mirror of
https://github.com/drwetter/testssl.sh.git
synced 2026-06-23 08:47:38 +02:00
potato-20
57fc5850d1
Revives and rebases #1809 by @tosticated (Jim Blankendaal) onto 3.3dev. When --phone-out is set, run_hsts now queries https://hstspreload.org/api/v2/status and reports whether the domain is on the browser HSTS preload list (preloaded/pending/rejected/unknown), cross-referenced with the served header, the same-domain check and the bulk flag. Addresses the review comments on #1809: the API-response matching uses native bash string matching instead of forking grep, the JSON quoting is handled inside check_hsts_preloadlist_match() so callers pass plain values, and the value arrays use 'local -a'. The output decision table is kept as-is (per maintainer feedback). Adds t/53_hsts_preload.t. Original design and decision table by @tosticated.
Naming scheme
- 00-05: Does the bare testssl.sh work at all?
- 10-29: Do scans work fine (client side)?
- 30-39: Does reporting work?
- 50-69: Are the results what I expect (server side)?
Please help to write CI tests! Documentation can be found here.
You can consult the existing code here. Feel free to use 10_baseline_ipv4_http.t or 12_diff_opensslversions.t as a
template. The latter is newer and code is cleaner.
03_debug.t.DISABLEDis a handy tool when the runner is not in line with checks outside github. It provides debugging means- IPv6 was (status 2025) not allowed, thus the file
11_baseline_ipv6_http.t.DISABLEDwhich can be renamed if that will change.