Question
Nationale Nederlanden
NL
Last activity: 22 Mar 2022 7:48 EDT
pySafeURL and pySafeURLAndActivity result in Rule Security Analyzer
Hello,
I have two question about the Rule Security Analyzer.
1) In the documentation I can't find anything about pySafeURLAndActivity.
I can see that it also check for activity in particular rules but what is the real purpose?
2) As a result we have several HTML rules. In the documentation you can find this:
"To prevent data from being misinterpreted as having a special meaning, finds URLs and query parameters that are not encoded."
My question is how to solve this so the rule(s) will not be showed anymore in the report? Regards,
Maurice
Updated: 22 Mar 2022 7:48 EDT
Pegasystems Inc.
GB
You have asked about the Harness rules
pySafeURLAndActivity
pyUnsafeURL
The mentioned expression pySafeURLAndActivity can be used in RSA tool but is not specifically related to security.
See https://community.pega.com/knowledgebase/articles/security/84/rule-security-analyzer-0
Regular expressions, pyUnsafeURL, is to find URL construction without using the SafeURL javascript API.
Can you tell us more about your HTML rules?
The Rule Security Analyzer tool examines only custom code, not autogenerated rules. Blocked rules are ignored. These rules are identified by the property .pyRuleAvailable = "Blocked". The tool scans rules in your own applications, not rules in standard Pega Platform rulesets.
Are you requesting an enhancement to be able to pass rules when they are not a URL construction and not reading from parameters? I have found other clients asking this question, and the response was that the findings based on pyUnsafeURL do NOT represent a security vulnerability.
Unfortunately the name of the regex implies this, but it is not the case. This regex is meant to be used in conjunction with url obfuscation.
You have asked about the Harness rules
pySafeURLAndActivity
pyUnsafeURL
The mentioned expression pySafeURLAndActivity can be used in RSA tool but is not specifically related to security.
See https://community.pega.com/knowledgebase/articles/security/84/rule-security-analyzer-0
Regular expressions, pyUnsafeURL, is to find URL construction without using the SafeURL javascript API.
Can you tell us more about your HTML rules?
The Rule Security Analyzer tool examines only custom code, not autogenerated rules. Blocked rules are ignored. These rules are identified by the property .pyRuleAvailable = "Blocked". The tool scans rules in your own applications, not rules in standard Pega Platform rulesets.
Are you requesting an enhancement to be able to pass rules when they are not a URL construction and not reading from parameters? I have found other clients asking this question, and the response was that the findings based on pyUnsafeURL do NOT represent a security vulnerability.
Unfortunately the name of the regex implies this, but it is not the case. This regex is meant to be used in conjunction with url obfuscation.
It attempts to find logic where URLs might be submitted in requests without going through the SafeURL api and thus not getting obfuscated. The end result might be that such requests would get rejected if the submitobfuscatedURL setting is 'required'. If obfuscation is not used or this setting is set to 'optional', there is no action needed on these findings. Note: obfuscation works prior to authentication
The items only come into play if you are making use of the setting URLEncryption=true and SubmitObfuscatedURL=Required as described in the following article:
For items showing up on the report, the end result might be that such requests would get rejected with URL Encryption. If you are not planning to use the exact settings above, then these findings are not relevant.
I was not able to find any suggested method to avoid this scenario in the tool.