
|------|--------|
|
|
| Go Test Coverage (85.1%) | ✅ PASS |
|
|
| Go Vet | ✅ PASS |
|
|
| Check .version matches Git tag | ✅ PASS |
|
|
| Prevent large files not tracked by LFS | ✅ PASS |
|
|
| Prevent committing CodeQL DB artifacts | ✅ PASS |
|
|
| Prevent committing data/backups files | ✅ PASS |
|
|
| Frontend TypeScript Check | ✅ PASS |
|
|
| Frontend Lint (Fix) | ✅ PASS |
|
|
|
|
---
|
|
|
|
## File Verification
|
|
|
|
### Security.tsx (`frontend/src/pages/Security.tsx`)
|
|
|
|
| Check | Status | Details |
|
|
|-------|--------|---------|
|
|
| Card title shows "Coraza" | ✅ Verified | Line 320: `<h3>Coraza</h3>` |
|
|
| No "WAF (Coraza)" text in card title | ✅ Verified | Confirmed via grep search |
|
|
| Dropdowns removed from Security page | ✅ Verified | Controls moved to `/security/waf` config page |
|
|
| Internal API field names unchanged | ✅ Verified | `status.waf.enabled`, `toggle-waf` testid preserved for API compatibility |
|
|
|
|
### Layout.tsx (`frontend/src/components/Layout.tsx`)
|
|
|
|
| Check | Status | Details |
|
|
|-------|--------|---------|
|
|
| Navigation shows "Coraza" | ✅ Verified | Line 70: `{ name: 'Coraza', path: '/security/waf', icon: '🛡️' }` |
|
|
|
|
---
|
|
|
|
## Changes Made During QA
|
|
|
|
### Test File Update: Security.test.tsx
|
|
|
|
```diff
|
|
- describe('WAF Controls', () => {
|
|
- it('should change WAF mode', async () => { ... })
|
|
- it('should change WAF ruleset', async () => { ... })
|
|
- })
|
|
+ // Note: WAF Controls tests removed - dropdowns moved to dedicated WAF config page (/security/waf)
|
|
|
|
- expect(cardNames).toEqual(['CrowdSec', 'Access Control', 'WAF (Coraza)', 'Rate Limiting', 'Live Security Logs'])
|
|
+ expect(cardNames).toEqual(['CrowdSec', 'Access Control', 'Coraza', 'Rate Limiting', 'Live Security Logs'])
|
|
```
|
|
|
|
---
|
|
|
|
## Recommendations
|
|
|
|
1. **No blocking issues** - All changes are complete and verified.
|
|
|
|
2. **Pre-existing warnings** - Consider addressing the `@typescript-eslint/no-explicit-any` warnings in `CrowdSecConfig.tsx` and its test file in a future cleanup pass.
|
|
|
|
---
|
|
|
|
## Conclusion
|
|
|
|
The WAF to Coraza rename has been successfully implemented:
|
|
|
|
- ✅ UI displays "Coraza" in the Security dashboard card
|
|
- ✅ Navigation shows "Coraza" instead of "WAF"
|
|
- ✅ Dropdowns removed from main Security page (moved to dedicated config page)
|
|
- ✅ All 728 frontend tests pass
|
|
- ✅ TypeScript compiles without errors
|
|
- ✅ No new lint errors introduced
|
|
- ✅ All pre-commit hooks pass
|
|
|
|
**QA Approval:** ✅ Approved for merge
|