zaproxy / action-full-scan

A GitHub Action for running the ZAP Full scan
Apache License 2.0
280 stars 53 forks source link

Passing args to -z in cmd_options not possible due to quote escaping #83

Open JackLewisGit opened 9 months ago

JackLewisGit commented 9 months ago

I'm trying to set some exclusions by passing some regex to the -z paramater. In the cli, it looks like this

-z "-config globalexcludeurl.url_list.url.regex='(?!http:\\/\\/ete-dev-api.azurewebsites.net)"

however, to pass this to the cli in the yaml is seemingly impossible because the double quotes are stripped regardless of how you pass it in.

I will explain the specific issue using an example from the readme though (as you would assume that should work).

cmd_options: -z "-config view.locale=fr_FR"

in the yaml results in the following being called in the runner (I've redacted a the other args)

run -v /home/****:/zap/wrk/:rw --network=host -z -config view.locale=fr_FR

From what I can tell this is due to the way exec (and argStringToArray) escape strings in the js library. Am I missing something or is this a bug?