Dev/test code forgotten in plugin code

[frloudet]

Issue Type

Bug Report

Faraday version

3.8.0 (latest)

Component Name

Openvas plugin: /faraday/client/plugins/repo/openvas/plugin.py

Steps to reproduce

Just started to test faraday, had some openvas output I wanted to upload and it was failing, had a look at the plugin code and saw javier left some test file being open in main, I suspect this does not help:

line 461:

if __name__ == '__main__':
    parser = OpenvasPlugin()
    with open("/home/javier/7_faraday_Openvas.xml","r") as report:
        parser.parseOutputString(report.read())

I find also other test files left in other plugins:

$ grep javier * -r
appscan/plugin.py:    with open('/home/javier/Reports_Testing/appscan-demo_testfire.xml', 'r') as report:
goohost/plugin.py:    with open('/home/javier/Plugins/goohost/report-10071-google.com.txt','r') as report:
nessus/plugin.py:    with open('/home/javier/DNS_publicos_hlnn77.nessus', 'r') as report:
openvas/plugin.py:    with open("/home/javier/7_faraday_Openvas.xml","r") as report:
sslyze/plugin.py:    with open("/home/javier/expired.xml","r") as report:
wapiti/plugin.py:        with open('/home/javier/Reports_Testing/wapiti3.0.1.xml') as report:
wfuzz/plugin.py:    with open("/home/javier/salida", "r") as report:

I just started to look at faraday so don't know the code and don't want to say this is my issue but I bet these should not be there and sys.argv[1] should be the classic input as in other plugins.

Thanks!

Expected results

openvas plugin trying to parse my uploaded file

[frloudet]

Not sure any of the __main__ are being used in fact (plugins seem always imported) so might not be too important. In the meantime, I found my issue, which is my openvas file parsed as "Zap". Line 356 in https://github.com/infobyte/faraday/blob/master/faraday/client/managers/reports_managers.py is looking for "OpenVAS" or "<omp><version>" in the file but it must be for old openvas output, it is not there in greenbone openvas XML output so it defaults to "Zap" instead.

[llazzaro]

Hi, The __main__ code is not used by faraday and we usually use it for development purposes (makes the development process faster). We are working in a refactor of the plugin engine that will allow us to have unit tests. We also did a rewrite of the plugin detection in the file reports_managers.py, the method called rType was completed rewritten and now every plugin knowns how to detect the files. You will see these plugin changes in v3.10 (python3) or v3.11, all the plugins will be moved to a new project called faraday-plugins. We will release v3.9 tomorrow with several new features (remote agents and more) I will add a reference to this issue in our internal issue tracker. we will clean up the code to remove those main lines that you found. Thanks a lot for reviewing the code and if you see something else, please let us know!

[frloudet]

Thanks a lot, great news, indeed, I realize afterwards those were just imported so main would never be triggered (sorry for the "non" issue then). Glad you are making those refactoring. Cheers!

On Tue, Oct 8, 2019 at 3:24 AM Leonardo Lazzaro notifications@github.com wrote:

Hi, The main code is not used by faraday and we usually use it for development purposes (makes the development process faster). We are working in a refactor of the plugin engine that will allow us to have unit tests. We also did a rewrite of the plugin detection in the file reports_managers.py, the method called rType was completed rewritten and now every plugin knowns how to detect the files. You will see these plugin changes in v3.10 (python3) or v3.11, all the plugins will be moved to a new project called faraday-plugins. We will release v3.9 tomorrow with several new features (remote agents and more) I will add a reference to this issue in our internal issue tracker. we will clean up the code to remove those main lines that you found. Thanks a lot for reviewing the code and if you see something else, please let us know!

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/infobyte/faraday/issues/374?email_source=notifications&email_token=ANMFUT54NS7ASQRGO4Q32MTQNPVOXA5CNFSM4I5NKKW2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEASNFJY#issuecomment-539284135, or mute the thread https://github.com/notifications/unsubscribe-auth/ANMFUTYDVNXASUHIO5DTKWTQNPVOXANCNFSM4I5NKKWQ .

-- Frederic LoudetSenior Security Engineer - Red Team | GitLab

[llazzaro]

Hi, we started to publish out new plugins repository here: https://github.com/infobyte/faraday_plugins Faraday v3.10 will use python3 and we made a performance improvement on plugin processing. Cheers!

[llazzaro]

We have released v1.0 and we have made the code clean up. Thank you for reporting this issue!