ScoutSuite icon indicating copy to clipboard operation
ScoutSuite copied to clipboard

Check for dropping invalid header fields only for ALB

Open hakman opened this issue 2 years ago • 2 comments

Description

As mentioned in AWS docs, this attribute can be applied only to Application Load Balancers.

PS: not sure if the syntax is quite correct, but wanted to try to address https://github.com/kubernetes/kops/issues/13976.

Make sure the PR is against the develop branch (see Contributing).

Make sure to set the corresponding milestone in the PR.

Please include a summary of the change(s) and which issue(s) it addresses. Please also include relevant motivation and context.

Fixes # (issue)

Type of change

Select the relevant option(s):

  • [x] Bug fix (non-breaking change which fixes an issue)
  • [ ] New feature (non-breaking change which adds functionality)
  • [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [ ] This change requires a documentation update

Checklist:

  • [x] My code follows the style guidelines of this project
  • [x] I have performed a self-review of my own code
  • [x] I have commented my code, particularly in hard-to-understand areas
  • [x] My changes generate no new warnings
  • [ ] I have added tests that prove my fix is effective or that my feature works (optional)
  • [x] New and existing unit tests pass locally with my changes

hakman avatar Jul 16 '22 12:07 hakman

Hi,

Thanks for the PR. However, this change is not needed - since the routing.http.drop_invalid_header_fields.enabled attribute is not present for load balancers other than ALBs, this finding is never raised for those types of ELBs.

fernando-gallego avatar Aug 31 '22 10:08 fernando-gallego

@fernando-gallego As you can see in https://github.com/kubernetes/kops/issues/13976, someone managed to find it for NLB. The PR was just a nice extra check in this case.

hakman avatar Aug 31 '22 10:08 hakman