GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — sslyze scanner: Add mozilla compliance check to the findings · Issue #2099 · secureCodeBox/secureCodeBox

sslyze scanner: Add mozilla compliance check to the findings #2099

New issue
Copy link
New issue
Copy link
Open
Open
sslyze scanner: Add mozilla compliance check to the findings#2099
Copy link
Labels
enhancementNew feature or requestNew feature or request

Description

@Urth
Urth
opened on Nov 15, 2023
Issue body actions

➹ New Feature implementation request

Is your feature request related to a problem?

https://www.securecodebox.io/docs/scanners/sslyze#examples

The documentation for the SSLyze scanner shows many examples using the --mozilla_config=intermediate parameter. But the reality is that the --mozilla_config parameter has no effect on the findings reported by the scanner. SSLyze performs the same scan regardless of the --mozilla_config parameter and validates the scan against the requested compliance level after the json output has been generated.
https://github.com/nabla-c0d3/sslyze/blob/release/sslyze/__main__.py#L89
https://github.com/search?q=repo%3Anabla-c0d3%2Fsslyze%20check_against_mozilla_config&type=code

The mozilla compliance check result can only be read from the logs of the scanner pod which is very inconvenient.

The SSLyze examples set the wrong expectation with the --mozilla_config parameter.

Describe the solution you'd like

I would like to have the scanner include mozilla compliance validation in the findings.

Describe alternatives you've considered

Requesting the compliance level to be included in the SSLyze json output.
Because the scan does not change it should even be possible to check if the target matches any compliance level and report that.

Activity

  1. Urth
    added
    enhancementNew feature or requestNew feature or request
    on Nov 15, 2023
  2. Weltraumschaf
    added this to secureCodeBoxon Nov 17, 2023
  3. github-project-automation
    moved this to Backlog in secureCodeBoxon Nov 17, 2023
  4. Weltraumschaf
    moved this from Backlog to Todo in secureCodeBoxon Nov 17, 2023
  5. Weltraumschaf commented on Nov 17, 2023

    @Weltraumschaf
    Weltraumschaf
    on Nov 17, 2023
    Member
    More actions

    @Urth Thanksfor submitting this issue. We will investigate it.

  6. J12934
    moved this from Todo to Backlog in secureCodeBoxon Jan 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestNew feature or request

    Type

    No type

    Projects

    • secureCodeBox
      Status
      Backlog
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.