Class: Pipeline::Zap

Inherits:
BaseTask show all
Includes:
Util
Defined in:
lib/pipeline/tasks/zap.rb

Instance Attribute Summary

Attributes inherited from BaseTask

#appname, #description, #findings, #labels, #name, #stage, #trigger, #warnings

Instance Method Summary collapse

Methods included from Util

#fingerprint, #relative_path, #runsystem, #strip_archive_path

Methods inherited from BaseTask

#report, #severity, #warn

Constructor Details

#initialize(trigger, tracker) ⇒ Zap

Returns a new instance of Zap.



11
12
13
14
15
16
17
 
# File 'lib/pipeline/tasks/zap.rb', line 11

def initialize(trigger,tracker)
  super(trigger,tracker)
  @name = "ZAP"
  @description = "App Scanning"
  @stage = :live
  @labels << "live"
end

Instance Method Details

#analyze ⇒ Object 



50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/pipeline/tasks/zap.rb', line 50

def analyze
  begin   
    json = JSON.parse @result
    alerts = json["alerts"]
    count = 0
    alerts.each do |alert|
      count = count + 1
      description = alert["description"]
      detail = "Url: #{alert["url"]} Param: #{alert["param"]} \nReference: #{alert["reference"]}\n"+
               "Solution: #{alert["solution"]}\nCWE: #{alert["cweid"]}\tWASCID: #{alert["wascid"]}"
      source = @name + alert["url"]
      sev = severity alert["risk"]
      fingerprint = @name + alert["url"] + alert["alert"] + alert["param"]
      report description, detail, source, sev, fingerprint
    end
    Pipeline.debug "ZAP Identified #{count} issues."
  rescue Exception => e
    Pipeline.warn e.message
    Pipeline.notify "Problem running ZAP."
  end
end

#poll_until_100(url) ⇒ Object 



39
40
41
42
43
44
45
46
47
48
 
# File 'lib/pipeline/tasks/zap.rb', line 39

def poll_until_100(url)
  count = 0
  loop do
    sleep 5
    status = JSON.parse(Curl.get(url).body_str)
    count = count + 1      
    Pipeline.notify "Count ... #{count}"
    break if status["status"] == "100" or count > 100
  end
end

#run ⇒ Object 



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/pipeline/tasks/zap.rb', line 19

def run
  rootpath = @trigger.path
  base = "#{@tracker.options[:zap_host]}:#{@tracker.options[:zap_port]}"
  Pipeline.debug "Running ZAP on: #{rootpath} from #{base}"

  # TODO:  Add API Key
  # TODO:  Find out if we need to worry about "contexts" stepping on each other.

  # Spider
  Curl.get("#{base}/JSON/spider/action/scan/?#{rootpath}")
  poll_until_100("#{base}/JSON/spider/view/status")

  # Active Scan
  Curl.get("#{base}/JSON/ascan/action/scan/?recurse=true&inScopeOnly=true&url=#{rootpath}")
  poll_until_100("#{base}/JSON/ascan/view/status/")
    
  # Result
  @result = Curl.get("#{base}/JSON/core/view/alerts/").body_str
end

#supported? ⇒ Boolean

Returns:

  • (Boolean) 


72
73
74
75
76
77
78
79
80
81
 
# File 'lib/pipeline/tasks/zap.rb', line 72

def supported?
  base = "#{@tracker.options[:zap_host]}:#{@tracker.options[:zap_port]}"
  supported=JSON.parse(Curl.get("#{base}/JSON/core/view/version/").body_str)
  if supported["version"] == "2.4.3"
    return true
  else
    Pipeline.notify "Install ZAP from owasp.org and ensure that the configuration to connect is correct."
    return false
  end
end