Pages Vulnerability Report Fixes - 2537

[r-bartlett-gsa]

• Remediate Pages vulnerability scan issues for challenges-and-prizes: https://pages.cloud.gov/report/2537

[jairoanaya]

@r-bartlett-gsa please be aware mostly of the issues reported by Pages have been addressed and will have a positive impact on the production report, see new staging report: https://pages.cloud.gov/report/4132

However, some issues need attention. Please provide a course of action:

• The asset https://www.googletagmanager.com/gtag/js?id=G-HE61P192WE cannot be signed because it changes every time it is loaded. Currently, Pages flag it as Unsuppressed. Signing it will prevent the browser from executing Google Tag. My recommendation is to override that rule and make it Suppressed. Currently, I removed the SRI to allow Google Tag to work. It will generate a warning. Is this ok?
• The following file https://federalist-2c628203-05c2-48ab-8f87-3eda79380559.sites.pages.cloud.gov/preview/gsa/challenges-and-prizes/staging/assets/document-library/prize-competition-appendices-as-a-CSV.CSV contains a value that is being passed as Timestamp Disclosure. My recommendation is to override the rule for this specific file if possible and making it Suppressed or deleting the file if it is not being used. How should I proceed?

@kkrug PR has been requested.

[r-bartlett-gsa]

@jairoanaya Thank you for an update. Let's suppress these both results for future reports.

[jairoanaya]

@r-bartlett-gsa based on your instruction. The vulnerabilities on https://pages.cloud.gov/report/2537 have been resolved on staging and should reflect this behavior once on production. Additionally, the findings mentioned above have been suppressed. Please review the latest report: https://pages.cloud.gov/report/4206#finding-90003

[jairoanaya]

@r-bartlett-gsa vulnerability report issues have been resolved. See attached image.

Changes made to citizens-and-prizes
a8a9040
8f05772
5f23278!