← 输入框|github.com|刷新
Skip to content

Bugfixed zap-advanced scanner script configuration #609

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
J12934 merged 1 commit into from
Aug 26, 2021
Merged

Bugfixed zap-advanced scanner script configuration #609

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions ...ced/scanner/tests/mocks/context-with-overlay-secrets/1_zap-advanced-scan-type-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,13 @@ contexts:
type: "script-based"
# script-based
script-based:
scriptName: "scb-oidc-password-grand-type.js"
name: "scb-oidc-password-grand-type.js"
# Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts
scriptEngine: "Oracle Nashorn"
engine: "Oracle Nashorn"
# Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount)
scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js"
scriptDescription: "This is a description for the SCB OIDC Script."
scriptArguments:
filePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js"
description: "This is a description for the SCB OIDC Script."
arguments:
URL: "https://www.secureCodeBox.io/authserver/"
email: "secureCodeBox@teratec.com"
# should have at least the role "reserved_view_swagger" to access the OpenAPI spec
Expand All @@ -65,9 +65,9 @@ contexts:
type: "scriptBasedSessionManagement"
# basic-auth requires no further configuration
scriptBasedSessionManagement:
scriptName: "juiceshop-session-management.js"
name: "juiceshop-session-management.js"
# Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts
scriptEngine: "Oracle Nashorn"
engine: "Oracle Nashorn"
# Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount)
scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js"
scriptDescription: "This is a JuiceShop specific SessionManagement Script used to handle JWT."
filePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js"
description: "This is a JuiceShop specific SessionManagement Script used to handle JWT."
18 changes: 9 additions & 9 deletions ...ers/zap-advanced/scanner/tests/mocks/context-with-overlay/2_zap-advanced-scan-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,13 +39,13 @@ contexts:
type: "script-based"
# script-based
script-based:
scriptName: "scb-oidc-password-grand-type.js"
name: "scb-oidc-password-grand-type.js"
# Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts
scriptEngine: "Oracle Nashorn"
engine: "Oracle Nashorn"
# Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount)
scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js"
scriptDescription: "This is a description for the SCB OIDC Script."
scriptArguments:
filePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js"
description: "This is a description for the SCB OIDC Script."
arguments:
URL: "https://www.secureCodeBox.io/authserver/"
email: "secureCodeBox@teratec.com"
# should have at least the role "reserved_view_swagger" to access the OpenAPI spec
Expand All @@ -67,12 +67,12 @@ contexts:
type: "scriptBasedSessionManagement"
# basic-auth requires no further configuration
scriptBasedSessionManagement:
scriptName: "juiceshop-session-management.js"
name: "juiceshop-session-management.js"
# Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts
scriptEngine: "Oracle Nashorn"
engine: "Oracle Nashorn"
# Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount)
scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js"
scriptDescription: "This is a JuiceShop specific SessionManagement Script used to handle JWT."
filePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js"
description: "This is a JuiceShop specific SessionManagement Script used to handle JWT."
# Name to be used to refer to this context in other jobs, mandatory
- name: secureCodeBox-Basic-Auth
# The top level url, mandatory, everything under this will be included
Expand Down
14 changes: 7 additions & 7 deletions scanners/zap-advanced/scanner/zapclient/context/zap_context_authentication.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ def configure_context_authentication(self, context: collections.OrderedDict, con
self._configure_context_authentication_json_auth(authentication["json-based"], context_id)

if self._is_not_empty("verification", authentication):
self._confige_auth_validation(authentication["verification"], context_id)
self._configure_auth_validation(authentication["verification"], context_id)

def _configure_context_authentication_script(self, script_config: collections.OrderedDict, context_id: int):
"""Protected method to configure the ZAP 'Context / Authentication Settings with Script based Authentication' based on a given ZAP config.
Expand All @@ -76,8 +76,8 @@ def _configure_context_authentication_script(self, script_config: collections.Or
The zap context id tot configure the ZAP authentication for (based on the class ZapConfiguration).
"""

if(not script_config == None and "scriptName" in script_config and "scriptFilePath" in script_config and "scriptEngine" in script_config):
self._configure_load_script(zap=self.get_zap, script_config=script_config, script_type='authentication')
if(not script_config == None and "name" in script_config and "filePath" in script_config and "engine" in script_config):
self._configure_load_script(script_config=script_config, script_type='authentication')

auth_params = self.__get_script_auth_params(script_config)

Expand All @@ -92,7 +92,7 @@ def _configure_context_authentication_script(self, script_config: collections.Or
exception_message="Missing ZAP Authentication Script Parameters! Please check your secureCodeBox YAML configuration!"
)
else:
logging.warning("Important script authentication configs (scriptName, scriptFilePath, scriptEngine) are missing! Ignoring the authenication script configuration. Please check your YAML configuration.")
logging.warning("Important script authentication configs (name, filePath, engine) are missing! Ignoring the authentication script configuration. Please check your YAML configuration.")

def _configure_context_authentication_basic_auth(self, basic_auth: collections.OrderedDict, context_id: int):
"""Protected method to configure the ZAP 'Context / Authentication Settings with Basic Authentication' based on a given ZAP config.
Expand Down Expand Up @@ -171,7 +171,7 @@ def _configure_context_authentication_json_auth(self, json_auth: collections.Ord
authmethodname='jsonBasedAuthentication',
authmethodconfigparams=auth_method_config_params)

def _confige_auth_validation(self, validation: collections.OrderedDict, context_id: int):
def _configure_auth_validation(self, validation: collections.OrderedDict, context_id: int):
"""Protected method to configure the ZAP 'Context / Authentication Settings with Script based Authentication' based on a given ZAP config.

Parameters
Expand Down Expand Up @@ -205,9 +205,9 @@ def __get_script_auth_params(self, script_config: collections.OrderedDict) -> li
"""

# Create ZAP Script parameters based on given configuration object
auth_params = ['scriptName=' + script_config["scriptName"],]
auth_params = ['scriptName=' + script_config["name"],]
# Creates a list of URL-Encoded params, based on the YAML config
for key, value in script_config["scriptArguments"].items():
for key, value in script_config["arguments"].items():
auth_params.append(key + "=" + value)
# Add a '&' to all elements except the last one
auth_params = '&'.join(auth_params)
Expand Down