Skip to content

Commit fe16876

Browse files
malexmavemalexmave
authored
Merge pull request #1320 from secureCodeBox/feature/zap-report-enhancements
ZAP Advanced: Add support for additional report types
2 parents fc9c693 + e30a7ef commit fe16876

7 files changed

Lines changed: 20 additions & 11 deletions

File tree

‎parser-sdk/nodejs/parser-wrapper.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ async function uploadResultToFileStorageService(
2727
return axios
2828
.put(resultUploadUrl, findingsWithIdsAndDates, {
2929
headers: { "content-type": "" },
30+
maxBodyLength: Infinity,
3031
})
3132
.catch(function (error) {
3233
if (error.response) {

‎scanners/zap-advanced/.helm-docs.gotmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script.
4040
The command line interface can be used to easily run server scans: `-t www.example.com`
4141

4242
```bash
43-
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}]
43+
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}]
4444
4545
OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.)
4646
@@ -56,7 +56,7 @@ optional arguments:
5656
The target to scan with OWASP ZAP.
5757
-o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER
5858
The path to a local folder used to store the output files, eg. the ZAP Report or logfiles.
59-
-r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD}
59+
-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}
6060
The OWASP ZAP Report Type.
6161
```
6262
{{- end }}

‎scanners/zap-advanced/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script.
5656
The command line interface can be used to easily run server scans: `-t www.example.com`
5757

5858
```bash
59-
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}]
59+
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}]
6060

6161
OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.)
6262

@@ -72,7 +72,7 @@ optional arguments:
7272
The target to scan with OWASP ZAP.
7373
-o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER
7474
The path to a local folder used to store the output files, eg. the ZAP Report or logfiles.
75-
-r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD}
75+
-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}
7676
The OWASP ZAP Report Type.
7777
```
7878

‎scanners/zap-advanced/docs/README.ArtifactHub.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script.
6161
The command line interface can be used to easily run server scans: `-t www.example.com`
6262

6363
```bash
64-
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}]
64+
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}]
6565

6666
OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.)
6767

@@ -77,7 +77,7 @@ optional arguments:
7777
The target to scan with OWASP ZAP.
7878
-o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER
7979
The path to a local folder used to store the output files, eg. the ZAP Report or logfiles.
80-
-r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD}
80+
-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}
8181
The OWASP ZAP Report Type.
8282
```
8383

‎scanners/zap-advanced/docs/README.DockerHub-Scanner.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script.
6464
The command line interface can be used to easily run server scans: `-t www.example.com`
6565

6666
```bash
67-
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}]
67+
usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}]
6868

6969
OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.)
7070

@@ -80,7 +80,7 @@ optional arguments:
8080
The target to scan with OWASP ZAP.
8181
-o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER
8282
The path to a local folder used to store the output files, eg. the ZAP Report or logfiles.
83-
-r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD}
83+
-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}
8484
The OWASP ZAP Report Type.
8585
```
8686

‎scanners/zap-advanced/scanner/zapclient/__main__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ def get_parser_args(args=None):
116116
parser.add_argument("-r",
117117
"--report-type",
118118
help='The OWASP ZAP Report Type.',
119-
choices=['XML', 'JSON', 'HTML', 'MD'],
119+
choices=['XML', 'XML-plus', 'JSON', 'JSON-plus', 'HTML', 'HTML-plus', 'MD'],
120120
default=None,
121121
required=False)
122122
return parser.parse_args(args)

‎scanners/zap-advanced/scanner/zapclient/zap_automation.py‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,15 +146,21 @@ def __start_scanner(self, target: str):
146146
def get_report_template_for_file_type(self, file_type: str):
147147
if file_type == "XML":
148148
return "traditional-xml"
149+
elif file_type == "XML-plus":
150+
return "traditional-xml-plus"
149151
elif file_type == "JSON":
150152
return "traditional-json"
153+
elif file_type == "JSON-plus":
154+
return "traditional-json-plus"
151155
elif file_type == "HTML":
152156
return "traditional-html"
157+
elif file_type == "HTML-plus":
158+
return "traditional-html-plus"
153159
elif file_type == "MD":
154160
return "traditional-md"
155161
else:
156162
raise RuntimeError(
157-
"Report file type: '" + file_type + "' hasn't been implemented. Available: XML, JSON, HTML or MD")
163+
"Report file type: '" + file_type + "' hasn't been implemented. Available: XML, XML-plus, JSON, JSON-plus, HTML, HTML-plus, or MD")
158164

159165
def generate_report_file(self, file_path: str, report_type: str):
160166
# To retrieve ZAP report in XML or HTML format
@@ -163,7 +169,9 @@ def generate_report_file(self, file_path: str, report_type: str):
163169
if report_type is None:
164170
report_type = "XML"
165171

166-
report_file = "zap-results." + report_type.lower()
172+
# Remove any trailing "-plus" from the file ending, as this is an artifact of the
173+
# XML-plus / JSON-plus / HTML-plus report format selector.
174+
report_file = "zap-results." + report_type.lower().replace('-plus', '')
167175
self.__zap.reports.generate(
168176
title="ZAP Report",
169177
template=self.get_report_template_for_file_type(report_type),

0 commit comments

Comments
 (0)