Remove non standard header findings and add deprecated headers findings

boefjes/boefjes/plugins/kat_kat_finding_types/kat_finding_types.json

@@ -473,5 +473,12 @@
     "risk": "medium",
     "impact": "Disallowed domains are domains that are for example 'world writable', this opens up the possibility for an atacker to host malicious files on a csp whitelisted domain.",
     "recommendation": "Remove the offending hostname from the CSP header."
+  },
+  "KAT-DEPRECATED-HEADERS": {
+    "description": "Headers are used that are deprecated and should not be used anymore.",
+    "risk": "low",
+    "source": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers",
+    "impact": "Deprecated headers may not be supported by all browsers and may not provide the security that is expected.",
+    "recommendation": "Remove the deprecated headers from the response."
   }
 }

octopoes/bits/missing_headers/missing_headers.py

@@ -5,6 +5,16 @@
 from octopoes.models.ooi.findings import Finding, KATFindingType
 from octopoes.models.ooi.web import HTTPHeader, HTTPResource
 
+DEPRECATED_HEADER = {
+    "x-forwarded-host",
+    "x-forwarded-proto",
+    "x-dns-prefetch-control",
+    "x-forwarded-for",
+    "x-robots-tag",
+    "pragma",
+    "warning",
+}
+
 
 def run(resource: HTTPResource, additional_oois: list[HTTPHeader], config: dict[str, Any]) -> Iterator[OOI]:
     if not additional_oois:
@@ -35,26 +45,6 @@ def run(resource: HTTPResource, additional_oois: list[HTTPHeader], config: dict[
         yield ft
         yield finding
 
-    if "x-permitted-cross-domain-policies" not in header_keys:
-        ft = KATFindingType(id="KAT-NO-X-PERMITTED-CROSS-DOMAIN-POLICIES")
-        finding = Finding(
-            finding_type=ft.reference,
-            ooi=resource.reference,
-            description="Header x-permitted-cross-domain-policies is missing or not configured correctly.",
-        )
-        yield ft
-        yield finding
-
-    if "x-xss-protection" not in header_keys:
-        ft = KATFindingType(id="KAT-NO-EXPLICIT-XSS-PROTECTION")
-        finding = Finding(
-            finding_type=ft.reference,
-            ooi=resource.reference,
-            description="Header x-xss-protection is missing or not configured correctly.",
-        )
-        yield ft
-        yield finding
-
     if "x-frame-options" not in header_keys:
         ft = KATFindingType(id="KAT-NO-X-FRAME-OPTIONS")
         finding = Finding(
@@ -65,16 +55,6 @@ def run(resource: HTTPResource, additional_oois: list[HTTPHeader], config: dict[
         yield ft
         yield finding
 
-    if "x-dns-prefetch-control" not in header_keys:
-        ft = KATFindingType(id="KAT-NO-X-DNS-PREFETCH-CONTROL")
-        finding = Finding(
-            finding_type=ft.reference,
-            ooi=resource.reference,
-            description="Header x-dns-prefetch-control is missing or not configured correctly.",
-        )
-        yield ft
-        yield finding
-
     if "permissions-policy" not in header_keys:
         ft = KATFindingType(id="KAT-NO-PERMISSIONS-POLICY")
         finding = Finding(
@@ -104,3 +84,14 @@ def run(resource: HTTPResource, additional_oois: list[HTTPHeader], config: dict[
         )
         yield ft
         yield finding
+
+    if set(header_keys) & DEPRECATED_HEADER:
+        ft = KATFindingType(id="KAT-DEPRECATED-HEADERS")
+        finding = Finding(
+            finding_type=ft.reference,
+            ooi=resource.reference,
+            description=f"Deprecated headers are used. Avoid using the following headers: "
+            f"{' '.join(DEPRECATED_HEADER & set(header_keys))}",
+        )
+        yield ft
+        yield finding

octopoes/tests/test_bit_missing_headers.py

@@ -39,3 +39,16 @@ def test_http_no_hsts(http_resource_http):
     hsts_findings = [r for r in results if r.object_type == "Finding" and r.finding_type.natural_key == "KAT-NO-HSTS"]
 
     assert not hsts_findings
+
+
+def test_deprecated_header(http_resource_https):
+    headers = [
+        HTTPHeader(resource=http_resource_https.reference, key="x-forwarded-for", value="DENY"),
+    ]
+
+    results = list(run(http_resource_https, headers, {}))
+    deprecated_headers_findings = [
+        r for r in results if r.object_type == "Finding" and r.finding_type.natural_key == "KAT-DEPRECATED-HEADERS"
+    ]
+
+    assert len(deprecated_headers_findings) == 1