From d97ad474da33337a3b0f8145b2157ebb9befefb1 Mon Sep 17 00:00:00 2001 From: Neil Martinsen-Burrell Date: Wed, 7 Jun 2023 14:06:29 -0500 Subject: [PATCH 1/2] Get environment variable from a better location --- src/registrar/config/settings.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/registrar/config/settings.py b/src/registrar/config/settings.py index 54eb35d9f..8f3307d80 100644 --- a/src/registrar/config/settings.py +++ b/src/registrar/config/settings.py @@ -48,6 +48,7 @@ env_db_url = env.dj_db_url("DATABASE_URL") env_debug = env.bool("DJANGO_DEBUG", default=False) env_log_level = env.str("DJANGO_LOG_LEVEL", "DEBUG") env_base_url = env.str("DJANGO_BASE_URL") +env_getgov_public_site_url = env.str("GETGOV_PUBLIC_SITE_URL", "") secret_login_key = b64decode(secret("DJANGO_SECRET_LOGIN_KEY", "")) secret_key = secret("DJANGO_SECRET_KEY") @@ -62,8 +63,6 @@ secret_registry_key = b64decode(secret("REGISTRY_KEY", "")) secret_registry_key_passphrase = secret("REGISTRY_KEY_PASSPHRASE", "") secret_registry_hostname = secret("REGISTRY_HOSTNAME") -secret_getgov_public_site_url = secret("GETGOV_PUBLIC_SITE_URL", "") - # region: Basic Django Config-----------------------------------------------### # Build paths inside the project like this: BASE_DIR / "subdir". @@ -509,7 +508,7 @@ STATIC_URL = "public/" # Base URL of our separate static public website. Used by the # {% public_site_url subdir/path %} template tag -GETGOV_PUBLIC_SITE_URL = secret_getgov_public_site_url +GETGOV_PUBLIC_SITE_URL = env_getgov_public_site_url # endregion # region: Registry----------------------------------------------------------### From 97f8a710487ed0e32231eb3e01b7841bf227e1d8 Mon Sep 17 00:00:00 2001 From: Seamus Johnston Date: Thu, 8 Jun 2023 11:16:37 -0500 Subject: [PATCH 2/2] Try adding a rule for uswds-init --- src/zap.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/zap.conf b/src/zap.conf index 6a5e9bf77..b79fac71e 100644 --- a/src/zap.conf +++ b/src/zap.conf @@ -27,6 +27,8 @@ 10027 OUTOFSCOPE http://app:8080/public/debug_toolbar/js/toolbar.js # USWDS.min.js contains suspicious words "query", "select", "from" in ordinary usage 10027 OUTOFSCOPE http://app:8080/public/js/uswds.min.js +# UNCLEAR WHY THIS ONE IS FAILING. Giving 404 error. +10027 OUTOFSCOPE http://app:8080/public/js/uswds-init.min.js # get-gov.js contains suspicious word "from" as in `Array.from()` 10027 OUTOFSCOPE http://app:8080/public/js/get-gov.js 10028 FAIL (Open Redirect - Passive/beta)