diff --git a/VERSION.txt b/VERSION.txt index 7717884..3f11ef6 100644 --- a/VERSION.txt +++ b/VERSION.txt @@ -1 +1 @@ -1.0.26 \ No newline at end of file +1.0.27 \ No newline at end of file diff --git a/helpers/configuration.py b/helpers/configuration.py index b0daf26..f6e3223 100644 --- a/helpers/configuration.py +++ b/helpers/configuration.py @@ -68,7 +68,7 @@ def load_config(self, extra_zap_params): self.header = os.environ.get('CUSTOM_HEADER') or EMPTY_STRING self.oauth_token_url = os.environ.get('OAUTH_TOKEN_URL') or EMPTY_STRING self.oauth_parameters = self._get_hook_param_list(os.environ.get('OAUTH_PARAMETERS')) or EMPTY_STRING - self.disable_rules = self._get_hook_param_list(os.environ.get('DISABLE_RULES')) or EMPTY_STRING + self.disable_rules = self._get_hook_param_list(os.environ.get('DISABLE_RULES')) or None except Exception as error: log(f"error in start_docker_zap: {traceback.print_exc()}", log_level=LogLevel.ERROR) diff --git a/hooks/soos_dast_hook.py b/hooks/soos_dast_hook.py index 6a6e42a..202f936 100644 --- a/hooks/soos_dast_hook.py +++ b/hooks/soos_dast_hook.py @@ -6,6 +6,7 @@ import sys import traceback from helpers.utils import log, exit_app +from typing import List config = DASTConfig() @@ -29,9 +30,13 @@ def zap_started(zap, target): target = target[0:target.index('/', 8) + 1] zap.ascan.update_scan_policy(scanpolicyname=Constants.ZAP_ACTIVE_SCAN_POLICY_NAME, attackstrength="LOW") - log(f"disabled rules: {config.disable_rules}") - zap.pscan.disable_scanners(','.join(config.disable_rules)) - zap.ascan.disable_scanners(','.join(config.disable_rules), Constants.ZAP_ACTIVE_SCAN_POLICY_NAME) + + if config.disable_rules: + pscan_disabled_rules = set(config.disable_rules).intersection(set(_all_passive_scanner_rules(zap))) + ascan_disabled_rules = set(config.disable_rules).intersection(set(_all_active_scanner_rules(zap, Constants.ZAP_ACTIVE_SCAN_POLICY_NAME))) + zap.pscan.disable_scanners(','.join(pscan_disabled_rules)) + zap.ascan.disable_scanners(','.join(ascan_disabled_rules), Constants.ZAP_ACTIVE_SCAN_POLICY_NAME) + log(f"disabled rules: {config.disable_rules}") auth = DASTAuth(config) auth.authenticate(zap, target) @@ -43,10 +48,13 @@ def zap_started(zap, target): return zap, target - def zap_pre_shutdown(zap): log("Overview of spidered URL's:") with open('spidered_urls.txt', 'w') as f: for url in zap.spider.all_urls: f.write(f"{url}\n") - log(f"found: {url}") \ No newline at end of file + log(f"found: {url}") + +def _all_active_scanner_rules(zap, policy_name) -> List[str]: return [scanner['id'] for scanner in zap.ascan.scanners(policy_name)] + +def _all_passive_scanner_rules(zap) -> List[str]: return [scanner['id'] for scanner in zap.pscan.scanners]