Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add TAGs for yaml, xml, extended json #8423

Merged
merged 1 commit into from
Apr 30, 2024
Merged

Add TAGs for yaml, xml, extended json #8423

merged 1 commit into from
Apr 30, 2024

Conversation

kingthorin
Copy link
Member

@kingthorin kingthorin commented Mar 31, 2024 •
edited

  • config.xml > Add new patterns. Disabled by default.
  • Constant > Update version info, add upgrade method.
  • ConstantUnitTest > Add test to ensure new patterns are added on upgrade.
  • DefaultRegexAutoTagScannerTest > Added tests for the new patterns and modulized initial test(s).

Character length restrictions in the patterns are based on http://www.iana.org/assignments/media-types/media-types.xhtml plus extra. Mainly to prevent any possible ReDOS or just stupid processing on an invalid input.

Related to #8399 and #8456

@kingthorin kingthorin force-pushed the new-tags branch 2 times, most recently from 4026090 to 2ba0655 Compare March 31, 2024 00:49
@kingthorin
Copy link
Member Author

Will add some functionality like this to Constant to handle the upgrade.

@kingthorin
Copy link
Member Author

Ok I lied, it makes sense to me when it's something being updated or replaced. When it's something new I don't see how this would work out. How do I access the packaged config.xml in the installer vs the one in the installation home on the destination? (I assume the destination one is config being passed through Contstant.updateFrom*.)

@kingthorin kingthorin added this to the 2.15.0 milestone Apr 6, 2024
@thc202 thc202 changed the title regex tag scanner: Add TAGs for yaml, xml, extended json Add TAGs for yaml, xml, extended json Apr 9, 2024
@thc202
Copy link
Member

thc202 commented Apr 9, 2024

#8423 (comment)

See e.g. upgradeFrom1_2_0 which reads from the bundled configuration.

@kingthorin
Copy link
Member Author

Re-jigged the YAML and XML rules/tags.

@kingthorin
Copy link
Member Author

Fixed

@kingthorin
Copy link
Member Author

See e.g. upgradeFrom1_2_0 which reads from the bundled configuration.

I still need to work on this part.

@kingthorin
Copy link
Member Author

kingthorin commented Apr 25, 2024 •
edited

I'd like to get this into 2.15 which will help cover the Constant changes.

I'll prioritize working on it over the weekend and next week.

@psiinon psiinon mentioned this pull request Apr 25, 2024
Closed
56 tasks
@psiinon
Copy link
Member

psiinon commented Apr 25, 2024

I'd like to get this into 2.15 which will help cover the Constant changes.

I'll prioritize working on it over the weekend and next week.

I've added it to #8456 😁

@kingthorin
Copy link
Member Author

I decided working with the "new" config and trying to compare is too convoluted. I'm just going to use literals and add them when upgrading. Will update PR later today.

@kingthorin kingthorin force-pushed the new-tags branch 2 times, most recently from 06e7420 to cd80f37 Compare April 25, 2024 19:54
@kingthorin
Copy link
Member Author

Ready for review.

thc202
thc202 reviewed Apr 26, 2024
View reviewed changes
zap/src/main/java/org/parosproxy/paros/Constant.java Outdated Show resolved Hide resolved
zap/src/main/java/org/parosproxy/paros/Constant.java Outdated Show resolved Hide resolved
zap/src/test/java/org/parosproxy/paros/ConstantUnitTest.java Show resolved Hide resolved
zap/src/test/java/org/zaproxy/zap/extension/pscan/scanner/DefaultRegexAutoTagScannerTest.java Outdated Show resolved Hide resolved
zap/src/test/java/org/zaproxy/zap/extension/pscan/scanner/DefaultRegexAutoTagScannerTest.java Outdated Show resolved Hide resolved
zap/src/test/java/org/zaproxy/zap/extension/pscan/scanner/DefaultRegexAutoTagScannerTest.java Outdated Show resolved Hide resolved
zap/src/main/java/org/parosproxy/paros/Constant.java Outdated Show resolved Hide resolved
@kingthorin kingthorin force-pushed the new-tags branch 4 times, most recently from 2b345b1 to c9de075 Compare April 26, 2024 14:37
@kingthorin kingthorin force-pushed the new-tags branch 2 times, most recently from 4f2629c to 62f5a14 Compare April 26, 2024 14:41
@kingthorin kingthorin force-pushed the new-tags branch 2 times, most recently from 3173fef to 34f9874 Compare April 29, 2024 10:27
@kingthorin
Copy link
Member Author

kingthorin commented Apr 29, 2024 •
edited

Added the condition and hard coded the TYPE names.

@kingthorin
Copy link
Member Author

Okay hopefully that covers the last bits.

@kingthorin kingthorin force-pushed the new-tags branch 3 times, most recently from 131caea to 8c30507 Compare April 29, 2024 17:25
@kingthorin
regex tag scanner: Add TAGs for yaml, xml, extended json
0e861a3 
- config.xml > Add new patterns. Disabled by default.
- Constant > Update version info, add upgrade method.
- ConstantUnitTest > Add test to ensure new patterns are added on
upgrade.
- DefaultRegexAutoTagScannerTest > Added tests for the new patterns and
modulized initial test(s).

Character length restrictions in the patterns are based on
http://www.iana.org/assignments/media-types/media-types.xhtml plus
extra. Mainly to prevent any possible ReDOS or just stupid processing on
an invalid input.

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>
@thc202
Copy link
Member

thc202 commented Apr 29, 2024

Thank you!

@kingthorin kingthorin requested a review from psiinon April 30, 2024 01:58
@psiinon psiinon merged commit b972597 into zaproxy:main Apr 30, 2024
9 checks passed
@github-actions github-actions bot locked and limited conversation to collaborators Apr 30, 2024
@kingthorin kingthorin deleted the new-tags branch April 30, 2024 10:05
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@psiinon psiinon psiinon approved these changes

@thc202 thc202 thc202 approved these changes

Assignees
No one assigned
Labels
enhancement
Milestone
2.15.0
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@kingthorin @thc202 @psiinon