feat: add info severity

cmd/scan/root.go

@@ -14,7 +14,7 @@ import (
 var reporter *report.Reporter
 
 func severityTableColor(v *report.VulnerabilityReport) int {
-	if v.IsLowRiskSeverity() {
+	if v.IsLowRiskSeverity() || v.IsInfoRiskSeverity() {
 		return tablewriter.BgBlueColor
 	} else if v.IsMediumRiskSeverity() {
 		return tablewriter.FgYellowColor

report/vuln.go

@@ -26,6 +26,10 @@ func (vr *VulnerabilityReport) IsHighRiskSeverity() bool {
 	return vr.SeverityLevel > 7
 }
 
+func (vr *VulnerabilityReport) IsInfoRiskSeverity() bool {
+	return vr.SeverityLevel == 0
+}
+
 func (vr *VulnerabilityReport) String() string {
 	return fmt.Sprintf("[%s][%s] %s %s: %s", vr.SeverityLevelString(), vr.Name, vr.Operation.Method, vr.Operation.Request.URL.String(), vr.Description)
 }
@@ -39,6 +43,8 @@ func (vr *VulnerabilityReport) SeverityLevelString() string {
 		return "Medium"
 	} else if vr.SeverityLevel < 4 && vr.SeverityLevel >= 0.1 {
 		return "Low"
+	} else if vr.SeverityLevel == 0 {
+		return "Info"
 	} else {
 		return "None"
 	}

scan/best_practices/http_cookies.go

@@ -10,19 +10,19 @@ import (
 )
 
 const (
-	HTTPCookiesNotHTTPOnlySeverityLevel            = 1
+	HTTPCookiesNotHTTPOnlySeverityLevel            = 0
 	HTTPCookiesNotHTTPOnlyVulnerabilityName        = "Cookies not HTTP-Only"
 	HTTPCookiesNotHTTPOnlyVulnerabilityDescription = "Cookies should be http-only."
 
-	HTTPCookiesNotSecureSeverityLevel            = 1
+	HTTPCookiesNotSecureSeverityLevel            = 0
 	HTTPCookiesNotSecureVulnerabilityName        = "Cookies not Secure"
 	HTTPCookiesNotSecureVulnerabilityDescription = "Cookies should be secure."
 
-	HTTPCookiesSameSiteSeverityLevel            = 1
+	HTTPCookiesSameSiteSeverityLevel            = 0
 	HTTPCookiesSameSiteVulnerabilityName        = "Cookies SameSite not set or set to None"
 	HTTPCookiesSameSiteVulnerabilityDescription = "Cookies should have SameSite attribute set to Strict or Lax."
 
-	HTTPCookiesExpiresSeverityLevel            = 1
+	HTTPCookiesExpiresSeverityLevel            = 0
 	HTTPCookiesExpiresVulnerabilityName        = "Cookies Expires not set"
 	HTTPCookiesExpiresVulnerabilityDescription = "Cookies should have Expires attribute set."
 )

scan/best_practices/http_headers.go

@@ -19,27 +19,27 @@ const (
 )
 
 const (
-	CSPHTTPHeaderSeverityLevel                                  = 1
+	CSPHTTPHeaderSeverityLevel                                  = 0
 	CSPHTTPHeaderIsNotSetVulnerabilityName                      = "CSP Header is not set"
 	CSPHTTPHeaderIsNotSetVulnerabilityDescription               = "No Content Security Policy (CSP) Header has been detected in HTTP Response."
 	CSPHTTPHeaderFrameAncestorsIsNotSetVulnerabilityName        = "CSP frame-ancestors policy is not set"
 	CSPHTTPHeaderFrameAncestorsIsNotSetVulnerabilityDescription = "No frame-ancestors policy has been set in CSP HTTP Response Header."
 
-	HSTSHTTPHeaderSeverityLevel                    = 1
+	HSTSHTTPHeaderSeverityLevel                    = 0
 	HSTSHTTPHeaderIsNotSetVulnerabilityName        = "HSTS Header is not set"
 	HSTSHTTPHeaderIsNotSetVulnerabilityDescription = "No HSTS Header has been detected in HTTP Response."
 
-	CORSHTTPHeaderSeverityLevel                       = 1
+	CORSHTTPHeaderSeverityLevel                       = 0
 	CORSHTTPHeaderIsNotSetVulnerabilityName           = "CORS Header is not set"
 	CORSHTTPHeaderIsNotSetVulnerabilityDescription    = "No CORS Header has been detected in HTTP Response."
 	CORSHTTPHeaderIsPermisiveVulnerabilityName        = "CORS Header is set but permissive"
 	CORSHTTPHeaderIsPermisiveVulnerabilityDescription = "CORS Header has been detected in HTTP Response but is permissive."
 
-	XContentTypeOptionsHTTPHeaderIsNotSetSeverityLevel            = 1
+	XContentTypeOptionsHTTPHeaderIsNotSetSeverityLevel            = 0
 	XContentTypeOptionsHTTPHeaderIsNotSetVulnerabilityName        = "X-Content-Type-Options Header is not set"
 	XContentTypeOptionsHTTPHeaderIsNotSetVulnerabilityDescription = "No X-Content-Type-Options Header has been detected in HTTP Response."
 
-	XFrameOptionsHTTPHeaderIsNotSetSeverityLevel            = 1
+	XFrameOptionsHTTPHeaderIsNotSetSeverityLevel            = 0
 	XFrameOptionsHTTPHeaderIsNotSetVulnerabilityName        = "X-Frame-Options Header is not set"
 	XFrameOptionsHTTPHeaderIsNotSetVulnerabilityDescription = "No X-Frame-Options Header has been detected in HTTP Response."
 )

scan/best_practices/http_trace_method.go

@@ -8,7 +8,7 @@ import (
 )
 
 const (
-	HTTPTraceMethodSeverityLevel            = 1
+	HTTPTraceMethodSeverityLevel            = 0
 	HTTPTraceMethodVulnerabilityName        = "HTTP Trace Method enabled"
 	HTTPTraceMethodVulnerabilityDescription = "HTTP Trace method seems enabled for this request."
 )

scan/discover/discoverable_openapi.go

@@ -11,7 +11,7 @@ import (
 )
 
 const (
-	DiscoverableOpenAPISeverityLevel            = 1
+	DiscoverableOpenAPISeverityLevel            = 0
 	DiscoverableOpenAPIVulnerabilityName        = "Discoverable OpenAPI"
 	DiscoverableOpenAPIVulnerabilityDescription = "An OpenAPI file is exposed without protection. This can lead to information disclosure and security issues"
 )

scan/discover/graphql.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	GraphqlIntrospectionEnabledSeverityLevel            = 1
+	GraphqlIntrospectionEnabledSeverityLevel            = 0
 	GraphqlIntrospectionEnabledVulnerabilityName        = "GraphQL Introspection enabled"
 	GraphqlIntrospectionEnabledVulnerabilityDescription = "GraphQL Introspection seems enabled and can lead to information disclosure and security issues"
 )

scan/discover/server_signature.go

@@ -8,7 +8,7 @@ import (
 )
 
 const (
-	ServerSignatureSeverityLevel            = 1
+	ServerSignatureSeverityLevel            = 0
 	ServerSignatureVulnerabilityName        = "Server Signature Exposed"
 	ServerSignatureVulnerabilityDescription = "A Server signature is exposed in an header."
 )