GitHub Code Scanning Integration

[SvanBoxel]

👋🏽 ZAproxy team,

Thank you for building this Action. I took the liberty to create an actions that maps the ZAProxy results to SARIF so they can be displayed in the GitHub Advanced Security UI.

You can check it out here: https://github.com/SvanBoxel/zaproxy-to-ghas

Optionally we could decide to merge this action into zaproxy/action-baseline so it becomes easier for users to leverage this scanning utility.

Disclaimer: I know, SARIF isn’t made for DAST results, but having the ability to view all security results through a single pane of glass can be very beneficial.

[psiinon]

@SvanBoxel thank you for creating this and telling us about it :) It looks very interesting - we'll have a look at it and get back to you asap!

[brentufkes]

There any action here? @psiinon

This is very helpful as be able to show these results in the Advanced Security UI (acknowledging the disclaimer)

[derekmurawsky]

This would be fantastic. I would love to see this action enable sarif output as well so an intermediate step/action is not needed.

[DanBradbury]

Ran into this requirement recently so I took a quick stab at hacking out a solution to let us proceed and I'd very much like to help make this be part of the main action without requiring an additional action to be used.

My understanding is that this would require changes to this repo (https://github.com/zaproxy/action-baseline/pull/110) & zaproxy (https://github.com/zaproxy/zaproxy/pull/8005)

In my case I had to create a new docker image with these files updated (zap-baseline.py and zap_common.py) to confirm that the entire scenario works correctly.

Would gladly take suggestions / work on produtionizing the code if this path doesn't seem to out there.. would require input from folks who are far more knowledgable than I (@psiinon or any others)

[thc202]

With a scan hook you could create the report without doing changes everywhere: https://www.zaproxy.org/docs/docker/scan-hooks/

[DanBradbury]

With a scan hook you could create the report without doing changes everywhere: https://www.zaproxy.org/docs/docker/scan-hooks/

Wondering if that solve makes sense for folks supporting 100s of applications and needing to add that hook.py file to all repos. Was mostly hoping for it to be supported with a command line option

[thc202]

The hook can be created by the workflow and one can use reusable workflows, so no need to add a file to 100s repos.

It's not necessary to add a command line option when this can be implemented just in the action (or the common package).

[DanBradbury]

ack. My issue with that solution is that it requires something beyond the baseline scan options that come out of the box. Seems like a workaround to use a hook rather than have something supported properly in the main action.

Definitely not a fan of that solution but if the guidance is to not support sairf within the baseline scan in the future I guess we will go with the gross hook solve / keep rolling our own docker image + maintain our own fork

[thc202]

What do you want to use? The action or the packaged scan? Both?

[DanBradbury]

My understanding from the docs was that "GitHub Actions wrap the above packaged scans " (Baseline, Full Scan, API Scan)

What do you want to use? The action or the packaged scan? Both?

doesn't the action-baseline action use the Baseline packaged scan? I believe that's the reason I had to make changes to both the repos to support the new -S option for sarif support. I'd like to improve the baseline action and if that requires changes to the packaged scan then I think that work should be done in parallel.. even if there is a sunset plan for the old packaged scans to be unified with the automation framework it looks like there is still work being done zap-baseline.py to attempt to use the AF when possible https://github.com/zaproxy/zaproxy/blob/main/docker/zap-baseline.py#L344-L352

Ideally it would be great to have sarif support figured out in the action here now and then make the change to move the AF completely seamless and update the old zap-baseline.py to fully use the automation framework when the time is right.. obviously I'm naive to priorities, etc for the team but as someone who is selfishly trying to use ZAP at scale we'd like have this a default / configurable behavior at the action level.

[elgohr]

Looks like a SARIF report exporter is already part of ZAP. See

• https://www.zaproxy.org/docs/desktop/addons/report-generation/report-sarif-json/
• https://github.com/zaproxy/zap-extensions/tree/main/addOns/reports/src/main/java/org/zaproxy/addon/reports/sarif

Sadly I didn't find a way/documentation to use it.

[elgohr]

Find an idea at https://github.com/GSA-TTS/FAC/issues/1654