OWASP / OWASP/SecurityShepherd

Docker build passes even though landing page does not load

Open
#554 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Test Automation
Dominant language
Java
Stars
1.5k
Forks
515
Avg merge
3h 46m
Merged PRs (30d)
1

Description

There is currently no test to see if the webpage loads when the build for docker is complete.

Below an an issue with the sed command not working where its supposed to replace TLS_KEYSTORE_FILE in /usr/local/tomcat/conf/ with the actual value but it fails. The file is not referenced when the application starts up and cannot produce the landing page.

There needs to be a test developed to catch this.

Evidence of build passing - https://travis-ci.com/OWASP/SecurityShepherd/jobs/294068223

ecshep_tomcat | 04-Mar-2020 18:16:59.971 SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-8443]]
secshep_tomcat | 	org.apache.catalina.LifecycleException: Protocol handler initialization failed
secshep_tomcat | 		at org.apache.catalina.connector.Connector.initInternal(Connector.java:1032)
secshep_tomcat | 		at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
secshep_tomcat | 		at org.apache.catalina.core.StandardService.initInternal(StandardService.java:552)
secshep_tomcat | 		at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
secshep_tomcat | 		at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:848)
secshep_tomcat | 		at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
secshep_tomcat | 		at org.apache.catalina.startup.Catalina.load(Catalina.java:639)
secshep_tomcat | 		at org.apache.catalina.startup.Catalina.load(Catalina.java:662)
secshep_tomcat | 		at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
secshep_tomcat | 		at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
secshep_tomcat | 		at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
secshep_tomcat | 		at java.lang.reflect.Method.invoke(Method.java:498)
secshep_tomcat | 		at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:303)
secshep_tomcat | 		at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:473)
secshep_tomcat | 	Caused by: java.lang.IllegalArgumentException: /usr/local/tomcat/conf/TLS_KEYSTORE_FILE (No such file or directory)
secshep_tomcat | 		at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:100)
secshep_tomcat | 		at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:72)
secshep_tomcat | 		at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:246)
secshep_tomcat | 		at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1118)
secshep_tomcat | 		at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:223)
secshep_tomcat | 		at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:587)
secshep_tomcat | 		at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)
secshep_tomcat | 		at org.apache.catalina.connector.Connector.initInternal(Connector.java:1030)
secshep_tomcat | 		... 13 more
secshep_tomcat | 	Caused by: java.io.FileNotFoundException: /usr/local/tomcat/conf/TLS_KEYSTORE_FILE (No such file or directory)
secshep_tomcat | 		at java.io.FileInputStream.open0(Native Method)
secshep_tomcat | 		at java.io.FileInputStream.open(FileInputStream.java:195)
secshep_tomcat | 		at java.io.FileInputStream.<init>(FileInputStream.java:138)
secshep_tomcat | 		at java.io.FileInputStream.<init>(FileInputStream.java:93)
secshep_tomcat | 		at sun.net.www.protocol.file.FileURLConnection.connect(FileURLConnection.java:90)
secshep_tomcat | 		at sun.net.www.protocol.file.FileURLConnection.getInputStream(FileURLConnection.java:188)
secshep_tomcat | 		at org.apache.tomcat.util.file.ConfigFileLoader.getInputStream(ConfigFileLoader.java:89)
secshep_tomcat | 		at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:197)
secshep_tomcat | 		at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:206)
secshep_tomcat | 		at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:282)
secshep_tomcat | 		at org.apache.tomcat.util.net.openssl.OpenSSLUtil.getKeyManagers(OpenSSLUtil.java:98)
secshep_tomcat | 		at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:246)
secshep_tomcat | 		at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:98)
secshep_tomcat | 		... 20 more

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the Docker build and container startup path, especially the sed replacement for TLS_KEYSTORE_FILE under /usr/local/tomcat/conf, then reproduce the failing landing-page startup shown in the issue. Done means the test fails when the keystore reference is not replaced and verifies that the completed build's webpage loads.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java
Domain
devops, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.