fix(matrix): DAST needs an http(s) endpoint; don't offer/run it on modbus:// #182
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sharang/compliance-scanner-agent#182
Reference in New Issue
Block a user
Demo C finding: a PlcSps target reachable only over Modbus (modbus://plc-sim:502) still marked DAST applicable, so DAST could be enabled and then failed at reconnaissance (it's an HTTP crawler).
ArtifactRequirement::HttpUrl(live URL with http(s) scheme); the 3 DAST rules use it, the ICS probe keepsRunningUrl(works off host:port of any scheme). modbus:// now blocks DAST with a clear reason.plan.has(Dast)so a leftover DAST target can't re-trigger against a non-web device.Demo C surfaced this: a PlcSps target whose only live URL is an industrial endpoint (modbus://plc-sim:502) still marked DAST applicable, so it could be enabled and then failed at reconnaissance — DAST is an HTTP crawler and the endpoint speaks raw Modbus. - Add ArtifactRequirement::HttpUrl (a live URL with an http(s) scheme) and point the three DAST rules (WebApp/BackendService, EmbeddedLinuxYocto, PlcSps) at it. The ICS probe keeps RunningUrl — it works off host:port of any scheme. A modbus:// endpoint now blocks DAST with a clear reason ("no http(s) live URL — DAST needs a web endpoint") so the wizard no longer offers it as an opt-in. - Gate the PLC-path DAST trigger on plan.has(Dast), not just plc||ics, so a DAST target left over from an earlier run can't re-trigger against a non-web device. Tests: PlcSps + modbus:// offers ICS probe but blocks DAST; PlcSps + http WebVisu offers both. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>