From 13425a30ef9be104bc9b9f3e6c971588cd9f8d4b Mon Sep 17 00:00:00 2001 From: Philip Hayton Date: Tue, 28 Nov 2023 16:04:05 +0000 Subject: [PATCH 1/2] docs: Update reduce_fingerprint.yml small content fix --- rules/javascript/express/reduce_fingerprint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/javascript/express/reduce_fingerprint.yml b/rules/javascript/express/reduce_fingerprint.yml index c7d090713..35a275ba4 100644 --- a/rules/javascript/express/reduce_fingerprint.yml +++ b/rules/javascript/express/reduce_fingerprint.yml @@ -32,7 +32,7 @@ metadata: By default, Express.js sends the X-Powered-By response header banner. This can be disabled using the app.disable() method: - ``` + ```javascript app.disable('x-powered-by') ``` From b606a7ee60f3f477976812ca5dbbe0e6d248b44c Mon Sep 17 00:00:00 2001 From: gotbadger Date: Tue, 12 Dec 2023 16:35:30 +0000 Subject: [PATCH 2/2] chore: update snapshot --- .../express/reduce_fingerprint/__snapshots__/test.js.snap | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/javascript/express/reduce_fingerprint/__snapshots__/test.js.snap b/tests/javascript/express/reduce_fingerprint/__snapshots__/test.js.snap index 9ddc8649f..e5c7579a9 100644 --- a/tests/javascript/express/reduce_fingerprint/__snapshots__/test.js.snap +++ b/tests/javascript/express/reduce_fingerprint/__snapshots__/test.js.snap @@ -11,7 +11,7 @@ exports[`javascript_express_reduce_fingerprint insecure 1`] = ` ], "id": "javascript_express_reduce_fingerprint", "title": "Security misconfiguration detected (server fingerprinting).", - "description": "## Description\\n\\nIt can help to provide an extra layer of security to reduce server fingerprinting. Though not a security issue itself, a method to improve the overall posture of a web server is to take measures to reduce the ability to fingerprint the software being used on the server. Server software can be fingerprinted by quirks in how they respond to specific requests.\\n\\nBy default, Express.js sends the X-Powered-By response header banner. This can be disabled using the app.disable() method:\\n\\n\`\`\`\\n app.disable('x-powered-by')\\n\`\`\`\\n\\n## Resources\\n\\n- [Express Security Best Practices](https://expressjs.com/en/advanced/best-practice-security.html)\\n", + "description": "## Description\\n\\nIt can help to provide an extra layer of security to reduce server fingerprinting. Though not a security issue itself, a method to improve the overall posture of a web server is to take measures to reduce the ability to fingerprint the software being used on the server. Server software can be fingerprinted by quirks in how they respond to specific requests.\\n\\nBy default, Express.js sends the X-Powered-By response header banner. This can be disabled using the app.disable() method:\\n\\n\`\`\`javascript\\n app.disable('x-powered-by')\\n\`\`\`\\n\\n## Resources\\n\\n- [Express Security Best Practices](https://expressjs.com/en/advanced/best-practice-security.html)\\n", "documentation_url": "https://docs.bearer.com/reference/rules/javascript_express_reduce_fingerprint", "line_number": 4, "full_filename": "/tmp/bearer-scan/insecure.js",