Add support for *-plus ZAP report formats

malexmave · malexmave · commit f46fb40bbcff · 2022-08-26T14:33:24.000+02:00
ZAP reports can come in an enhanced "plus" format, which also contains
the full request and response headers and payload.  This commit adds
support for selecting these formats to ZAP Advanced.

To enable them, simply add '-r XML-plus' to the parameters in the Scan
definition.  The XML-plus format is compatible with the regular XML
format used by the parser.

Signed-off-by: Max Maass &lt;max.maass@iteratec.com&gt;
diff --git a/scanners/zap-advanced/scanner/zapclient/__main__.py b/scanners/zap-advanced/scanner/zapclient/__main__.py
@@ -116,7 +116,7 @@ def get_parser_args(args=None):
     parser.add_argument("-r",
                         "--report-type",
                         help='The OWASP ZAP Report Type.',
-                        choices=['XML', 'JSON', 'HTML', 'MD'],
+                        choices=['XML', 'XML-plus', 'JSON', 'JSON-plus', 'HTML', 'HTML-plus', 'MD'],
                         default=None,
                         required=False)
     return parser.parse_args(args)
diff --git a/scanners/zap-advanced/scanner/zapclient/zap_automation.py b/scanners/zap-advanced/scanner/zapclient/zap_automation.py
@@ -146,15 +146,21 @@ def __start_scanner(self, target: str):
     def get_report_template_for_file_type(self, file_type: str):
         if file_type == "XML":
             return "traditional-xml"
+        elif file_type == "XML-plus":
+            return "traditional-xml-plus"
         elif file_type == "JSON":
             return "traditional-json"
+        elif file_type == "JSON-plus":
+            return "traditional-json-plus"
         elif file_type == "HTML":
             return "traditional-html"
+        elif file_type == "HTML-plus":
+            return "traditional-html-plus"
         elif file_type == "MD":
             return "traditional-md"
         else:
             raise RuntimeError(
-                "Report file type: '" + file_type + "' hasn't been implemented. Available: XML, JSON, HTML or MD")
+                "Report file type: '" + file_type + "' hasn't been implemented. Available: XML, XML-plus, JSON, JSON-plus, HTML, HTML-plus, or MD")
 
     def generate_report_file(self, file_path: str, report_type: str):
         # To retrieve ZAP report in XML or HTML format
@@ -163,7 +169,9 @@ def generate_report_file(self, file_path: str, report_type: str):
         if report_type is None:
             report_type = "XML"
 
-        report_file = "zap-results." + report_type.lower()
+        # Remove any trailing "-plus" from the file ending, as this is an artifact of the
+        # XML-plus / JSON-plus / HTML-plus report format selector.
+        report_file = "zap-results." + report_type.lower().replace('-plus', '')
         self.__zap.reports.generate(
             title="ZAP Report",
             template=self.get_report_template_for_file_type(report_type),
