Error when using zap-api-scan.py in docker

[tpang-ameame]

Hi,
When I use zap-api-scan.py in docker owasp/zap2docker-weekly to scan api with command:

docker run -u root -v /tmp/zap:/zap/wrk:rw  -ti owasp/zap2docker-weekly zap-api-scan.py -t api
_mini_1309.json -f openapi -r report.html -z "-configfile /zap/wrk/options.prop" -d

I met this error, and docker log shows:

2019-09-17 02:37:55,944 http://localhost:49579 "GET http://zap/JSON/ascan/view/status/?scanId=Does+Not+Exist HTTP/1.1" 400 52
ERROR <type 'exceptions.ValueError'>
2019-09-17 02:37:55,945 Unexpected error: <type 'exceptions.ValueError'>
Traceback (most recent call last):
  File "/zap/zap-api-scan.py", line 425, in main
    zap_active_scan(zap, target, scan_policy)
  File "/zap/zap_common.py", line 84, in _wrap
    return_data = func(*args_list, **kwargs)
  File "/zap/zap_common.py", line 398, in zap_active_scan
    while(int(zap.ascan.status(ascan_scan_id)) < 100):
ValueError: invalid literal for int() with base 10: 'Does Not Exist'

And url imported from swagger file is not null: Number of Imported URLs: 14
I notice this: http://localhost:49579 "GET http://zap/JSON/ascan/view/status/?scanId=Does+Not+Exist HTTP/1.1" 400 52
Seems that it passed wrong parameter to zap, please tell how to fix this?

Errors from the zap.log file

13041 [ZAP-ProxyThread-8] WARN org.zaproxy.zap.extension.api.API  - Bad request to API endpoint [/JSON/ascan/action/scan/] from [127.0.0.1]:
Does Not Exist (does_not_exist) : scanPolicyName
        at org.zaproxy.zap.extension.ascan.ActiveScanAPI.handleApiAction(ActiveScanAPI.java:357)
        at org.zaproxy.zap.extension.api.API.handleApiRequest(API.java:508)
        at org.parosproxy.paros.core.proxy.ProxyThread.processHttp(ProxyThread.java:499)
        at org.parosproxy.paros.core.proxy.ProxyThread.run(ProxyThread.java:335)
        at java.lang.Thread.run(Thread.java:748)
18058 [ZAP-ProxyThread-9] WARN org.zaproxy.zap.extension.api.API  - Bad request to API endpoint [/JSON/ascan/view/status/] from [127.0.0.1]:
Does Not Exist (does_not_exist) : scanId
        at org.zaproxy.zap.extension.ascan.ActiveScanAPI.getActiveScan(ActiveScanAPI.java:768)
        at org.zaproxy.zap.extension.ascan.ActiveScanAPI.handleApiView(ActiveScanAPI.java:958)
        at org.zaproxy.zap.extension.api.API.handleApiRequest(API.java:527)
        at org.parosproxy.paros.core.proxy.ProxyThread.processHttp(ProxyThread.java:499)
        at org.parosproxy.paros.core.proxy.ProxyThread.run(ProxyThread.java:335)
        at java.lang.Thread.run(Thread.java:748)
2019-09-17 02:37:55,952 Trigger hook: pre_exit, args: 3

[kingthorin]

It seems you're passing a string value where the API is expecting a number. (Which is exactly what the error messages are telling you.)
ValueError: invalid literal for int() with base 10: 'Does Not Exist'

Or specifying a scan policy name that doesn't exist.

[kingthorin]

Please don't ask questions as issues - the ZAP User Group https://groups.google.com/group/zaproxy-users is a much better place for questions.

[kingthorin]

We discussed this further. The problem you're encountering is that the policy didn't exist, however, the script should not continue if the scan didn't start.

If you have further questions please take them to the ZAP User Group: https://groups.google.com/group/zaproxy-users

This ticket will be left open (for now) to track the script changes.

[adrianer]

For those who run into the issue here and find it as first result in Google (like me): the problem is running inside the Docker Container as root (so the part "-u root" of the docker run command), as it then looks for the policies and scripts in /root/.ZAP(_D) instead of /home/zap/.ZAP(_D) and it does not find them there.
This comes from this line and line below: https://github.com/zaproxy/zaproxy/blob/develop/docker/Dockerfile-weekly#L69 . To cover the root-case, those dirs should be copied into /root/ too.

[gnirlos]

Any update on this issue?

[kingthorin]

Just what was stated last Oct. Either don't run as root or copy the directories to the appropriate location.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.