diff --git a/VERSION.txt b/VERSION.txt index a970716..b668c3b 100644 --- a/VERSION.txt +++ b/VERSION.txt @@ -1 +1 @@ -1.0.15 +1.0.16 diff --git a/main.py b/main.py index 301e6c8..90754b2 100644 --- a/main.py +++ b/main.py @@ -80,12 +80,13 @@ def __init__(self): self.zap_options: Optional[str] = None self.request_cookies: Optional[str] = None self.request_header: Optional[str] = None - self.integration_name: str = Constants.DEFAULT_INTEGRATION_NAME - self.integration_type: str = Constants.DEFAULT_INTEGRATION_TYPE - # INTENTIONALLY HARDCODED + + # Hardcoded values, used for analysis metadata self.dast_analysis_tool: str = Constants.DEFAULT_DAST_TOOL self.dast_analysis_tool_version: str = Constants.DEFAULT_DAST_TOOL_VERSION + self.integration_name: str = Constants.DEFAULT_INTEGRATION_NAME + self.integration_type: str = Constants.DEFAULT_INTEGRATION_TYPE # Auth Options self.auth_auto: Optional[str] = '0' @@ -421,7 +422,7 @@ def __generate_project_details_url__(self, project_id: str) -> str: soos_project_id=project_id) return url - def __make_soos_start_analysis_request__(self) -> DASTStartAnalysisResponse: + def __make_soos_start_analysis_request__(self, command: str) -> DASTStartAnalysisResponse: message: str = "An error has occurred Starting the Analysis" try: log("Making request to SOOS") @@ -446,6 +447,7 @@ def __make_soos_start_analysis_request__(self) -> DASTStartAnalysisResponse: appVersion=self.app_version, toolName=self.dast_analysis_tool, toolVersion=self.dast_analysis_tool_version, + commandLine=command, scanMode=self.scan_mode, commitHash=self.commit_hash, branch=self.branch_name, @@ -980,9 +982,7 @@ def run_analysis(self) -> None: exit_app(f"The URL {self.target_url} is not available") return None - log(f"Executing {self.scan_mode} scan") - soos_dast_start_response = self.__make_soos_start_analysis_request__() - # execute test + scan_function = self.scan_mode_map.get(self.scan_mode, None) if scan_function is None: @@ -1000,16 +1000,19 @@ def run_analysis(self) -> None: os.system("cp -R /zap/reports/traditional-json /root/.ZAP/reports/traditional-json") command: str = scan_function() + + if self.update_addons: + command = f"{command} --updateAddons" + log(f"Executing {self.scan_mode} scan") + soos_dast_start_response = self.__make_soos_start_analysis_request__(command) self.__make_soos_scan_status_request__(project_id=soos_dast_start_response.project_id, branch_hash=soos_dast_start_response.branch_hash, analysis_id=soos_dast_start_response.analysis_id, status="Running", status_message=None - ) - if self.update_addons: - command = f"{command} --updateAddons" + ) log(f"Command to be executed: {command}", log_level=LogLevel.DEBUG) os.system(command) diff --git a/reports/traditional-json-headers/report.json b/reports/traditional-json-headers/report.json index 1491b2f..ab951e0 100644 --- a/reports/traditional-json-headers/report.json +++ b/reports/traditional-json-headers/report.json @@ -17,7 +17,8 @@ "confidence": "[(${alert.confidence})]", "riskdesc": "[(${helper.legacyEscapeText(helper.getRiskString(alert.risk) + ' (' + helper.getConfidenceString(alert.confidence) + ')', true)})]", "desc": "[(${helper.legacyEscapeParagraph(alert.description, true)})]", - "instances":[ [#th:block th:each="instance, instState: ${instances}"][#th:block th:if="${! instState.first}"],[/th:block] + "instances":[ [#th:block th:each="instance, instState: ${instances}" th:unless="${ instState.index > 500}"] + [#th:block th:if="${! instState.first}"],[/th:block] { "uri": "[(${helper.legacyEscapeText(instance.uri, true)})]", "method": "[(${helper.legacyEscapeText(instance.method, true)})]", @@ -27,9 +28,10 @@ "evidence": "[(${helper.legacyEscapeText(instance.evidence, true)})]", "request-header": "[(${helper.legacyEscapeText(instance.message.requestHeader, true)})]", "response-header": "[(${helper.legacyEscapeText(instance.message.responseHeader, true)})]" - }[/th:block] + } + [/th:block] ], - "count": "[(${instances.size})]", + "totalInstanceCount": "[(${instances.size})]", "solution": "[(${helper.legacyEscapeParagraph(alert.solution, true)})]", "otherinfo": "[(${helper.legacyEscapeParagraph(alert.otherinfo, true)})]", "reference": "[(${helper.legacyEscapeParagraph(alert.reference, true)})]", diff --git a/reports/traditional-json/report.json b/reports/traditional-json/report.json index ecaadde..11979ea 100644 --- a/reports/traditional-json/report.json +++ b/reports/traditional-json/report.json @@ -17,17 +17,19 @@ "confidence": "[(${alert.confidence})]", "riskdesc": "[(${helper.legacyEscapeText(helper.getRiskString(alert.risk) + ' (' + helper.getConfidenceString(alert.confidence) + ')', true)})]", "desc": "[(${helper.legacyEscapeParagraph(alert.description, true)})]", - "instances":[ [#th:block th:each="instance, instState: ${instances}"][#th:block th:if="${! instState.first}"],[/th:block] - { - "uri": "[(${helper.legacyEscapeText(instance.uri, true)})]", - "method": "[(${helper.legacyEscapeText(instance.method, true)})]", - "status-code": [(${instance.message.responseHeader.statusCode})], - "param": "[(${helper.legacyEscapeText(instance.param, true)})]", - "attack": "[(${helper.legacyEscapeText(instance.attack, true)})]", - "evidence": "[(${helper.legacyEscapeText(instance.evidence, true)})]" - }[/th:block] - ], - "count": "[(${instances.size})]", + "instances":[ [#th:block th:each="instance, instState: ${instances}" th:unless="${ instState.index > 500}"] + [#th:block th:if="${! instState.first}"],[/th:block] + { + "uri": "[(${helper.legacyEscapeText(instance.uri, true)})]", + "method": "[(${helper.legacyEscapeText(instance.method, true)})]", + "status-code": [(${instance.message.responseHeader.statusCode})], + "param": "[(${helper.legacyEscapeText(instance.param, true)})]", + "attack": "[(${helper.legacyEscapeText(instance.attack, true)})]", + "evidence": "[(${helper.legacyEscapeText(instance.evidence, true)})]", + } + [/th:block] + ], + "totalInstanceCount": "[(${instances.size})]", "solution": "[(${helper.legacyEscapeParagraph(alert.solution, true)})]", "otherinfo": "[(${helper.legacyEscapeParagraph(alert.otherinfo, true)})]", "reference": "[(${helper.legacyEscapeParagraph(alert.reference, true)})]",