search

blst-security / cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
https://www.blstsecurity.com/cherrybomb
Apache License 2.0
1.11k stars 78 forks source link

💡 Provide additional output format controls and options #17

Open AErmie opened 2 years ago

AErmie commented 2 years ago

Is your feature request related to a problem? Please describe. Whether using the command cherrybomb oas [OR] swagger --file <PATH> --output <PATH> or running the command without the --output it produces a results.txt file. For use in a CI/CD pipeline, this file makes it difficult to react to the results.

Describe the solution you'd like I would like to see the tool support other common formats (ie. JSON, JUnit, SARIF, etc.), and provide the ability to control the output of that file (ie. allowing a multi-type output versus having to run the tool multiple times, such as --type JSON,JUnit,SARIF).

Further, having the ability to control the output by severity or result (ie. only outputting the Failed checks or High severities).

Describe alternatives you've considered None

Additional context Context would be running in a CI/CD pipeline, like Azure DevOps, or GitHub Actions.

GuyL99 commented 2 years ago

Thank you for the input, I'll add it to the top of the roadmap, and I'll update you once there is an rc/version that implement that change

GuyL99 commented 2 years ago

In today's release I added the option for a JSON as the --format flag. Can you check it out? BTW, you can use verbosity 2 for the scan for it to output only the failed tests. Regarding severity control it's still in dev, I'll update you about it soon.

DeliciousBounty commented 1 year ago

Hi @AErmie The output can now be exported from CherryBomb in TXT or JSON format. The next release will include an additional option to select the type of checks you want to run by categorizing them as intrusive, full, or normal. When it comes to severity control, we may include it in the upcoming config file feature.

RazMag commented 1 year ago

Hey, we will be releasing a major version soon this is will be included in it. thank you for the recommendation