Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Owasp ZAPのFull ScanでGlobal Filterを当てる方法 #1252

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

Owasp ZAPのFull ScanでGlobal Filterを当てる方法 #1252

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
121126e
[create-pull-request] automated change
tubone24 Jan 15, 2023
f58488c
[skip netlify]wip
tubone24 Jan 15, 2023
cdea6f0
[skip netlify]wip
tubone24 Jan 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions src/content/2023-01-15-Owasp-ZAPのFull-ScanでGlobal-Filterを当てる方法.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
---
slug: 2023-01-15/Owasp-ZAPのFull-ScanでGlobal-Filterを当てる方法
title: "Docker版Owasp ZAPのFull ScanでAlert Filtersを当てる方法"
date: 2023-01-15T12:53:50+0000
description: Docker版Owasp ZAPのFull ScanでAlert Filtersを当てる方法
tags:
- Owasp ZAP
- GitHub Actions
headerImage: https://i.imgur.com/QmIHfeR.jpg
templateKey: blog-post
---

Owasp ZAPでGlobal Filtersを使い、Alert Filtersを適用することでより正確な脆弱性診断をおこないます。
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [textlint] <eslint.rules.smarthr/prh-rules> reported by reviewdog 🐶
おこな => 行な
「行なう」と表現し、「行う」の使用は控える https://smarthr.design/products/contents/idiomatic-usage/usage/ (smarthr/prh-rules)


## Table of Contents

```toc

```

## Alert Filters

前回の記事でもちらっとお話しましたが、Owasp ZAPを実行すると、結構誤検知(False positive)が出ます。

![false positive](https://i.imgur.com/FnGbBym.png)

例えば上記のレポートではInformation Disclosure - Debug Error Messagesや Private IP Disclosureが出てますが、こちらはブログ記事やロゴのSVGに含まれる文字列を引っ張って検知してしまった誤検知です。
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [textlint] <eslint.rules.smarthr/ja-space-between-half-and-full-width> reported by reviewdog 🐶
原則として、全角文字と半角文字の間にスペースを入れません。 (smarthr/ja-space-between-half-and-full-width)