Skip to content

Commit 6f199f6

Browse files
authored
Merge pull request #218 from righettod/master
Add stats tab (further work).
2 parents 1a15743 + 5c5f0bf commit 6f199f6

24 files changed

+46
-151
lines changed

.github/workflows/tab-stats-headers-generate-related-files.yml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
name: update_tab_stats_related_files
22
on:
33
workflow_dispatch:
4-
push:
54
schedule:
6-
- cron: '0 0 3 * *'
5+
- cron: '0 0 3 * *'
6+
push:
7+
paths:
8+
- 'ci/tab_stats_generate_md_file.py'
9+
- 'ci/tab_stats_generate_png_files.sh'
10+
- 'ci/tab_stats_manage_generation.sh'
711
jobs:
812
build:
913
runs-on: ubuntu-latest
@@ -19,7 +23,7 @@ jobs:
1923
run: |
2024
python -m pip install --upgrade pip
2125
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
22-
sudo apt install wget
26+
sudo apt install -y wget dos2unix
2327
- name: Run update of the tab related files
2428
run: |
2529
cd ci; bash tab_stats_manage_generation.sh

README.md

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,16 @@
33
![OSHP Logo](assets/images/oshp_logo.png)
44

55
[![OWASP Production](https://img.shields.io/badge/owasp-production%20project-800080.svg)](https://www.owasp.org/projects)
6+
67
[![External Links Validity Check](https://github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml)
8+
79
[![Update headers reference JSON files](https://github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml)
8-
[![Update monitoring technical references dashboard](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml) [![Perform_monitoring_oshp_site_references](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml)
10+
11+
[![Update monitoring technical references dashboard](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml)
12+
13+
[![Perform_monitoring_oshp_site_references](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml)
14+
15+
[![update_tab_stats_related_files](https://github.com/OWASP/www-project-secure-headers/actions/workflows/tab-stats-headers-generate-related-files.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/tab-stats-headers-generate-related-files.yml)
916

1017
🎯 The **OWASP Secure Headers Project** (also named **OSHP**) describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities. The OWASP Secure Headers Project intends to raise awareness and use of these headers.
1118

@@ -17,7 +24,7 @@
1724

1825
📚 We aim to publish reports on header usage stats, developments and changes, code libraries that make these headers easily accessible to developers on a range of platforms, and data sets concerning the general usage of these headers.
1926

20-
🌐 The OWASP Secure Headers Project was migrated to a [new OWASP website](https://owasp.org/www-project-secure-headers/).
27+
🌍 The OWASP Secure Headers Project was migrated to a [new OWASP website](https://owasp.org/www-project-secure-headers/).
2128

2229
📁 You can still access the old website [here](https://wiki.owasp.org/index.php/OWASP_Secure_Headers_Project).
2330

@@ -36,19 +43,28 @@
3643

3744
👩‍💻 Content editing is done with [Visual Studio Code](https://code.visualstudio.com/).
3845

39-
A [workspace file](project.code-workspace) is provided with [recommended extensions](.vscode/extensions.json).
46+
📦 A [workspace file](project.code-workspace) is provided with [recommended extensions](.vscode/extensions.json).
4047

4148
## Automatically generated content
4249

4350
🏭 The folder [ci](ci) (**CI** for **C**ontinuous **I**ntegration) contains materials to generate the following content.
4451

45-
📝 Generate the both JSON files containing the header recommended to add and remove:
52+
📝 Generation of the both JSON files containing the header recommended to add and remove:
53+
54+
* Processing is performed by this GitHub action [workflow](.github/workflows/headers-generate-json-files.yml) every time the file [tab_bestpractices.md](tab_bestpractices.md) is modified.
55+
56+
📝 Generation of the [markdown file](monitoring_technical_references_dashboard.md) with the update health state of all GitHub repositories mentioned in the tab named **[Technical](tab_technical.md)**:
4657

47-
* Generation is performed by this GitHub action [workflow](.github/workflows/headers-generate-json-files.yml) every time the file [tab_bestpractices.md](tab_bestpractices.md) is modified.
58+
* Processing is performed by this GitHub action [workflow](.github/workflows/monitoring-technical-references-generate-dashboard.yml) every week with a cron expression indicating `At 00:00 on Sunday` or every time the file [tab_technical.md](tab_technical.md) is modified.
4859

49-
📝 Generate the [markdown file](monitoring_technical_references_dashboard.md) with the update health state of all GitHub repositories mentioned in the tab named **[Technical](tab_technical.md)**:
60+
📝 Generation of the file [tab_statistics.md](tab_statistics.md) as well as [all related PNG files](assets/tab_stats_generated_images):
5061

51-
* Generation is performed by this GitHub action [workflow](.github/workflows/monitoring-technical-references-generate-dashboard.yml) every time the file [tab_technical.md](tab_technical.md) is modified.
62+
* Processing is performed by this GitHub action [workflow](.github/workflows/tab-stats-headers-generate-related-files.yml) every month with a cron expression indicating `At 00:00 on day-of-month 3` or every time any of the following files is modified:
63+
* [ci/tab_stats_manage_generation.sh](ci/tab_stats_manage_generation.sh).
64+
* [ci/tab_stats_generate_md_file.py](ci/tab_stats_generate_md_file.py).
65+
* [ci/tab_stats_generate_png_files.sh](ci/tab_stats_generate_png_files.sh).
66+
* The specified cron expression was selected because the database containing the data used by the script [tab_stats_generate_md_file.py](ci/tab_stats_generate_md_file.py) is updated on the first day of each month by the project [oshp-stats](https://github.com/oshp/oshp-stats/):
67+
* See [here](https://github.com/oshp/oshp-stats/blob/main/.github/workflows/update-datasource.yml) for technical details.
5268

5369
## Social media communication
5470

Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading

ci/tab_stats_generate_md_file.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/usr/bin/python3
22
"""
33
Script using the gathered data from the OSHP project "oshp-stats" to generate/update the
4-
markdown file "tab_stats.md" with mermaid pie charts with differents statistics about HTTP security headers usage.
4+
markdown file "tab_statistics.md" with mermaid pie charts with differents statistics about HTTP security headers usage.
55
66
Source:
77
https://mermaid-js.github.io/mermaid/#/pie
@@ -19,14 +19,14 @@
1919
HTTP_REQUEST_TIMEOUT = 60
2020
DATA_DB_FILE = "/tmp/data.db"
2121
OSHP_SECURITY_HEADERS_FILE_lOCATION = "https://owasp.org/www-project-secure-headers/ci/headers_add.json"
22-
MD_FILE = "../tab_stats.md"
22+
MD_FILE = "../tab_statistics.md"
2323
IMAGE_FOLDER_LOCATION = "../assets/tab_stats_generated_images"
2424
TAB_MD_TEMPLATE = """---
2525
title: statistics
2626
displaytext: Statistics
2727
layout: null
2828
tab: true
29-
order: 10
29+
order: 7
3030
tags: headers
3131
---
3232

ci/tab_stats_manage_generation.sh

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
#!/bin/bash
22
#########################################################################
33
# This script manage the generation/update of the tab represented by the
4-
# file "tab_stats.md".
4+
# file "tab_statistics.md".
55
#########################################################################
66
DATA_DB_FILE_LOCATION="https://github.com/oshp/oshp-stats/raw/refs/heads/main/data/data.db"
77
DATA_DB_FILE="/tmp/data.db"
88
echo "[+] Download the database of headers analysis..."
99
wget -q -O $DATA_DB_FILE $DATA_DB_FILE_LOCATION
1010
file $DATA_DB_FILE
11+
echo "[+] Set correct access rights for the scripts as well as UNIX CRLF settings..."
12+
dos2unix tab_stats_generate_*
1113
chmod +x tab_stats_generate_*
1214
echo "[+] Generate the MD file of the TAB and all the MMD files for every pie chart image..."
1315
python tab_stats_generate_md_file.py

index.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,16 @@ pitch: Provides technical information about HTTP security headers.
1616
![OSHP Logo](assets/images/oshp_logo.png)
1717

1818
[![OWASP Production](https://img.shields.io/badge/owasp-production%20project-800080.svg)](https://www.owasp.org/projects)
19+
1920
[![External Links Validity Check](https://github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml)
21+
2022
[![Update headers reference JSON files](https://github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml)
21-
[![Update monitoring technical references dashboard](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml) [![Perform_monitoring_oshp_site_references](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml)
23+
24+
[![Update monitoring technical references dashboard](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml)
25+
26+
[![Perform_monitoring_oshp_site_references](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-oshp-site-references.yml)
27+
28+
[![update_tab_stats_related_files](https://github.com/OWASP/www-project-secure-headers/actions/workflows/tab-stats-headers-generate-related-files.yml/badge.svg?branch=master)](https://github.com/OWASP/www-project-secure-headers/actions/workflows/tab-stats-headers-generate-related-files.yml)
2229

2330
🎯 The **OWASP Secure Headers Project** (also called **OSHP**) describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities. The OWASP Secure Headers Project intends to raise awareness and use of these headers.
2431

tab_stats.md renamed to tab_statistics.md

Lines changed: 2 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: statistics
33
displaytext: Statistics
44
layout: null
55
tab: true
6-
order: 10
6+
order: 7
77
tags: headers
88
---
99

@@ -15,108 +15,92 @@ tags: headers
1515

1616
<!-- markdown-link-check-disable -->
1717

18-
19-
20-
⏲️ Last update: 02/01/2025 at 23:36:52 - Domains analyzed count: 150000.
18+
⏲️ Last update: 02/02/2025 at 08:26:37 - Domains analyzed count: 150000.
2119

2220
## Global usage of secure headers
2321

2422
Provide the distribution of usage of secure headers across all domains analyzed.
2523

2624
![be611e71c615c27471d766612bfb7e8b05d743c7](assets/tab_stats_generated_images/be611e71c615c27471d766612bfb7e8b05d743c7.png)
2725

28-
2926
## Global usage of header 'Cache-Control'
3027

3128
Provide the distribution of usage of the header 'Cache-Control' across all domains analyzed.
3229

3330
![5b54b09f5f5c815a014d71b3b07495a69e3a4509](assets/tab_stats_generated_images/5b54b09f5f5c815a014d71b3b07495a69e3a4509.png)
3431

35-
3632
## Global usage of header 'Clear-Site-Data'
3733

3834
Provide the distribution of usage of the header 'Clear-Site-Data' across all domains analyzed.
3935

4036
![2e12376a6c60ad301b25193c11517ea0cd6aba2f](assets/tab_stats_generated_images/2e12376a6c60ad301b25193c11517ea0cd6aba2f.png)
4137

42-
4338
## Global usage of header 'Content-Security-Policy'
4439

4540
Provide the distribution of usage of the header 'Content-Security-Policy' across all domains analyzed.
4641

4742
![5e74150e7d98f861bf3fa632ca32e2d7f3e59632](assets/tab_stats_generated_images/5e74150e7d98f861bf3fa632ca32e2d7f3e59632.png)
4843

49-
5044
## Global usage of header 'Cross-Origin-Embedder-Policy'
5145

5246
Provide the distribution of usage of the header 'Cross-Origin-Embedder-Policy' across all domains analyzed.
5347

5448
![00334f25a22543fb684dbe10861afee71c5263e0](assets/tab_stats_generated_images/00334f25a22543fb684dbe10861afee71c5263e0.png)
5549

56-
5750
## Global usage of header 'Cross-Origin-Opener-Policy'
5851

5952
Provide the distribution of usage of the header 'Cross-Origin-Opener-Policy' across all domains analyzed.
6053

6154
![f700c02d30083cf617bdeca51e7eec3d49fe4a08](assets/tab_stats_generated_images/f700c02d30083cf617bdeca51e7eec3d49fe4a08.png)
6255

63-
6456
## Global usage of header 'Cross-Origin-Resource-Policy'
6557

6658
Provide the distribution of usage of the header 'Cross-Origin-Resource-Policy' across all domains analyzed.
6759

6860
![fa069b07281496f391d957d8936337da1a601614](assets/tab_stats_generated_images/fa069b07281496f391d957d8936337da1a601614.png)
6961

70-
7162
## Global usage of header 'Permissions-Policy'
7263

7364
Provide the distribution of usage of the header 'Permissions-Policy' across all domains analyzed.
7465

7566
![0792b92709f42a7962c27c64b74b94a4dfbffda1](assets/tab_stats_generated_images/0792b92709f42a7962c27c64b74b94a4dfbffda1.png)
7667

77-
7868
## Global usage of header 'Referrer-Policy'
7969

8070
Provide the distribution of usage of the header 'Referrer-Policy' across all domains analyzed.
8171

8272
![d5e855464d800d7b27eb3e430c5ae378497ddf50](assets/tab_stats_generated_images/d5e855464d800d7b27eb3e430c5ae378497ddf50.png)
8373

84-
8574
## Global usage of header 'Strict-Transport-Security'
8675

8776
Provide the distribution of usage of the header 'Strict-Transport-Security' across all domains analyzed.
8877

8978
![dbeb94ebb1ed7763f390b7be97a292f3c66920c7](assets/tab_stats_generated_images/dbeb94ebb1ed7763f390b7be97a292f3c66920c7.png)
9079

91-
9280
## Global usage of header 'X-Content-Type-Options'
9381

9482
Provide the distribution of usage of the header 'X-Content-Type-Options' across all domains analyzed.
9583

9684
![0259a15512c639e10df724dc019babf03534b303](assets/tab_stats_generated_images/0259a15512c639e10df724dc019babf03534b303.png)
9785

98-
9986
## Global usage of header 'X-Frame-Options'
10087

10188
Provide the distribution of usage of the header 'X-Frame-Options' across all domains analyzed.
10289

10390
![6ddd8e89eb34224bf460f672999c7dd447baef79](assets/tab_stats_generated_images/6ddd8e89eb34224bf460f672999c7dd447baef79.png)
10491

105-
10692
## Global usage of header 'X-Permitted-Cross-Domain-Policies'
10793

10894
Provide the distribution of usage of the header 'X-Permitted-Cross-Domain-Policies' across all domains analyzed.
10995

11096
![364a633adcd63d315ec3df781fed6008c57ad00d](assets/tab_stats_generated_images/364a633adcd63d315ec3df781fed6008c57ad00d.png)
11197

112-
11398
## Global usage of insecure framing configuration via the header 'x-frame-options'
11499

115100
Provide the distribution of usage of the header 'x-frame-options' across all domains analyzed with a insecure framing configuration: value different from `DENY` or `SAMEORIGIN` including unsupported values.
116101

117102
![ccc438a754b6d9324c9c1ea62662969c6114bfdf](assets/tab_stats_generated_images/ccc438a754b6d9324c9c1ea62662969c6114bfdf.png)
118103

119-
120104
## Global usage of insecure referrer configuration via the header 'referrer-policy'
121105

122106
Provide the distribution of usage of the header 'referrer-policy' across all domains analyzed with a insecure referrer configuration: value set to `unsafe-url` or `no-referrer-when-downgrade`.
@@ -125,21 +109,18 @@ Provide the distribution of usage of the header 'referrer-policy' across all dom
125109

126110
![e90a8350bb77972b086599b65efc8fcd02036a11](assets/tab_stats_generated_images/e90a8350bb77972b086599b65efc8fcd02036a11.png)
127111

128-
129112
## Global usage of the Strict Transport Security 'preload' feature
130113

131114
Provide the distribution of usage of the '[preload](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#preloading_strict_transport_security)' feature for the header 'strict-transport-security' across all domains analyzed.
132115

133116
![8dd898e970a4cc540e0394ace9c9cedd425bc1c5](assets/tab_stats_generated_images/8dd898e970a4cc540e0394ace9c9cedd425bc1c5.png)
134117

135-
136118
## Global common 'max-age' values of the Strict Transport Security header
137119

138120
* Most common value used is 31536000 seconds (525600 minutes) across all domains analyzed.
139121
* Maximum value used is 1234513412313 seconds (20575223539 minutes) across all domains analyzed.
140122
* Minimum value used is -5375190 seconds (-89586 minutes) across all domains analyzed.
141123

142-
143124
## Global usage of content security policy with directives allowing unsafe expressions
144125

145126
Provide the distribution of content security policy allowing unsafe expressions across all domains analyzed.
@@ -149,4 +130,3 @@ Determine if a CSP policy contains `(default-src|script-src|script-src-elem|scri
149130
Based on [Report-URI CSP](https://report-uri.com/home/generate) generator allowed instructions for CSP directives.
150131

151132
![c7ef83055cf836a48ed9dd26b3a8d55103645022](assets/tab_stats_generated_images/c7ef83055cf836a48ed9dd26b3a8d55103645022.png)
152-

0 commit comments

Comments
 (0)