From f46fb40bbcff6a903e9c5adc61dc4fed83709e4b Mon Sep 17 00:00:00 2001 From: Max Maass Date: Fri, 26 Aug 2022 14:33:24 +0200 Subject: [PATCH 1/4] Add support for *-plus ZAP report formats ZAP reports can come in an enhanced "plus" format, which also contains the full request and response headers and payload. This commit adds support for selecting these formats to ZAP Advanced. To enable them, simply add '-r XML-plus' to the parameters in the Scan definition. The XML-plus format is compatible with the regular XML format used by the parser. Signed-off-by: Max Maass --- scanners/zap-advanced/scanner/zapclient/__main__.py | 2 +- .../zap-advanced/scanner/zapclient/zap_automation.py | 12 ++++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/scanners/zap-advanced/scanner/zapclient/__main__.py b/scanners/zap-advanced/scanner/zapclient/__main__.py index 138b0badd7..00f8b6258a 100644 --- a/scanners/zap-advanced/scanner/zapclient/__main__.py +++ b/scanners/zap-advanced/scanner/zapclient/__main__.py @@ -116,7 +116,7 @@ def get_parser_args(args=None): parser.add_argument("-r", "--report-type", help='The OWASP ZAP Report Type.', - choices=['XML', 'JSON', 'HTML', 'MD'], + choices=['XML', 'XML-plus', 'JSON', 'JSON-plus', 'HTML', 'HTML-plus', 'MD'], default=None, required=False) return parser.parse_args(args) diff --git a/scanners/zap-advanced/scanner/zapclient/zap_automation.py b/scanners/zap-advanced/scanner/zapclient/zap_automation.py index 27ec34b71f..ac1023301d 100644 --- a/scanners/zap-advanced/scanner/zapclient/zap_automation.py +++ b/scanners/zap-advanced/scanner/zapclient/zap_automation.py @@ -146,15 +146,21 @@ def __start_scanner(self, target: str): def get_report_template_for_file_type(self, file_type: str): if file_type == "XML": return "traditional-xml" + elif file_type == "XML-plus": + return "traditional-xml-plus" elif file_type == "JSON": return "traditional-json" + elif file_type == "JSON-plus": + return "traditional-json-plus" elif file_type == "HTML": return "traditional-html" + elif file_type == "HTML-plus": + return "traditional-html-plus" elif file_type == "MD": return "traditional-md" else: raise RuntimeError( - "Report file type: '" + file_type + "' hasn't been implemented. Available: XML, JSON, HTML or MD") + "Report file type: '" + file_type + "' hasn't been implemented. Available: XML, XML-plus, JSON, JSON-plus, HTML, HTML-plus, or MD") def generate_report_file(self, file_path: str, report_type: str): # To retrieve ZAP report in XML or HTML format @@ -163,7 +169,9 @@ def generate_report_file(self, file_path: str, report_type: str): if report_type is None: report_type = "XML" - report_file = "zap-results." + report_type.lower() + # Remove any trailing "-plus" from the file ending, as this is an artifact of the + # XML-plus / JSON-plus / HTML-plus report format selector. + report_file = "zap-results." + report_type.lower().replace('-plus', '') self.__zap.reports.generate( title="ZAP Report", template=self.get_report_template_for_file_type(report_type), From 4dced09dc45aa1988fb4769014072adce33bf829 Mon Sep 17 00:00:00 2001 From: Max Maass Date: Fri, 26 Aug 2022 14:37:23 +0200 Subject: [PATCH 2/4] Update documentation with new flags for reports Signed-off-by: Max Maass --- scanners/zap-advanced/.helm-docs.gotmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/zap-advanced/.helm-docs.gotmpl b/scanners/zap-advanced/.helm-docs.gotmpl index 42b702d4a0..0666415d61 100644 --- a/scanners/zap-advanced/.helm-docs.gotmpl +++ b/scanners/zap-advanced/.helm-docs.gotmpl @@ -40,7 +40,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script. The command line interface can be used to easily run server scans: `-t www.example.com` ```bash -usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}] +usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}] OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.) @@ -56,7 +56,7 @@ optional arguments: The target to scan with OWASP ZAP. -o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER The path to a local folder used to store the output files, eg. the ZAP Report or logfiles. - -r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD} + -r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD} The OWASP ZAP Report Type. ``` {{- end }} From 94482e7cdcb14ef5bc7da0a034be05c0bfaa8505 Mon Sep 17 00:00:00 2001 From: malexmave Date: Fri, 26 Aug 2022 12:38:19 +0000 Subject: [PATCH 3/4] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/zap-advanced/README.md | 4 ++-- scanners/zap-advanced/docs/README.ArtifactHub.md | 4 ++-- scanners/zap-advanced/docs/README.DockerHub-Scanner.md | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/scanners/zap-advanced/README.md b/scanners/zap-advanced/README.md index 2881d89e89..f2fec8e5ad 100644 --- a/scanners/zap-advanced/README.md +++ b/scanners/zap-advanced/README.md @@ -56,7 +56,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script. The command line interface can be used to easily run server scans: `-t www.example.com` ```bash -usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}] +usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}] OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.) @@ -72,7 +72,7 @@ optional arguments: The target to scan with OWASP ZAP. -o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER The path to a local folder used to store the output files, eg. the ZAP Report or logfiles. - -r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD} + -r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD} The OWASP ZAP Report Type. ``` diff --git a/scanners/zap-advanced/docs/README.ArtifactHub.md b/scanners/zap-advanced/docs/README.ArtifactHub.md index 9dee365bf2..7e460819c2 100644 --- a/scanners/zap-advanced/docs/README.ArtifactHub.md +++ b/scanners/zap-advanced/docs/README.ArtifactHub.md @@ -61,7 +61,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script. The command line interface can be used to easily run server scans: `-t www.example.com` ```bash -usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}] +usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}] OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.) @@ -77,7 +77,7 @@ optional arguments: The target to scan with OWASP ZAP. -o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER The path to a local folder used to store the output files, eg. the ZAP Report or logfiles. - -r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD} + -r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD} The OWASP ZAP Report Type. ``` diff --git a/scanners/zap-advanced/docs/README.DockerHub-Scanner.md b/scanners/zap-advanced/docs/README.DockerHub-Scanner.md index 2be9f93058..1f031e50fe 100644 --- a/scanners/zap-advanced/docs/README.DockerHub-Scanner.md +++ b/scanners/zap-advanced/docs/README.DockerHub-Scanner.md @@ -64,7 +64,7 @@ Listed below are the arguments supported by the `zap-advanced-scan` script. The command line interface can be used to easily run server scans: `-t www.example.com` ```bash -usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,JSON,HTML,MD}] +usage: zap-client [-h] -z ZAP_URL [-a API_KEY] [-c CONFIG_FOLDER] -t TARGET [-o OUTPUT_FOLDER] [-r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}] OWASP secureCodeBox OWASP ZAP Client (can be used to automate OWASP ZAP instances based on YAML configuration files.) @@ -80,7 +80,7 @@ optional arguments: The target to scan with OWASP ZAP. -o OUTPUT_FOLDER, --output-folder OUTPUT_FOLDER The path to a local folder used to store the output files, eg. the ZAP Report or logfiles. - -r {XML,JSON,HTML,MD}, --report-type {XML,JSON,HTML,MD} + -r {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD}, --report-type {XML,XML-plus,JSON,JSON-plus,HTML,HTML-plus,MD} The OWASP ZAP Report Type. ``` From e30a7efb00ba28e45cfbee22c3c0915df3941a5e Mon Sep 17 00:00:00 2001 From: Max Maass Date: Tue, 30 Aug 2022 18:33:03 +0200 Subject: [PATCH 4/4] Allow unlimited size for parser finding upload Axios seems to have an issue where we are hitting a maximum upload size, even though neither we nor the server set it. This commit explicitly sets the maximum upload size to unlimited, which seems to fix the issue. Signed-off-by: Max Maass --- parser-sdk/nodejs/parser-wrapper.js | 1 + 1 file changed, 1 insertion(+) diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index f67bfee6b4..d868059d0c 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -27,6 +27,7 @@ async function uploadResultToFileStorageService( return axios .put(resultUploadUrl, findingsWithIdsAndDates, { headers: { "content-type": "" }, + maxBodyLength: Infinity, }) .catch(function (error) { if (error.response) {