Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
", "endpoint": null, "raw": { "pluginid": "10038", "alertRef": "10038-1", "alert": "Content Security Policy (CSP) Header Not Set", "name": "Content Security Policy (CSP) Header Not Set", "riskcode": "2", "confidence": "3", "riskdesc": "Medium (High)", "desc": "Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
", "instances": [ { "id": "20", "uri": "https://dms.overdrive.co.za/", "nodeName": "https://dms.overdrive.co.za/", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "90", "uri": "https://dms.overdrive.co.za/index.php", "nodeName": "https://dms.overdrive.co.za/index.php", "method": "GET", "param": "", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "2", "systemic": false, "solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
https://www.w3.org/TR/CSP/
https://w3c.github.io/webappsec-csp/
https://web.dev/articles/csp
https://caniuse.com/#feat=contentsecuritypolicy
https://content-security-policy.com/
", "cweid": "693", "wascid": "15", "sourceid": "8" } }, { "tool": "zap", "type": "web", "severity": "medium", "title": "Missing Anti-clickjacking Header", "description": "The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.
", "endpoint": null, "raw": { "pluginid": "10020", "alertRef": "10020-1", "alert": "Missing Anti-clickjacking Header", "name": "Missing Anti-clickjacking Header", "riskcode": "2", "confidence": "2", "riskdesc": "Medium (Medium)", "desc": "The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.
", "instances": [ { "id": "17", "uri": "https://dms.overdrive.co.za/", "nodeName": "https://dms.overdrive.co.za/", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" }, { "id": "89", "uri": "https://dms.overdrive.co.za/index.php", "nodeName": "https://dms.overdrive.co.za/index.php", "method": "GET", "param": "x-frame-options", "attack": "", "evidence": "", "otherinfo": "" } ], "count": "2", "systemic": false, "solution": "Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.
If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's \"frame-ancestors\" directive.
", "otherinfo": "", "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
", "cweid": "1021", "wascid": "15", "sourceid": "8" } }, { "tool": "zap", "type": "web", "severity": "medium", "title": "Source Code Disclosure - Java", "description": "Application Source Code was disclosed by the web server. - Java
", "endpoint": null, "raw": { "pluginid": "10099", "alertRef": "10099", "alert": "Source Code Disclosure - Java", "name": "Source Code Disclosure - Java", "riskcode": "2", "confidence": "2", "riskdesc": "Medium (Medium)", "desc": "Application Source Code was disclosed by the web server. - Java
", "instances": [ { "id": "16", "uri": "https://dms.overdrive.co.za/", "nodeName": "https://dms.overdrive.co.za/", "method": "GET", "param": "", "attack": "", "evidence": "class n{static#e=new Set;static toggleSearchBox(t,e){let s=t.querySelector(\".kint-search\"),i=t.parentNode;if(s)if(s.classList.toggle(\"kint-show\",e)){if(s.focus(),s.select(),!n.#e.has(s)){let r=i.querySelectorAll(\"dl\").length,o=200;r>1e4&&(o=700),s.addEventListener(\"keyup\",I(n.#t.bind(null,s),o)),n.#e.add(s)}n.#t(s)}else i.classList.remove(\"kint-search-root\")}static#t(t){let e=t.closest(\".kint-parent\")?.parentNode;if(e)if(t.classList.contains(\"kint-show\")&&t.value.length){let s=e.dataset.lastSearch;if(e.classList.add(\"kint-search-root\"),s!==t.value){e.dataset.lastSearch=t.value,e.classList.remove(\"kint-search-match\");for(let i of e.querySelectorAll(\".kint-search-match\"))i.classList.remove(\"kint-search-match\");n.#s(e,t.value.toUpperCase())}}else e.classList.remove(\"kint-search-root\")}static#s(t,e){let s=t.cloneNode(!0);for(let c of s.querySelectorAll(\".access-path\"))c.remove();if(!s.textContent.toUpperCase().includes(e))return;t.classList.add(\"kint-search-match\");let i=t.firstElementChild;for(;i&&i.tagName!==\"DT\";)i=i.nextElementSibling;if(!i)return;let r=a.getChildContainer(i);if(!r)return;let o,l;for(let c of r.children)c.tagName===\"DL\"?n.#s(c,e):c.tagName===\"UL\"&&(c.classList.contains(\"kint-tabs\")?o=c.children:c.classList.contains(\"kint-tab-contents\")&&(l=c.children));if(!(!o||o.length!==l?.length))for(let c=o.length;c--;){let k=!1,F=!1;o[c].textContent.toUpperCase().includes(e)&&(k=!0);let O=l[c].cloneNode(!0);for(let v of O.querySelectorAll(\".access-path\"))v.remove();if(O.textContent.toUpperCase().includes(e)&&(k=!0,F=!0),k&&o[c].classList.add(\"kint-search-match\"),F)for(let v of l[c].children)v.tagName===\"DL\"&&n.#s(v,e)}}};var g=class{static sort(t,e){let s=t.dataset.kintTableSort,i=parseInt(s)===e?-1:1,r=t.tBodies[0];[...r.rows].sort(function(o,l){o=o.cells[e].textContent.trim().toLocaleLowerCase(),l=l.cells[e].textContent.trim().toLocaleLowerCase();let c=0;return!isNaN(o)&&!isNaN(l)?(o=parseFloat(o),l=parseFloat(l),c=o-l):isNaN(o)&&!isNaN(l)?c=1:isNaN(l)&&!isNaN(o)?c=-1:c=(\"\"+o).localeCompare(\"\"+l),c*i}).forEach(o=>r.appendChild(o)),i<0?t.dataset.kintTableSort=null:t.dataset.kintTableSort=e}};var a=class n{#e;#t;#s;constructor(t){if(!(t instanceof h))throw new Error(\"Invalid argument to Rich.constructor()\");this.#e=t,this.#e.runOnInit(this.#i.bind(this));let e=new q(this,t);new b(this,t.window,e)}#i(){let t=this.#e.window.document;if(d(this.#t)||(this.#t=t.querySelector(\"style.kint-rich-style\")),this.#t&&m(this.#t),t.querySelector(\".kint-rich.kint-file\")){this.setupFolder(t);let e=this.#s.querySelector(\"dd.kint-foldout\"),s=Array.from(t.querySelectorAll(\".kint-rich.kint-file\"));for(let i of s)i.parentNode!==e&&e.appendChild(i);this.#s.classList.add(\"kint-show\")}}addToFolder(t){let e=t.closest(\".kint-rich\");if(!e)throw new Error(\"Bad addToFolder\");let s=this.#e.window.document;if(this.setupFolder(s),this.folder.contains(t))throw new Error(\"Bad addToFolder\");let i=this.#s.querySelector(\"dd.kint-foldout\"),r=t.closest(\".kint-parent, .kint-rich\"),o=Array.from(e.querySelectorAll(\".kint-folder-trigger\"));if(e===r||e.querySelectorAll(\".kint-rich > dl\").length===1){for(let l of o)l.remove();e.classList.add(\"kint-file\"),i.insertBefore(e,i.firstChild)}else{let l=s.createElement(\"div\");l.classList.add(\"kint-rich\"),l.classList.add(\"kint-file\"),l.appendChild(r.closest(\".kint-rich > dl\"));let c=e.lastElementChild;c.matches(\".kint-rich > footer\")&&l.appendChild(c.cloneNode(!0));for(let k of o)k.remove();i.insertBefore(l,i.firstChild)}n.toggle(this.#s.querySelector(\".kint-parent\"),!0)}setupFolder(t){if(this.#s)d(this.#s)||(this.#s=t.querySelector(\".kint-rich.kint-folder\"));else{let e=t.createElement(\"template\");e.innerHTML='