diff --git a/addOns/reports/CHANGELOG.md b/addOns/reports/CHANGELOG.md index 4f82eca1398..58e293c5713 100644 --- a/addOns/reports/CHANGELOG.md +++ b/addOns/reports/CHANGELOG.md @@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## Unreleased ### Added - Stats counter to the main toolbar button (Issue 8375). -- Sequence data to JSON reports. +- Sequence data to JSON & HTML reports. ### Changed - Update automation job help. diff --git a/addOns/reports/reports.gradle.kts b/addOns/reports/reports.gradle.kts index 73636a17469..414fed77679 100644 --- a/addOns/reports/reports.gradle.kts +++ b/addOns/reports/reports.gradle.kts @@ -76,6 +76,7 @@ spotless { fileTree(projectDir) { include("src/**/*.html") exclude("src/main/zapHomeFiles/reports/risk-confidence-html/report.html") + exclude("src/main/zapHomeFiles/reports/traditional-html*/report.html") exclude("src/test/**/*.html") }, ) diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-plus-sequence-details.png b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-plus-sequence-details.png new file mode 100644 index 00000000000..e102c366bcb Binary files /dev/null and b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-plus-sequence-details.png differ diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-sequence-details.png b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-sequence-details.png new file mode 100644 index 00000000000..f85d218a23f Binary files /dev/null and b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-sequence-details.png differ diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-sequence-summary.png b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-sequence-summary.png new file mode 100644 index 00000000000..712d115fcb7 Binary files /dev/null and b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/common/images/report-traditional-html-sequence-summary.png differ diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html-plus.html b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html-plus.html index c3abb9e9828..77c33b6e64e 100644 --- a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html-plus.html +++ b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html-plus.html @@ -41,8 +41,23 @@

Sections

Parameters params + + Sequence Details + sequencedetails + +

Sequence Support

+ + If "Sequence Details" are included in the report. Both a summary + section and details section will be included. +

+ Traditional HTML Plus - Sequences Summary +

+ Traditional HTML OPlus - Sequences Details +

Themes

diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html.html b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html.html index cbad1f99134..a80ddee994f 100644 --- a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html.html +++ b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-html.html @@ -25,6 +25,10 @@

Sections

+ + + +
Alert Details alertdetails
Sequence Detailssequencedetails

Screenshot

@@ -33,6 +37,17 @@

Screenshot

Traditional HTML +

Sequence Support

+ + If "Sequence Details" are included in the report. Both a summary + section and details section will be included. +

+ Traditional HTML - Sequences Summary +

+ Traditional HTML - Sequences Details + diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json-plus.html b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json-plus.html index 08039551fd2..c56e1dbdbdc 100644 --- a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json-plus.html +++ b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json-plus.html @@ -83,6 +83,66 @@

About riskdesc

+ The report can also include details of Sequences and related active + scanning results, for example: + +
+    "sequences": [
+      {
+        "name": "Seq name",
+        "steps": [
+          {
+            "step": "1",
+            "pass": "true",
+            "resultDetails": "Pass",
+            "alertIds": [],
+            "original": {
+              "uri": "https://www.example.com/step1",
+              "method": "GET",
+              "request-header": "GET https://www.example.com/step1 HTTP/1.1\r\nhost: www.example.com\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0\r\npragma: no-cache\r\ncache-control: no-cache\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "request-body": "\\x0000\\x0013",
+              "response-header": "HTTP/1.0 0\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "response-body": "\\x0000\\x0013"
+            },
+            "replay": {
+              "uri": "https://www.example.com/step1",
+              "method": "GET",
+              "request-header": "GET https://www.example.com/step1 HTTP/1.1\r\nhost: www.example.com\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0\r\npragma: no-cache\r\ncache-control: no-cache\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "request-body": "\\x0000\\x0013",
+              "response-header": "HTTP/1.0 0\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "response-body": "\\x0000\\x0013"
+            }
+          },
+          {
+            "step": "2",
+            "pass": "false",
+            "resultDetails": "Fail",
+            "alertIds": [
+              2,
+              4
+            ],
+            "original": {
+              "uri": "https://www.example.com/step2",
+              "method": "GET",
+              "request-header": "GET https://www.example.com/step2 HTTP/1.1\r\nhost: www.example.com\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0\r\npragma: no-cache\r\ncache-control: no-cache\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "request-body": "\\x0000\\x0013",
+              "response-header": "HTTP/1.0 0\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "response-body": "\\x0000\\x0013"
+            },
+            "replay": {
+              "uri": "https://www.example.com/step2",
+              "method": "GET",
+              "request-header": "GET https://www.example.com/step2 HTTP/1.1\r\nhost: www.example.com\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0\r\npragma: no-cache\r\ncache-control: no-cache\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "request-body": "\\x0000\\x0013",
+              "response-header": "HTTP/1.0 0\r\nTest: Foo-Header\\x0000\\x0013\r\n\r\n",
+              "response-body": "\\x0000\\x0013"
+            }
+          }
+        ]
+      }
+    ]
+
+ diff --git a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json.html b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json.html index 6e0ed93dc47..dbb38efb094 100644 --- a/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json.html +++ b/addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/report-traditional-json.html @@ -61,6 +61,49 @@

About riskdesc

+ The report can also include details of Sequences and related active + scanning results, for example: + +
+    "sequences": [
+      {
+        "name": "Seq name",
+        "steps": [
+          {
+            "step": "1",
+            "pass": "true",
+            "resultDetails": "Pass",
+            "alertIds": [],
+            "original": {
+              "uri": "https://www.example.com/step1",
+              "method": "GET"
+            },
+            "replay": {
+              "uri": "https://www.example.com/step1",
+              "method": "GET"
+            }
+          },
+          {
+            "step": "2",
+            "pass": "false",
+            "resultDetails": "Fail",
+            "alertIds": [
+              2,
+              4
+            ],
+            "original": {
+              "uri": "https://www.example.com/step2",
+              "method": "GET"
+            },
+            "replay": {
+              "uri": "https://www.example.com/step2",
+              "method": "GET"
+            }
+          }
+        ]
+      }
+    ]
+
diff --git a/addOns/reports/src/main/resources/org/zaproxy/addon/reports/resources/Messages.properties b/addOns/reports/src/main/resources/org/zaproxy/addon/reports/resources/Messages.properties index fd9755376d5..da48a962602 100644 --- a/addOns/reports/src/main/resources/org/zaproxy/addon/reports/resources/Messages.properties +++ b/addOns/reports/src/main/resources/org/zaproxy/addon/reports/resources/Messages.properties @@ -132,6 +132,24 @@ reports.report.risk.1 = Low reports.report.risk.2 = Medium reports.report.risk.3 = High +reports.report.sequences.details.name = Sequence Details +reports.report.sequences.details.note = With the associated active scan results. +reports.report.sequences.list.name = Name +reports.report.sequences.step.alerts = Alerts: +reports.report.sequences.step.label = Step +reports.report.sequences.step.original = Original +reports.report.sequences.step.replay = Replay +reports.report.sequences.step.req.body = Request Body +reports.report.sequences.step.req.header = Request Header +reports.report.sequences.step.request = Request +reports.report.sequences.step.resp.body = Response Body +reports.report.sequences.step.resp.header = Response Header +reports.report.sequences.step.response = Response +reports.report.sequences.step.result = Result: +reports.report.sequences.step.showhide = Show / Hide Request & Response +reports.report.sequences.summary.name = Summary of Sequences +reports.report.sequences.summary.note = For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any). + reports.report.site = Site: {0} reports.report.sites = Sites: {0} reports.report.sites.title = Sites diff --git a/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/Messages.properties b/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/Messages.properties index 91bcbfda738..43221b7dd77 100644 --- a/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/Messages.properties +++ b/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/Messages.properties @@ -17,6 +17,7 @@ report.template.section.chart = Chart report.template.section.instancecount = Instance Count report.template.section.params = Parameters report.template.section.passingrules = Passing Rules +report.template.section.sequencedetails = Sequence Details report.template.section.statistics = Statistics report.template.stats.auth = Authentication Statistics report.template.stats.auth.none = No Authentication Statistics Found diff --git a/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/report.html b/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/report.html index 41a149a4be0..ac3fba6d1c8 100644 --- a/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/report.html +++ b/addOns/reports/src/main/zapHomeFiles/reports/traditional-html-plus/report.html @@ -10,16 +10,23 @@ + + + - + -

- - - Test Title -

-

- - Test Description - - +

+ + + Test Title +

+

+ + Test Description + + -

- !reports.report.generated! -

-

- !reports.report.zapVersion! -

-

- ZAP by Checkmarx -

- - - -

- +

+ - -

!reports.report.alerts.summary!

- - - - - - - - - - - - - - - - - - - - - - - - - -
!reports.report.alerts.summary.risklevel!!reports.report.alerts.summary.numalerts!
-
!reports.report.risk.3!
-
-
1
-
-
!reports.report.risk.2!
-
-
0
-
-
!reports.report.risk.1!
-
-
0
-
-
!reports.report.risk.0!
-
-
1
-
-
!reports.report.risk.-1!
-
-
0
-
-
- + +

!reports.report.alerts.summary!

+ + + + + + + + + + + + + + + + + + + + + + + + + +
!reports.report.alerts.summary.risklevel!!reports.report.alerts.summary.numalerts!
+
!reports.report.risk.3!
+
+
1
+
+
!reports.report.risk.2!
+
+
0
+
+
!reports.report.risk.1!
+
+
0
+
+
!reports.report.risk.0!
+
+
1
+
+
!reports.report.risk.-1!
+
+
0
+
+
+ - -

!reports.report.alerts.list!

- - - - - - - - - - - - - - - - -
!reports.report.alerts.list.name!!reports.report.alerts.list.risklevel!!reports.report.alerts.list.numinstances!
XSS!reports.report.risk.3!2
!reports.report.risk.0!0
-
- + + + - -

Passing Rules

- - - - - - - - - -
!reports.report.alerts.list.name!Rule TypeThresholdStrength
-
- + +

!reports.report.alerts.list!

+ + + + + + + + + + + + + + + + +
!reports.report.alerts.list.name!!reports.report.alerts.list.risklevel!!reports.report.alerts.list.numinstances!
XSS!reports.report.risk.3!2
!reports.report.risk.0!0
+
+ -

!reports.report.sites.title!

+ +

Passing Rules

+ + + + + + + + + +
!reports.report.alerts.list.name!Rule TypeThresholdStrength
+
+ - Number of Sites tree nodes actively scanned: - 0 +

!reports.report.sites.title!

- -

http://example.com

- - - - - - + Number of Sites tree nodes actively scanned: + 0 - -
HTTP Response CodeNumber of Responses
-
-

No Authentication Statistics Found

- - - + +

http://example.com

+ + + + + + - + +
HTTP Response CodeNumber of Responses
+
+

No Authentication Statistics Found

+ + + -
- + - -

!reports.report.alerts.detail!

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
!reports.report.risk.3!
XSS
!reports.report.alerts.detail.description! -
XSS Description
- -
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test 'Other\
- -
!reports.report.alerts.detail.request.header! - !reports.report.size! - - -
!reports.report.alerts.detail.request.body! - !reports.report.size! - - -
!reports.report.alerts.detail.response.header! - !reports.report.size! - - -
!reports.report.alerts.detail.response.body! - !reports.report.size! - - -
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test Another 'Other\
- -
!reports.report.alerts.detail.request.header! - !reports.report.size! - - -
!reports.report.alerts.detail.request.body! - !reports.report.size! - - -
!reports.report.alerts.detail.response.header! - !reports.report.size! - - -
!reports.report.alerts.detail.response.body! - !reports.report.size! - - -
!reports.report.alerts.detail.instances!2
!reports.report.alerts.detail.solution! -
Test Solution
- -
!reports.report.alerts.detail.reference! - Test Reference - -
!reports.report.alerts.detail.tags! +
+ + + +

!reports.report.alerts.detail!

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
!reports.report.risk.3!
XSS
!reports.report.alerts.detail.description! +
XSS Description
+ +
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test 'Other\
+ +
!reports.report.alerts.detail.request.header! + !reports.report.size! + + +
!reports.report.alerts.detail.request.body! + !reports.report.size! + + +
!reports.report.alerts.detail.response.header! + !reports.report.size! + + +
!reports.report.alerts.detail.response.body! + !reports.report.size! + + +
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test Another 'Other\
+ +
!reports.report.alerts.detail.request.header! + !reports.report.size! + + +
!reports.report.alerts.detail.request.body! + !reports.report.size! + + +
!reports.report.alerts.detail.response.header! + !reports.report.size! + + +
!reports.report.alerts.detail.response.body! + !reports.report.size! + + +
!reports.report.alerts.detail.instances!2
!reports.report.alerts.detail.solution! +
Test Solution
+ +
!reports.report.alerts.detail.reference! + Test Reference + +
!reports.report.alerts.detail.tags! + + + + tagkey + = + tagvalue + + +
!reports.report.alerts.detail.cweid!123
!reports.report.alerts.detail.wascid!456
!reports.report.alerts.detail.pluginid!1
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
!reports.report.risk.0!
!reports.report.alerts.detail.description!
!reports.report.alerts.detail.instances!0
!reports.report.alerts.detail.solution!
!reports.report.alerts.detail.reference!
!reports.report.alerts.detail.tags!
!reports.report.alerts.detail.cweid!
!reports.report.alerts.detail.wascid!
!reports.report.alerts.detail.pluginid!1
+
+ + + + + + + + - - - tagkey - = - tagvalue - - -
!reports.report.alerts.detail.cweid!123
!reports.report.alerts.detail.wascid!456
!reports.report.alerts.detail.pluginid!1
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
!reports.report.risk.0!
!reports.report.alerts.detail.description!
!reports.report.alerts.detail.instances!0
!reports.report.alerts.detail.solution!
!reports.report.alerts.detail.reference!
!reports.report.alerts.detail.tags!
!reports.report.alerts.detail.cweid!
!reports.report.alerts.detail.wascid!
!reports.report.alerts.detail.pluginid!1
-
- - diff --git a/addOns/reports/src/test/resources/org/zaproxy/addon/reports/resources/basic-traditional-html.html b/addOns/reports/src/test/resources/org/zaproxy/addon/reports/resources/basic-traditional-html.html index d2d7d461fdb..b6b9595a6e6 100644 --- a/addOns/reports/src/test/resources/org/zaproxy/addon/reports/resources/basic-traditional-html.html +++ b/addOns/reports/src/test/resources/org/zaproxy/addon/reports/resources/basic-traditional-html.html @@ -5,381 +5,475 @@ Test Title -

- - - Test Title -

-

- - Test Description - - - -

- - !reports.report.site! - -

- -

- !reports.report.generated! -

- -

- !reports.report.zapVersion! -

- -

- ZAP by Checkmarx -

- - -

!reports.report.alerts.summary!

- - - - - - - - - - - - - - - - - - - - - - - - - -
!reports.report.alerts.summary.risklevel!!reports.report.alerts.summary.numalerts!
-
!reports.report.risk.3!
-
-
1
-
-
!reports.report.risk.2!
-
-
0
-
-
!reports.report.risk.1!
-
-
0
-
-
!reports.report.risk.0!
-
-
1
-
-
!reports.report.risk.-1!
-
-
0
-
-
- - - -

!reports.report.alerts.list!

- - - - - - - - - - - - - - - - -
!reports.report.alerts.list.name!!reports.report.alerts.list.risklevel!!reports.report.alerts.list.numinstances!
XSS!reports.report.risk.3!2
!reports.report.risk.0!0
-
- - - -

!reports.report.alerts.detail!

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
!reports.report.risk.3!
XSS
!reports.report.alerts.detail.description! -
XSS Description
- -
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test 'Other\
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test Another 'Other\
!reports.report.alerts.detail.instances!2
!reports.report.alerts.detail.solution! -
Test Solution
- -
!reports.report.alerts.detail.reference! - Test Reference - -
!reports.report.alerts.detail.cweid!123
!reports.report.alerts.detail.wascid!456
!reports.report.alerts.detail.pluginid!1
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
!reports.report.risk.0!
!reports.report.alerts.detail.description!
!reports.report.alerts.detail.instances!0
!reports.report.alerts.detail.solution!
!reports.report.alerts.detail.reference!
!reports.report.alerts.detail.cweid!
!reports.report.alerts.detail.wascid!
!reports.report.alerts.detail.pluginid!1
-
- - +

+ + + Test Title +

+

+ + Test Description + + + +

+ + !reports.report.site! + +

+ +

+ !reports.report.generated! +

+ +

+ !reports.report.zapVersion! +

+ +

+ ZAP by Checkmarx +

+ + +

!reports.report.alerts.summary!

+ + + + + + + + + + + + + + + + + + + + + + + + + +
!reports.report.alerts.summary.risklevel!!reports.report.alerts.summary.numalerts!
+
!reports.report.risk.3!
+
+
1
+
+
!reports.report.risk.2!
+
+
0
+
+
!reports.report.risk.1!
+
+
0
+
+
!reports.report.risk.0!
+
+
1
+
+
!reports.report.risk.-1!
+
+
0
+
+
+ + + + + + + +

!reports.report.alerts.list!

+ + + + + + + + + + + + + + + + +
!reports.report.alerts.list.name!!reports.report.alerts.list.risklevel!!reports.report.alerts.list.numinstances!
XSS!reports.report.risk.3!2
!reports.report.risk.0!0
+
+ + + +

!reports.report.alerts.detail!

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
!reports.report.risk.3!
XSS
!reports.report.alerts.detail.description! +
XSS Description
+ +
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test 'Other\
!reports.report.alerts.detail.url!http://example.com/example_3
!reports.report.alerts.detail.method!GET
!reports.report.alerts.detail.param!Test Param
!reports.report.alerts.detail.attack!Test "Attack\"
!reports.report.alerts.detail.evidence!Test <p>Evidence
!reports.report.alerts.detail.otherinfo!Test Another 'Other\
!reports.report.alerts.detail.instances!2
!reports.report.alerts.detail.solution! +
Test Solution
+ +
!reports.report.alerts.detail.reference! + Test Reference + +
!reports.report.alerts.detail.cweid!123
!reports.report.alerts.detail.wascid!456
!reports.report.alerts.detail.pluginid!1
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
!reports.report.risk.0!
!reports.report.alerts.detail.description!
!reports.report.alerts.detail.instances!0
!reports.report.alerts.detail.solution!
!reports.report.alerts.detail.reference!
!reports.report.alerts.detail.cweid!
!reports.report.alerts.detail.wascid!
!reports.report.alerts.detail.pluginid!1
+
+ + + + + + + diff --git a/addOns/sequence/src/main/java/org/zaproxy/zap/extension/sequence/StdActiveScanRunner.java b/addOns/sequence/src/main/java/org/zaproxy/zap/extension/sequence/StdActiveScanRunner.java index 79c1d02786f..169fc3a1cad 100644 --- a/addOns/sequence/src/main/java/org/zaproxy/zap/extension/sequence/StdActiveScanRunner.java +++ b/addOns/sequence/src/main/java/org/zaproxy/zap/extension/sequence/StdActiveScanRunner.java @@ -28,8 +28,13 @@ import org.apache.logging.log4j.Logger; import org.parosproxy.paros.Constant; import org.parosproxy.paros.control.Control; +import org.parosproxy.paros.core.scanner.Alert; +import org.parosproxy.paros.db.DatabaseException; +import org.parosproxy.paros.db.RecordAlert; +import org.parosproxy.paros.db.TableAlert; import org.parosproxy.paros.extension.history.ExtensionHistory; import org.parosproxy.paros.model.HistoryReference; +import org.parosproxy.paros.model.Model; import org.parosproxy.paros.model.SiteNode; import org.parosproxy.paros.network.HttpMessage; import org.zaproxy.addon.network.ExtensionNetwork; @@ -218,6 +223,7 @@ public static class SequenceStepData { private boolean pass; private String result; private List alertIds; + private List alerts; private HttpMessage originalMsg; private HttpMessage replayMsg; @@ -235,5 +241,30 @@ public SequenceStepData( this.originalMsg = originalMsg; this.replayMsg = replayMsg; } + + public List getAlerts() { + if (alerts == null) { + alerts = new ArrayList<>(); + TableAlert tableAlert = Model.getSingleton().getDb().getTableAlert(); + alertIds.forEach( + id -> { + try { + RecordAlert recoardAlert = tableAlert.read(id); + if (recoardAlert != null) { + alerts.add(new Alert(recoardAlert)); + } + } catch (DatabaseException e) { + LOGGER.warn( + "Couldn't get alert for ID {} : {}", id, e.getMessage()); + } + }); + } + + return alerts; + } + + public int getHighestAlert() { + return getAlerts().stream().map(Alert::getRisk).max(Integer::compare).orElse(-1); + } } }