(self, headers: Dict[str, str], url: str)
| 907 | return body, headers, [c for c in cookies if c], final_url |
| 908 | |
| 909 | async def check_security_headers(self, headers: Dict[str, str], url: str) -> None: |
| 910 | for key, (title, severity) in SEC_HEADERS.items(): |
| 911 | if key not in headers: |
| 912 | self.add_finding(Finding( |
| 913 | category="Missing_Security_Header", |
| 914 | severity=severity, |
| 915 | url=url, |
| 916 | details=f"Missing header: {key} ({title})", |
| 917 | )) |
| 918 | |
| 919 | # Cookie flags |
| 920 | # We can't reliably parse all cookies without a library; do a best-effort for Set-Cookie header strings. |
| 921 | set_cookies = headers.get("set-cookie", "") |
| 922 | if set_cookies: |
| 923 | # Split on comma only when it looks like multiple cookies; best-effort |
| 924 | parts = re.split(r",(?=[^;]+?=)", set_cookies) |
| 925 | for c in parts: |
| 926 | c_l = c.lower() |
| 927 | missing: List[str] = [] |
| 928 | if "secure" not in c_l and self.scheme == "https": |
| 929 | missing.append("Secure") |
| 930 | if "httponly" not in c_l: |
| 931 | missing.append("HttpOnly") |
| 932 | if "samesite" not in c_l: |
| 933 | missing.append("SameSite") |
| 934 | if missing: |
| 935 | self.add_finding(Finding( |
| 936 | category="Cookie_Flags_Missing", |
| 937 | severity="Low", |
| 938 | url=url, |
| 939 | details=f"Cookie missing flags: {', '.join(missing)}", |
| 940 | evidence=c.strip()[:200], |
| 941 | remediation=" ".join(COOKIE_FLAG_REMEDIATION[m] for m in missing if m in COOKIE_FLAG_REMEDIATION) |
| 942 | )) |
| 943 | |
| 944 | async def detect_tech(self, headers: Dict[str, str], body: str, url: str) -> None: |
| 945 | # Correct header matching: build "key: value" lines and search |
no test coverage detected