secureCodeBox / scanner-webapplication-zap

Part of the deprecated secureCodeBox v1, see secureCodeBox/secureCodeBox Repo for v2
Apache License 2.0
5 stars 4 forks source link

Feature/reduce sitemap of restlike sites #10

Closed J12934 closed 6 years ago

J12934 commented 6 years ago

This got a bit larger as initially aimed for. To make these changes a bigger refactoring was required to do the Spider Result filtering possible with target specific configurations only applying for findings of the one target.

This refactoring also cleaned up some of the messy parts of the code base:

  1. Removed temporary serialization and deserialization of the results in spider and scanner.
  2. Statically Typed the HAR Object used in the spider and spider result reduction. Thanks to https://github.com/sdstoehr/har-reader
  3. Moved spider and scanner deduplication logic into its own classes.
  4. Raw results were build up by string concatenation to build up a json array this was now replaced by proper serialization.
  5. This changes also enabled to use the proper Zap XML report. Previously the scanner just exported the data in the format it was using internally. The scanner now exports the standard xml report also used by DefectDojo.

The new deduplication features can be enabled by the SECURECODEBOX_REDUCE_SPIDER_RESULT_ON_REST_SCHEMAS target attribute. I choose to prefix it with SECURECODEBOX instead of ZAP as this is a custom feature not included in Zap. Let me know if you agree with that or change it to be prefixed with Zap.

The filtering mechanism will filter urls like the following: https://github.com/secureCodeBox/scanner-webapplication-zap/blob/343107865808d08af340f4a550931827c555c65c/src/test/java/io/securecodebox/zap/service/zap/deduplication/SpiderDuplicateReducerTest.java#L141-L149

This currently only works on get requests. This behavior could be extended on non get requests, but is more tricky because of the request bodies.

J12934 commented 6 years ago

Build is currently broken because the gradle base image is missing. Seems to be related to: https://github.com/keeganwitt/docker-gradle/issues/66

rseedorff commented 6 years ago

ZAP Spider URLs besser auf Dublikate Filtern, indem per P-Attribut URL Pattern ergänzt werden können