← 输入框|github.com|刷新
Skip to content

sslyze scanner: Add mozilla compliance check to the findings #2099

Open

Description

@Urth

➹ New Feature implementation request

Is your feature request related to a problem?

https://www.securecodebox.io/docs/scanners/sslyze#examples

The documentation for the SSLyze scanner shows many examples using the --mozilla_config=intermediate parameter. But the reality is that the --mozilla_config parameter has no effect on the findings reported by the scanner. SSLyze performs the same scan regardless of the --mozilla_config parameter and validates the scan against the requested compliance level after the json output has been generated.
https://github.com/nabla-c0d3/sslyze/blob/release/sslyze/__main__.py#L89
https://github.com/search?q=repo%3Anabla-c0d3%2Fsslyze%20check_against_mozilla_config&type=code

The mozilla compliance check result can only be read from the logs of the scanner pod which is very inconvenient.

The SSLyze examples set the wrong expectation with the --mozilla_config parameter.

Describe the solution you'd like

I would like to have the scanner include mozilla compliance validation in the findings.

Describe alternatives you've considered

Requesting the compliance level to be included in the SSLyze json output.
Because the scan does not change it should even be possible to check if the target matches any compliance level and report that.

Activity

  1. moved this from Backlog to Todo in secureCodeBoxon Nov 17, 2023
  2. Weltraumschaf commented on Nov 17, 2023

    @Weltraumschaf
    Member

    @Urth Thanksfor submitting this issue. We will investigate it.

  3. moved this from Todo to Backlog in secureCodeBoxon Jan 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions