Complete Lab 9: Trivy, ZAP, and QuickNotes hardening

[smairon]

Goal

Complete Lab 9 for QuickNotes: run Trivy image/filesystem/config scans plus CycloneDX SBOM generation, run OWASP ZAP baseline against the running app, triage the findings, and fix at least one real finding in code.

Changes

• Task 1:
  Run pinned Trivy image, fs, and config scans against QuickNotes and the repo, generate a CycloneDX SBOM, save all raw artifacts under submissions/lab9-artifacts/, and document per-finding triage plus design answers in submissions/lab9.md.
• Task 2:
  Run pinned ZAP baseline before and after the fix, save HTML/JSON/Markdown/text artifacts, triage the actual alerts, and document the before/after evidence in submissions/lab9.md.
• Code fix:
  Add router-level middleware in app/handlers.go that applies security and cache-control headers to all responses, including 404s, and add tests in app/handlers_test.go that fail if the middleware is removed.

Testing

• go test ./...
• docker build -t quicknotes:lab6 ./app
• docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/work" -v "$HOME/.cache/trivy:/root/.cache" aquasec/trivy:0.59.1 image --severity HIGH,CRITICAL --format table -o /work/submissions/lab9-artifacts/trivy-image.txt quicknotes:lab6
• docker run --rm -v "$PWD:/work" -v "$HOME/.cache/trivy:/root/.cache" aquasec/trivy:0.59.1 fs --severity HIGH,CRITICAL --format table -o /work/submissions/lab9-artifacts/trivy-fs.txt /work
• docker run --rm -v "$PWD:/work" -v "$HOME/.cache/trivy:/root/.cache" aquasec/trivy:0.59.1 config --skip-check-update --format table -o /work/submissions/lab9-artifacts/trivy-config.txt /work
• docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/work" -v "$HOME/.cache/trivy:/root/.cache" aquasec/trivy:0.59.1 image --format cyclonedx -o /work/submissions/lab9-artifacts/quicknotes-lab6.cdx.json quicknotes:lab6
• docker compose up -d --build quicknotes
• docker run --rm --network devops-intro_default -v "$PWD:/zap/wrk:rw" ghcr.io/zaproxy/zaproxy:2.16.1 zap-baseline.py -t http://quicknotes:8080 -r submissions/lab9-artifacts/zap-pre.html -J submissions/lab9-artifacts/zap-pre.json -w submissions/lab9-artifacts/zap-pre.md
• curl -sSI http://localhost:8080/health and curl -sSI http://localhost:8080/ to verify the middleware headers after rebuild
• docker run --rm --network devops-intro_default -v "$PWD:/zap/wrk:rw" ghcr.io/zaproxy/zaproxy:2.16.1 zap-baseline.py -t http://quicknotes:8080 -r submissions/lab9-artifacts/zap-post.html -J submissions/lab9-artifacts/zap-post.json -w submissions/lab9-artifacts/zap-post.md

Checklist

• Title is a clear sentence (≤ 70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab9.md updated