OWASP / OWASP/SecurityShepherd
Docker build passes even though landing page does not load
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 515
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 1
Description
There is currently no test to see if the webpage loads when the build for docker is complete.
Below an an issue with the sed command not working where its supposed to replace TLS_KEYSTORE_FILE in /usr/local/tomcat/conf/ with the actual value but it fails. The file is not referenced when the application starts up and cannot produce the landing page.
There needs to be a test developed to catch this.
Evidence of build passing - https://travis-ci.com/OWASP/SecurityShepherd/jobs/294068223
ecshep_tomcat | 04-Mar-2020 18:16:59.971 SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-8443]]
secshep_tomcat | org.apache.catalina.LifecycleException: Protocol handler initialization failed
secshep_tomcat | at org.apache.catalina.connector.Connector.initInternal(Connector.java:1032)
secshep_tomcat | at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
secshep_tomcat | at org.apache.catalina.core.StandardService.initInternal(StandardService.java:552)
secshep_tomcat | at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
secshep_tomcat | at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:848)
secshep_tomcat | at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
secshep_tomcat | at org.apache.catalina.startup.Catalina.load(Catalina.java:639)
secshep_tomcat | at org.apache.catalina.startup.Catalina.load(Catalina.java:662)
secshep_tomcat | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
secshep_tomcat | at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
secshep_tomcat | at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
secshep_tomcat | at java.lang.reflect.Method.invoke(Method.java:498)
secshep_tomcat | at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:303)
secshep_tomcat | at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:473)
secshep_tomcat | Caused by: java.lang.IllegalArgumentException: /usr/local/tomcat/conf/TLS_KEYSTORE_FILE (No such file or directory)
secshep_tomcat | at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:100)
secshep_tomcat | at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:72)
secshep_tomcat | at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:246)
secshep_tomcat | at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1118)
secshep_tomcat | at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:223)
secshep_tomcat | at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:587)
secshep_tomcat | at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)
secshep_tomcat | at org.apache.catalina.connector.Connector.initInternal(Connector.java:1030)
secshep_tomcat | ... 13 more
secshep_tomcat | Caused by: java.io.FileNotFoundException: /usr/local/tomcat/conf/TLS_KEYSTORE_FILE (No such file or directory)
secshep_tomcat | at java.io.FileInputStream.open0(Native Method)
secshep_tomcat | at java.io.FileInputStream.open(FileInputStream.java:195)
secshep_tomcat | at java.io.FileInputStream.<init>(FileInputStream.java:138)
secshep_tomcat | at java.io.FileInputStream.<init>(FileInputStream.java:93)
secshep_tomcat | at sun.net.www.protocol.file.FileURLConnection.connect(FileURLConnection.java:90)
secshep_tomcat | at sun.net.www.protocol.file.FileURLConnection.getInputStream(FileURLConnection.java:188)
secshep_tomcat | at org.apache.tomcat.util.file.ConfigFileLoader.getInputStream(ConfigFileLoader.java:89)
secshep_tomcat | at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:197)
secshep_tomcat | at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:206)
secshep_tomcat | at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:282)
secshep_tomcat | at org.apache.tomcat.util.net.openssl.OpenSSLUtil.getKeyManagers(OpenSSLUtil.java:98)
secshep_tomcat | at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:246)
secshep_tomcat | at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:98)
secshep_tomcat | ... 20 more
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the Docker build and container startup path, especially the sed replacement for TLS_KEYSTORE_FILE under /usr/local/tomcat/conf, then reproduce the failing landing-page startup shown in the issue. Done means the test fails when the keystore reference is not replaced and verifies that the completed build's webpage loads.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java
- Domain
- devops, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100