From 0b5125a0f1765ceb1fcf495a413bfc630ae44f01 Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Thu, 26 Aug 2021 13:26:27 +0200 Subject: [PATCH] Fixing the script configuration field names to be more consistent Signed-off-by: Robert Seedorff --- .../1_zap-advanced-scan-type-config.yaml | 18 +++++++++--------- .../2_zap-advanced-scan-config.yaml | 18 +++++++++--------- .../context/zap_context_authentication.py | 14 +++++++------- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay-secrets/1_zap-advanced-scan-type-config.yaml b/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay-secrets/1_zap-advanced-scan-type-config.yaml index 00b3d6ae70..8ec962a1a1 100644 --- a/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay-secrets/1_zap-advanced-scan-type-config.yaml +++ b/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay-secrets/1_zap-advanced-scan-type-config.yaml @@ -37,13 +37,13 @@ contexts: type: "script-based" # script-based script-based: - scriptName: "scb-oidc-password-grand-type.js" + name: "scb-oidc-password-grand-type.js" # Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - scriptEngine: "Oracle Nashorn" + engine: "Oracle Nashorn" # Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount) - scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js" - scriptDescription: "This is a description for the SCB OIDC Script." - scriptArguments: + filePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js" + description: "This is a description for the SCB OIDC Script." + arguments: URL: "https://www.secureCodeBox.io/authserver/" email: "secureCodeBox@teratec.com" # should have at least the role "reserved_view_swagger" to access the OpenAPI spec @@ -65,9 +65,9 @@ contexts: type: "scriptBasedSessionManagement" # basic-auth requires no further configuration scriptBasedSessionManagement: - scriptName: "juiceshop-session-management.js" + name: "juiceshop-session-management.js" # Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - scriptEngine: "Oracle Nashorn" + engine: "Oracle Nashorn" # Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount) - scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js" - scriptDescription: "This is a JuiceShop specific SessionManagement Script used to handle JWT." + filePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js" + description: "This is a JuiceShop specific SessionManagement Script used to handle JWT." diff --git a/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay/2_zap-advanced-scan-config.yaml b/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay/2_zap-advanced-scan-config.yaml index f172af7a67..60b238140c 100644 --- a/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay/2_zap-advanced-scan-config.yaml +++ b/scanners/zap-advanced/scanner/tests/mocks/context-with-overlay/2_zap-advanced-scan-config.yaml @@ -39,13 +39,13 @@ contexts: type: "script-based" # script-based script-based: - scriptName: "scb-oidc-password-grand-type.js" + name: "scb-oidc-password-grand-type.js" # Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - scriptEngine: "Oracle Nashorn" + engine: "Oracle Nashorn" # Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount) - scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js" - scriptDescription: "This is a description for the SCB OIDC Script." - scriptArguments: + filePath: "/home/zap/.ZAP_D/scripts/scripts/authentication/scb-oidc-password-grand-type.js" + description: "This is a description for the SCB OIDC Script." + arguments: URL: "https://www.secureCodeBox.io/authserver/" email: "secureCodeBox@teratec.com" # should have at least the role "reserved_view_swagger" to access the OpenAPI spec @@ -67,12 +67,12 @@ contexts: type: "scriptBasedSessionManagement" # basic-auth requires no further configuration scriptBasedSessionManagement: - scriptName: "juiceshop-session-management.js" + name: "juiceshop-session-management.js" # Script engine values: 'Graal.js', 'Oracle Nashorn' for Javascript and 'Mozilla Zest' for Zest Scripts - scriptEngine: "Oracle Nashorn" + engine: "Oracle Nashorn" # Must be a full path to the script file inside the ZAP container (corresponding to the configMap FileMount) - scriptFilePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js" - scriptDescription: "This is a JuiceShop specific SessionManagement Script used to handle JWT." + filePath: "/home/zap/.ZAP_D/scripts/scripts/session/juiceshop-session-management.js" + description: "This is a JuiceShop specific SessionManagement Script used to handle JWT." # Name to be used to refer to this context in other jobs, mandatory - name: secureCodeBox-Basic-Auth # The top level url, mandatory, everything under this will be included diff --git a/scanners/zap-advanced/scanner/zapclient/context/zap_context_authentication.py b/scanners/zap-advanced/scanner/zapclient/context/zap_context_authentication.py index e8bb7c4102..e2161ac056 100644 --- a/scanners/zap-advanced/scanner/zapclient/context/zap_context_authentication.py +++ b/scanners/zap-advanced/scanner/zapclient/context/zap_context_authentication.py @@ -63,7 +63,7 @@ def configure_context_authentication(self, context: collections.OrderedDict, con self._configure_context_authentication_json_auth(authentication["json-based"], context_id) if self._is_not_empty("verification", authentication): - self._confige_auth_validation(authentication["verification"], context_id) + self._configure_auth_validation(authentication["verification"], context_id) def _configure_context_authentication_script(self, script_config: collections.OrderedDict, context_id: int): """Protected method to configure the ZAP 'Context / Authentication Settings with Script based Authentication' based on a given ZAP config. @@ -76,8 +76,8 @@ def _configure_context_authentication_script(self, script_config: collections.Or The zap context id tot configure the ZAP authentication for (based on the class ZapConfiguration). """ - if(not script_config == None and "scriptName" in script_config and "scriptFilePath" in script_config and "scriptEngine" in script_config): - self._configure_load_script(zap=self.get_zap, script_config=script_config, script_type='authentication') + if(not script_config == None and "name" in script_config and "filePath" in script_config and "engine" in script_config): + self._configure_load_script(script_config=script_config, script_type='authentication') auth_params = self.__get_script_auth_params(script_config) @@ -92,7 +92,7 @@ def _configure_context_authentication_script(self, script_config: collections.Or exception_message="Missing ZAP Authentication Script Parameters! Please check your secureCodeBox YAML configuration!" ) else: - logging.warning("Important script authentication configs (scriptName, scriptFilePath, scriptEngine) are missing! Ignoring the authenication script configuration. Please check your YAML configuration.") + logging.warning("Important script authentication configs (name, filePath, engine) are missing! Ignoring the authentication script configuration. Please check your YAML configuration.") def _configure_context_authentication_basic_auth(self, basic_auth: collections.OrderedDict, context_id: int): """Protected method to configure the ZAP 'Context / Authentication Settings with Basic Authentication' based on a given ZAP config. @@ -171,7 +171,7 @@ def _configure_context_authentication_json_auth(self, json_auth: collections.Ord authmethodname='jsonBasedAuthentication', authmethodconfigparams=auth_method_config_params) - def _confige_auth_validation(self, validation: collections.OrderedDict, context_id: int): + def _configure_auth_validation(self, validation: collections.OrderedDict, context_id: int): """Protected method to configure the ZAP 'Context / Authentication Settings with Script based Authentication' based on a given ZAP config. Parameters @@ -205,9 +205,9 @@ def __get_script_auth_params(self, script_config: collections.OrderedDict) -> li """ # Create ZAP Script parameters based on given configuration object - auth_params = ['scriptName=' + script_config["scriptName"],] + auth_params = ['scriptName=' + script_config["name"],] # Creates a list of URL-Encoded params, based on the YAML config - for key, value in script_config["scriptArguments"].items(): + for key, value in script_config["arguments"].items(): auth_params.append(key + "=" + value) # Add a '&' to all elements except the last one auth_params = '&'.join(auth_params)