search

iriusrisk / bdd-security

BDD Automated Security Tests for Web Applications
http://www.continuumsecurity.net/bdd-intro.html
GNU Affero General Public License v3.0
561 stars 178 forks source link

AppScanningSteps Error #20

Closed lfatty closed 9 years ago

lfatty commented 9 years ago

@continuumsecurity, I got the following error when running the latest bed-sec.

test/src/main/java/net/continuumsecurity/steps/AppScanningSteps.java:92: error: cannot find symbol byte[] xmlReport = scanner.getXmlReport();

iriusrisk commented 9 years ago

Check that you have the latest version of lib/proxy-2.4-SNAPSHOT.jar

I've just clone the whole project from github into a clean directory and it works without error.

lfatty commented 9 years ago

@continuumsecurity I fixed the issue, however, I noted that the new scan policies you added today do not have CWEid in ZAP because those policies are not there by default.

iriusrisk commented 9 years ago

Where the policy does not have a CWEId, I've also added the WASC-ID which are the only two external references ZAP uses.

lfatty commented 9 years ago

For instance HTTP Parameter polution and Expression Language injection are not in ZAP by default.

iriusrisk commented 9 years ago

Thanks. They were reported as being available through the API. I've now removed them.