Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

-r option fails with an permission issue #22

Closed
EAlf91 opened this issue Jul 14, 2023 · 2 comments · Fixed by #37
Closed

-r option fails with an permission issue #22

EAlf91 opened this issue Jul 14, 2023 · 2 comments · Fixed by #37

Comments

@EAlf91
Copy link

EAlf91 commented Jul 14, 2023

Describe the Issue
We recently updated our action from 0.1.0 to 0.3.1 and it stopped working.

Expected Behaviour
If we want to create the report_html.html file with a different name and therefore supply the option -r mySpecDefinition.html we would expect to create the report from the scan with the provided filename.

Steps to reproduce
given this step:

      - name: ZAP API Scan
        uses: zaproxy/action-api-scan@v0.3.1
        with:
          target: 'https://www.myapi.de/mydocs/mySpecDefinition.json'
          cmd_options: '-r mySpecDefinition.html'

it fails with this error

ERROR [Errno 13] Permission denied: '/zap/wrk/mySpecDefinition.html'
2023-07-14 04:45:17,559 I/O error: [Errno 13] Permission denied: '/zap/wrk/mySpecDefinition.html'
Traceback (most recent call last):
  File "/zap/zap-api-scan.py", line 580, in main
    write_report(os.path.join(base_dir, report_html), zap.core.htmlreport())
  File "/zap/zap_common.py", line 564, in write_report
    with open(file_path, mode='wb') as f:
PermissionError: [Errno 13] Permission denied: '/zap/wrk/mySpecDefinition.html'

Current Workaround
as a workaround we rename the file in a step but we would expect the action to do this out of the box by providing the -r option

      - name: rename file
        run: mv ./report_html.html ./mySpecDefinition.html
@navaldewangan
Copy link

but how you can rename the file it's failing before that?
And if you add mv before then it would be not able to pick report_html.html because it's not generated.

@thc202
Copy link
Member

thc202 commented Jun 5, 2024

The workaround is done without the -r, and it's being renamed after being generated.

thc202 added a commit to thc202/action-api-scan that referenced this issue Jun 6, 2024
Support any file not just the default reports (e.g. ZAP plan created by
the baseline scan).

Fix zaproxy#22.

Signed-off-by: thc202 <thc202@gmail.com>
thc202 added a commit to thc202/action-api-scan that referenced this issue Jun 6, 2024
Support any file not just the default reports.

Fix zaproxy#22.

Signed-off-by: thc202 <thc202@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging a pull request may close this issue.

3 participants