RedHatProductSecurity / rapidast

RapiDAST enables simple, continuous and fully automated application security testing
Apache License 2.0
56 stars 36 forks source link

[ZAP] Adds ability to install addons #143

Closed cedricbu closed 11 months ago

cedricbu commented 11 months ago

This adds the ability to install new addons, such as active or passive scanners. Examples of addons can be found there: https://github.com/zaproxy/zap-extensions/tree/main/addOns

Addons to be installed as configured as such:

scanners:
  zap:
    miscOptions:
      additionalAddons: "ascanrulesBeta,sqliplugin"

The additionalAddons accepts either a list of a string representing the list, but separated by commas

Also, I added additionalAddons: "ascanrulesBeta" in all the ZAP templates

jeremychoi commented 11 months ago

An error like the following error occurs:


Traceback (most recent call last):
  File "/home/user/./rapidast.py", line 224, in <module>
    run()
  File "/home/user/./rapidast.py", line 209, in run
    ret = run_scanner(name, config, args, defect_d)
  File "/home/user/./rapidast.py", line 99, in run_scanner
    scanner.run()
  File "/home/user/scanners/zap/zap_podman.py", line 106, in run
    cli = self._handle_plugins()
  File "/home/user/scanners/zap/zap_podman.py", line 228, in _handle_plugins
    self._zap_cli_list_to_str_for_sh(command)
  File "/home/user/scanners/zap/zap.py", line 172, in _zap_cli_list_to_str_for_sh
    return " ".join([sub.translate(result_mapping) for sub in l_zap_cli])
  File "/home/user/scanners/zap/zap.py", line 172, in <listcomp>
    return " ".join([sub.translate(result_mapping) for sub in l_zap_cli])
AttributeError: 'list' object has no attribute 'translate'

The config looks like:

    miscOptions:
      # enableUI (default: false), requires a compatible runtime (e.g.: flatpak or no containment)
      enableUI: False
      # Defaults to True, set False to prevent auto update of ZAP plugins
      updateAddons: False
      additionalAddons: "ascanrulesBeta"
cedricbu commented 11 months ago

Updated accordingly:

I tried in several condition (none and podman, update, addon install, or nothing)... It should be fine