{"action":"opened","issue":{"url":"https://api.github.com/repos/thesp0nge/dawnscanner/issues/150","labels_url":"https://api.github.com/repos/thesp0nge/dawnscanner/issues/150/labels{/name}","comments_url":"https://api.github.com/repos/thesp0nge/dawnscanner/issues/150/comments","events_url":"https://api.github.com/repos/thesp0nge/dawnscanner/issues/150/events","html_url":"https://github.com/thesp0nge/dawnscanner/issues/150","id":117600455,"number":150,"title":"Add Maven support","user":{"login":"thesp0nge","id":143166,"avatar_url":"https://avatars.githubusercontent.com/u/143166?v=3","gravatar_id":"","url":"https://api.github.com/users/thesp0nge","html_url":"https://github.com/thesp0nge","followers_url":"https://api.github.com/users/thesp0nge/followers","following_url":"https://api.github.com/users/thesp0nge/following{/other_user}","gists_url":"https://api.github.com/users/thesp0nge/gists{/gist_id}","starred_url":"https://api.github.com/users/thesp0nge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thesp0nge/subscriptions","organizations_url":"https://api.github.com/users/thesp0nge/orgs","repos_url":"https://api.github.com/users/thesp0nge/repos","events_url":"https://api.github.com/users/thesp0nge/events{/privacy}","received_events_url":"https://api.github.com/users/thesp0nge/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/thesp0nge/dawnscanner/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"thesp0nge","id":143166,"avatar_url":"https://avatars.githubusercontent.com/u/143166?v=3","gravatar_id":"","url":"https://api.github.com/users/thesp0nge","html_url":"https://github.com/thesp0nge","followers_url":"https://api.github.com/users/thesp0nge/followers","following_url":"https://api.github.com/users/thesp0nge/following{/other_user}","gists_url":"https://api.github.com/users/thesp0nge/gists{/gist_id}","starred_url":"https://api.github.com/users/thesp0nge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thesp0nge/subscriptions","organizations_url":"https://api.github.com/users/thesp0nge/orgs","repos_url":"https://api.github.com/users/thesp0nge/repos","events_url":"https://api.github.com/users/thesp0nge/events{/privacy}","received_events_url":"https://api.github.com/users/thesp0nge/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/thesp0nge/dawnscanner/milestones/4","html_url":"https://github.com/thesp0nge/dawnscanner/milestones/Version%202.0.0%20-%20Finn%20McMissile","labels_url":"https://api.github.com/repos/thesp0nge/dawnscanner/milestones/4/labels","id":610870,"number":4,"title":"Version 2.0.0 - Finn McMissile","description":"New supported frameworks\r\n\r\n* Add Lotus support\r\n* Add Maven support (this will lead of creating the skeleton of a dawnscanner-java gem. I will decide later if it will stay with the core or if it will be a separted gem plugging into dawnscanner as plugin).\r\n* Add support for pure Rack applications\r\n* Add basic support for Javascript. At the beginning, it will be a signature based support. dawnscanner will try to detect the js library version by using SHA hashing functions, comparing it with fingerprint of vulnerable libraies. Of course, this will lead to false negatives if a user tamper the original JS. We must consider also minified versions and we're not able to deal with obfuscated code.\r\n\r\nNew checks\r\n* Add a language check. It will handle a ruby script as input and a ruby_parser line as unsafe pattern. It will compile the ruby and look for the unsafe pattern\r\n* Cross Site Scripting, SQL injection and CSRF detection: it must be done for all MVC frameworks (including Rack) and it must cover either reflected than stored attack patterns\r\n* Security checks for vulnerabilities out until 31 May 2016.\r\n\r\nNew features\r\n* Separate dependencies check from model, view and controller analysis.\r\n* Add a '--ab-decision' flag. Can be a good idea to make dawnscanner able just to say a quick \"go/no go\" for a release with a small json output like {decision:\"GO\", vulns: 12, mean_cvss: 3.2} or {decision:\"NO GO\", vulns: 9, mean_cvss:9.2}\r\n* Add a --github option to Dawnscanner to clone a remote repository, perform a bundle install and do a code review.\r\n* SQLite3 integration for saving data. Each project will have its own SQLite database containing reviews, findings and all. A table with Dawnscanner version it created the database will be inserted as well\r\n* Add source code metrics gathering (lines of code, lines of comments, cyclomatic complexity index, ...)\r\n* Add a ruby deprecation check, accordingly to https://bugs.ruby-lang.org/projects/ruby/wiki/ReleaseEngineering\r\n* Add support for github hooks\r\n* Add a new way to handle KB. Like wpscan, the KB must be separated and deployed using dawnscanner.org web site and a --update flag, people can use to upgrade and have new checks. Of course, new checks would be also rely on newer APIs, so a require dawnscanner info must be given and user forced also to upgrade the tool. KB download must be digitally signed and encrypted.","creator":{"login":"thesp0nge","id":143166,"avatar_url":"https://avatars.githubusercontent.com/u/143166?v=3","gravatar_id":"","url":"https://api.github.com/users/thesp0nge","html_url":"https://github.com/thesp0nge","followers_url":"https://api.github.com/users/thesp0nge/followers","following_url":"https://api.github.com/users/thesp0nge/following{/other_user}","gists_url":"https://api.github.com/users/thesp0nge/gists{/gist_id}","starred_url":"https://api.github.com/users/thesp0nge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thesp0nge/subscriptions","organizations_url":"https://api.github.com/users/thesp0nge/orgs","repos_url":"https://api.github.com/users/thesp0nge/repos","events_url":"https://api.github.com/users/thesp0nge/events{/privacy}","received_events_url":"https://api.github.com/users/thesp0nge/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":0,"state":"open","created_at":"2014-03-26T16:35:42Z","updated_at":"2015-11-18T14:40:31Z","due_on":"2016-06-29T22:00:00Z","closed_at":null},"comments":0,"created_at":"2015-11-18T14:40:31Z","updated_at":"2015-11-18T14:40:31Z","closed_at":null,"body":"Add Maven support (this will lead of creating the skeleton of a dawnscanner-java gem. I will decide later if it will stay with the core or if it will be a separted gem plugging into dawnscanner as plugin)."}}