Fix OWASP test

.github/actions/run-server/action.yml

@@ -18,6 +18,7 @@ runs:
         DATABASE_URL: ${{ inputs.database_url }}
         SECRET_KEY_BASE: not-actually-secret
       run: bundle exec rails server &
+      working-directory: app
 
     - name: "Wait for startup"
       shell: bash

.github/workflows/owasp-daily-scan.yml

@@ -1,10 +1,12 @@
 name: OWASP ZAP daily scan
 
 on:
-  schedule:
-    # cron format: 'minute hour dayofmonth month dayofweek'
-    # this will run at noon UTC every day (7am EST / 8am EDT)
-    - cron: '0 12 * * *'
+  pull_request:
+    branches: [ main ]
+  # schedule:
+  #   # cron format: 'minute hour dayofmonth month dayofweek'
+  #   # this will run at noon UTC every day (7am EST / 8am EDT)
+  #   - cron: '0 12 * * *'
 
 jobs:
   owasp-scan:
@@ -31,15 +33,17 @@ jobs:
 
       - id: setup
         uses: ./.github/actions/setup-project
+        with:
+          rails_env: test
 
       - uses: ./.github/actions/run-server
         with:
           database_url: ${{ steps.setup.outputs.database_url }}
 
       - name: Run OWASP Full Scan
-        uses: zaproxy/action-full-scan@v0.10.0
+        uses: JosephGasiorekUSDS/action-full-scan@jgasiorek-args
         with:
           target: 'http://localhost:3000/'
           fail_action: true
-          rules_file_name: 'zap.conf'
-          cmd_options: '-I'
+          rules_file_name: 'app/zap.conf'
+          cmd_options: -I -z \"-config network.globalExclusions.exclusions\\(0\\).exclusion.name=Search -config network.globalExclusions.exclusions\\(0\\).exclusion.enabled=true -config network.globalExclusions.exclusions\\(0\\).exclusion.value=/.*\\/(?:.{2}\\/)?cbv\\/employer_search\\?authenticity\\_token.*/gm\"

app/app/controllers/pages_controller.rb

@@ -1,4 +1,7 @@
 class PagesController < ApplicationController
   def home
+    unless params["format"].nil?
+      head 401, content_type: "text/html"
+    end
   end
 end

app/app/views/cbv/employer_searches/show.html.erb

@@ -8,6 +8,7 @@
   <p><%= t(".directed_to_login_portal") %></p>
 
   <%= form_with url: cbv_flow_employer_search_path, method: :get, class: "usa-search usa-search--big margin-top-4", html: { role: "search" }, data: { turbo_frame: "employers", turbo_action: "advance" } do |f| %>
+    <%= hidden_field_tag :authenticity_token, form_authenticity_token -%>
     <%= f.label :query, "Search for your employer", class: "usa-sr-only" %>
     <%= f.text_field :query, value: @query, class: "usa-input", type: "search", data: { "cbv-employer-search-target": "searchTerms" } %>
     <button
@@ -24,6 +25,7 @@
   <%= render partial: "employer", locals: { employer: @employers } %>
 
   <%= form_with url: next_path, method: :get, class: "display-none", data: { 'cbv-employer-search-target': "form" } do |f| %>
+    <%= hidden_field_tag :authenticity_token, form_authenticity_token -%>
     <input type="hidden" name="user[account_id]" data-cbv-employer-search-target="userAccountId" >
   <% end %>
 

zap_options.conf

@@ -0,0 +1,3 @@
+network.globalExclusions.exclusions(0).exclusion.name=Search
+network.globalExclusions.exclusions(0).exclusion.enabled=true
+network.globalExclusions.exclusions(0).exclusion.value=/.*\/(?:.{2}\/)?cbv\/employer_search\?authenticity\_token.*/gm