Alert Counts not Populating Correctly

kasunkv / owasp-zap-vsts-task

Visual Studio Team Services build/release task for running OWASP ZAP automated security tests

MIT License

30 stars 11 forks source link

Alert Counts not Populating Correctly #16

Open RobertMcCoy opened 6 years ago

RobertMcCoy commented 6 years ago

When running a scan without any validation active, the scan output results just show:

Whereas the output report shows 5 low alerts for this scan.

I've fiddled around with the scan settings and I can't seem to get these to populate correctly.

kasunkv commented 6 years ago

Hi @RobertMcCoy ,

Thanks for the feedback. Can you provide me the current task settings you have configured? That might aid in troubleshooting this. I will look in to this issue.

RobertMcCoy commented 6 years ago

I have the API Url, API Key, and Target URL filled in with my VM/API Key as well as the correct target.

Under Spider Scan I have Execute Spider and Recurse checked, with Max Children to Crawl set to 2.

For Active Scan I have Execute Active Scan enabled and Recurse enabled, that's it.

Verification is disabled, and the Report output is set to Markdown.

denhsu commented 6 years ago

@RobertMcCoy @kasunkv Confirmed that with v2.0.7, the html and xml reports can be generated and the result is correct now. This bug can be closed.

RobertMcCoy commented 6 years ago

@denhsu the reports may be correct, but the VSTS output is not, this is what I am still seeing:

kingthorin commented 6 years ago

Not all alerts are a result of active scanning. The 5 lows could be passive results and therefore not show in the active summary.

tspascoal commented 5 years ago

I'm seeing the same behavior.

The Active scan result results observed in the logs are all zero when the report type is markdown (the markdown report shows counts greater than zero) if the report is HTML the counters on the logs are the same ones as in the report.

jabteles commented 5 years ago

I'm having the same issue: