Add necessary security exceptions.

Lombiq · Aug 22, 2024 · 232c30b · 232c30b
1 parent 775d84d
commit 232c30b
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs b/Lombiq.Tests.UI/SecurityScanning/SecurityScanningUITestContextExtensions.cs
@@ -85,6 +85,15 @@ public static Task RunAndConfigureAndAssertFullSecurityScanForContinuousIntegrat
                 // There is no need to security scan the admin dashboard.
                 configuration.ExcludeUrlWithRegex(@".*/Admin/.*");
 
+                // There is no need to security scan anything in Lombiq.Tests.UI.Shortcuts.
+                configuration.ExcludeUrlWithRegex(@".*/Lombiq.Tests.UI.Shortcuts/.*");
+
+                configuration.MarkScanRuleAsFalsePositiveForUrlWithRegex(
+                    ".*/(Login|ChangePassword)([?].*)?",
+                    6,
+                    "Path Traversal",
+                    "Setting the returnUrl attribute to a itself yields a false positive");
+
                 // Active scan takes a very long time, this is not practical in CI.
                 configuration.ModifyZapPlan(plan => plan
                     .SetActiveScanMaxDuration(maxActiveScanDurationInMinutes, maxRuleDurationInMinutes));