Skip to content

Commit 7fd9c21

Browse files
author
hp23 Server
committed
Update README and improve configuration settings
1 parent a1d0f7a commit 7fd9c21

21 files changed

+313
-1498
lines changed

‎CITATION.cff‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
cff-version: 1.2.0
2+
message: If you use this software, please cite both the article from preferred-citation and the software itself.
3+
authors:
4+
- family-names: Rautenstrauch
5+
given-names: Jannis
6+
- family-names: Nguyen
7+
given-names: Trung Tin
8+
- family-names: Ramakrishnan
9+
given-names: Karthik
10+
- family-names: Stock
11+
given-names: Ben
12+
title: Head(er)s Up! Detecting Security Header Inconsistencies in Browsers
13+
version: 1.0.0
14+
url: TODO
15+
doi: TODO
16+
date-released: '2025-09-01'
17+
preferred-citation:
18+
authors:
19+
- family-names: Rautenstrauch
20+
given-names: Jannis
21+
- family-names: Nguyen
22+
given-names: Trung Tin
23+
- family-names: Ramakrishnan
24+
given-names: Karthik
25+
- family-names: Stock
26+
given-names: Ben
27+
title: Head(er)s Up! Detecting Security Header Inconsistencies in Browsers
28+
doi: TODO
29+
url: TODO
30+
type: conference-paper
31+
pages: TODO
32+
year: 'TODO'
33+
isbn: 'TODO'
34+
collection-title: Proceedings of the 32nd ACM Conference on Computer and Communications Security
35+
conference:
36+
name: CCS '25
37+
publisher:
38+
name: Association for Computing Machinery
39+
address: New York, NY, USA

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ COPY entrypoint.sh /app/entrypoint.sh
2929
RUN chmod +x /app/entrypoint.sh
3030

3131
# Expose ports
32-
EXPOSE 80 443 8443 9000
32+
EXPOSE 80 443
3333

3434
# WORKDIR /app
3535

‎README.md‎

Lines changed: 187 additions & 173 deletions
Large diffs are not rendered by default.

‎TODOS.md‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎_hp/common/frame-script-csp.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
</head>
66

77
<body>
8-
<script src="https://sub.headers.websec.saarland/_hp/common/frame-script-csp.js"></script>
8+
<script src="https://sub.{base_host}/_hp/common/frame-script-csp.js"></script>
99
</body>
1010

1111
</html>

‎_hp/hp/test_external_api.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -64,24 +64,24 @@ def test_store_results():
6464
body = {
6565
"tests": [
6666
{
67-
"name": "referrer_iframe|false|window.open|http://sub.headers.websec.saarland|199",
68-
"outcome": "document.referrer: http://sub.headers.websec.saarland/_hp/server/responses.py?feature_group=rp&resp_id=199&count=1&nest=1&origin=http://sub.headers.websec.saarland&element=window.open&resp=1",
67+
"name": f"referrer_iframe|false|window.open|http://{base_host}|199",
68+
"outcome": f"document.referrer: http://{base_host}/_hp/server/responses.py?feature_group=rp&resp_id=199&count=1&nest=1&origin=http://{base_host}&element=window.open&resp=1",
6969
"status": 0,
7070
"message": None,
7171
"stack": None,
7272
"resp_scheme": "http",
73-
"resp_host": "sub.headers.websec.saarland",
73+
"resp_host": f"{base_host}",
7474
"relation": "window.open",
7575
}
7676
],
7777
"browser_id": "1",
78-
"test": "http://sub.headers.websec.saarland/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=199&last_id=199&scheme=http&t_resp_id=199&t_element_relation=iframe_window.open&t_resp_origin=http://sub.headers.websec.saarland",
78+
"test": f"http://{base_host}/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=199&last_id=199&scheme=http&t_resp_id=199&t_element_relation=iframe_window.open&t_resp_origin=http://{base_host}",
7979
"status": 0,
8080
"message": None,
8181
"stack": None,
8282
"org_scheme": "http",
83-
"org_host": "sub.headers.websec.saarland",
84-
"full_url": "http://sub.headers.websec.saarland/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=199&last_id=199&scheme=http&t_resp_id=199&t_element_relation=iframe_window.open&t_resp_origin=http://sub.headers.websec.saarland",
83+
"org_host": f"{base_host}",
84+
"full_url": f"http://{base_host}/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=199&last_id=199&scheme=http&t_resp_id=199&t_element_relation=iframe_window.open&t_resp_origin=http://{base_host}",
8585
}
8686

8787
resp = httpx.post(

‎_hp/hp/tools/crawler/create_ipados_browser.py‎ renamed to ‎_hp/hp/tools/crawler/create_generic_browser.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@
77
browser_version = "122.0.6261.89"
88

99
browser_id = get_or_create_browser(browser_name, browser_version, 'iPadOS 17.3.1', 'real', 'intent', '')
10-
print(browser_id)
10+
print(f"Browser ID: {browser_id}")

‎_hp/hp/tools/crawler/logs/.gitkeep‎

Whitespace-only changes.

‎_hp/hp/tools/crawler/selenium_run_specific.py‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
from selenium.webdriver.support.wait import WebDriverWait
44
from selenium.webdriver.support import expected_conditions as EC
55
from hp.tools.crawler.desktop_selenium import get_browser
6+
import json
67

78

89
def run_specific(url, browser_name, browser_version, binary_location, arguments):
@@ -28,10 +29,18 @@ def run_specific(url, browser_name, browser_version, binary_location, arguments)
2829
print(f"Visited, {browser_name}")
2930
driver.close()
3031

32+
try:
33+
wpt_config = json.load(open("/app/_hp/wpt-config.json"))
34+
except OSError:
35+
try:
36+
wpt_config = json.load(open("../../wpt-config.json"))
37+
except OSError:
38+
wpt_config = json.load(open("../../../wpt-config.json"))
39+
base_host = wpt_config["browser_host"]
3140

3241
if __name__ == "__main__":
3342
# Configure URL and Browser to visit for manual verification/testing
34-
url = "http://sub.headers.websec.saarland/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=199&last_id=199&scheme=http&t_resp_id=199&t_element_relation=iframe_window.open&t_resp_origin=http://sub.headers.websec.saarland"
43+
url = f"http://sub.{base_host}/_hp/tests/referrer-access-rp.sub.html?resp_type=basic&browser_id=1&label=RP&first_id=199&last_id=199&scheme=http&t_resp_id=199&t_element_relation=iframe_window.open&t_resp_origin=http://sub.{base_host}"
3544
config = [
3645
# Browsers (managed by Selenium itself)
3746
# Released 2024-01-23

‎_hp/hp/tools/create_responses.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
"""
22
Generates all debug and basic responses.
3-
Parsing responses are generated in analysis/response_header_generation.ipynb
3+
Parsing responses are generated in response_header_generation.py
44
"""
55
from hp.tools.models import Response, Session
66

@@ -310,7 +310,6 @@ def create_responses(header_list, label, status_code=200, resp_type="debug"):
310310
[(header_name, f"{v1}, {v2}, {v3}, {v4}, {v5}, {v6}, {v7}")],
311311
[(header_name, f"abc, {v1}")]
312312
]
313-
# TODO
314313
# [["Strict-Transport-Security", "max-age=20"], ["Strict-Transport-Security", "max-age=20; includeSubDomains"], ["Strict-Transport-Security", "includeSubDomains"], ["Strict-Transport-Security", ""], ["Strict-Transport-Security", "max-age=20; includeSubDomains; preload"], ["Strict-Transport-Security", "max-age=0"], ["Strict-Transport-Security", "max-age=-5"]]
315314
create_responses(header_list, label, resp_type="basic")
316315
# Some basic headers with redirect

0 commit comments

Comments
 (0)