Examples with ApiResponse org.zaproxy.zap.extension.api.ApiResponse used on opensource projects

Example 1 with ApiResponse

use of org.zaproxy.zap.extension.api.ApiResponse in project zaproxy by zaproxy.

the class AutoUpdateAPI method handleApiView.

@Override
public ApiResponse handleApiView(String name, JSONObject params) throws ApiException {
    ApiResponse result;
    if (VIEW_LATEST_VERSION_NUMBER.equals(name)) {
        result = new ApiResponseElement(name, this.getLatestVersionNumber());
    } else if (VIEW_IS_LATEST_VERSION.equals(name)) {
        result = new ApiResponseElement(name, Boolean.toString(this.isLatestVersion()));
    } else if (VIEW_INSTALLED_ADDONS.equals(name)) {
        final ApiResponseList resultList = new ApiResponseList(name);
        for (AddOn ao : extension.getInstalledAddOns()) {
            resultList.addItem(addonToSet(ao));
        }
        result = resultList;
    } else if (VIEW_NEW_ADDONS.equals(name)) {
        final ApiResponseList resultList = new ApiResponseList(name);
        for (AddOn ao : extension.getNewAddOns()) {
            resultList.addItem(addonToSet(ao));
        }
        result = resultList;
    } else if (VIEW_UPDATED_ADDONS.equals(name)) {
        final ApiResponseList resultList = new ApiResponseList(name);
        for (AddOn ao : extension.getUpdatedAddOns()) {
            resultList.addItem(addonToSet(ao));
        }
        result = resultList;
    } else if (VIEW_MARKETPLACE_ADDONS.equals(name)) {
        final ApiResponseList resultList = new ApiResponseList(name);
        for (AddOn ao : extension.getMarketplaceAddOns()) {
            resultList.addItem(addonToSet(ao));
        }
        result = resultList;
    } else {
        throw new ApiException(ApiException.Type.BAD_VIEW);
    }
    return result;
}

Example 2 with ApiResponse

use of org.zaproxy.zap.extension.api.ApiResponse in project zaproxy by zaproxy.

the class AlertAPI method handleApiAction.

@Override
public ApiResponse handleApiAction(String name, JSONObject params) throws ApiException {
    if (ACTION_DELETE_ALERT.equals(name)) {
        int alertId = ApiUtils.getIntParam(params, PARAM_ID);
        extension.deleteAlert(getAlertFromDb(alertId));
    } else if (ACTION_DELETE_ALL_ALERTS.equals(name)) {
        extension.deleteAllAlerts();
    } else if (ACTION_UPDATE_ALERT.equals(name)) {
        int alertId = ApiUtils.getIntParam(params, PARAM_ALERT_ID);
        String alertName = params.getString(PARAM_ALERT_NAME);
        int riskId = getRiskId(params);
        int confidenceId = getConfidenceId(params);
        String desc = params.getString(PARAM_ALERT_DESCRIPTION);
        String param = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_PARAM);
        String attack = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_ATTACK);
        String otherInfo = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_OTHERINFO);
        String solution = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_SOLUTION);
        String refs = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_REFS);
        String evidence = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_EVIDENCE);
        int cweId = getParam(params, PARAM_CWEID, 0);
        int wascId = getParam(params, PARAM_WASCID, 0);
        Alert updatedAlert = getAlertFromDb(alertId);
        updatedAlert.setName(alertName);
        updatedAlert.setRisk(riskId);
        updatedAlert.setConfidence(confidenceId);
        updatedAlert.setDescription(desc);
        updatedAlert.setParam(param);
        updatedAlert.setAttack(attack);
        updatedAlert.setOtherInfo(otherInfo);
        updatedAlert.setSolution(solution);
        updatedAlert.setReference(refs);
        updatedAlert.setEvidence(evidence);
        updatedAlert.setCweId(cweId);
        updatedAlert.setWascId(wascId);
        processAlertUpdate(updatedAlert);
    } else if (ACTION_ADD_ALERT.equals(name)) {
        int messageId = ApiUtils.getIntParam(params, PARAM_MESSAGE_ID);
        String alertName = ApiUtils.getNonEmptyStringParam(params, PARAM_ALERT_NAME);
        int riskId = getRiskId(params);
        int confidenceId = getConfidenceId(params);
        String desc = params.getString(PARAM_ALERT_DESCRIPTION);
        String param = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_PARAM);
        String attack = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_ATTACK);
        String otherInfo = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_OTHERINFO);
        String solution = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_SOLUTION);
        String refs = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_REFS);
        String evidence = ApiUtils.getOptionalStringParam(params, PARAM_ALERT_EVIDENCE);
        int cweId = getParam(params, PARAM_CWEID, 0);
        int wascId = getParam(params, PARAM_WASCID, 0);
        HttpMessage msg = getHttpMessage(messageId);
        Alert newAlert = new Alert(-1, riskId, confidenceId, alertName);
        newAlert.setSource(Alert.Source.MANUAL);
        newAlert.setMessage(msg);
        newAlert.setUri(msg.getRequestHeader().getURI().toString());
        newAlert.setName(alertName);
        newAlert.setRisk(riskId);
        newAlert.setConfidence(confidenceId);
        newAlert.setDescription(desc);
        newAlert.setParam(param);
        newAlert.setAttack(attack);
        newAlert.setOtherInfo(otherInfo);
        newAlert.setSolution(solution);
        newAlert.setReference(refs);
        newAlert.setEvidence(evidence);
        newAlert.setCweId(cweId);
        newAlert.setWascId(wascId);
        extension.alertFound(newAlert, msg.getHistoryRef());
        return new ApiResponseElement(name, Integer.toString(newAlert.getAlertId()));
    } else if (ACTION_UPDATE_ALERTS_CONFIDENCE.equals(name)) {
        int confidenceId = getConfidenceId(params);
        updateAlerts(params, alert -> alert.setConfidence(confidenceId));
    } else if (ACTION_UPDATE_ALERTS_RISK.equals(name)) {
        int riskId = getRiskId(params);
        updateAlerts(params, alert -> alert.setRisk(riskId));
    } else {
        throw new ApiException(ApiException.Type.BAD_ACTION);
    }
    return ApiResponseElement.OK;
}

Example 3 with ApiResponse

use of org.zaproxy.zap.extension.api.ApiResponse in project zaproxy by zaproxy.

the class StatsAPI method handleApiView.

@Override
public ApiResponse handleApiView(String name, JSONObject params) throws ApiException {
    ApiResponse result = null;
    InMemoryStats memStats = extension.getInMemoryStats();
    if (memStats == null) {
        throw new ApiException(ApiException.Type.DOES_NOT_EXIST);
    }
    if (VIEW_STATS.equals(name)) {
        Map<String, String> map = new TreeMap<>();
        for (Entry<String, Long> stat : memStats.getStats(this.getParam(params, PARAM_KEY_PREFIX, "")).entrySet()) {
            map.put(stat.getKey(), stat.getValue().toString());
        }
        result = new ApiResponseSet<>(name, map);
    } else if (VIEW_ALL_SITES_STATS.equals(name)) {
        result = new ApiResponseList(name);
        for (Entry<String, Map<String, Long>> stats : memStats.getAllSiteStats(this.getParam(params, PARAM_KEY_PREFIX, "")).entrySet()) {
            ((ApiResponseList) result).addItem(new SiteStatsApiResponse(stats.getKey(), stats.getValue()));
        }
    } else if (VIEW_SITE_STATS.equals(name)) {
        String site = params.getString(PARAM_SITE);
        URI siteURI;
        try {
            siteURI = new URI(site, true);
            site = SessionStructure.getHostName(siteURI);
        } catch (Exception e) {
            throw new ApiException(ApiException.Type.ILLEGAL_PARAMETER, PARAM_SITE);
        }
        String scheme = siteURI.getScheme();
        if (scheme == null || (!scheme.equalsIgnoreCase("http") && !scheme.equalsIgnoreCase("https"))) {
            throw new ApiException(ApiException.Type.ILLEGAL_PARAMETER, PARAM_SITE);
        }
        result = new SiteStatsApiResponse(site, memStats.getSiteStats(site, this.getParam(params, PARAM_KEY_PREFIX, "")));
    } else {
        throw new ApiException(ApiException.Type.BAD_VIEW);
    }
    return result;
}

Example 4 with ApiResponse

use of org.zaproxy.zap.extension.api.ApiResponse in project zaproxy by zaproxy.

the class SpiderAPI method handleApiView.

@Override
public ApiResponse handleApiView(String name, JSONObject params) throws ApiException {
    ApiResponse result;
    if (VIEW_STATUS.equals(name)) {
        SpiderScan scan = this.getSpiderScan(params);
        int progress = 0;
        if (scan.isStopped()) {
            progress = 100;
        } else {
            progress = scan.getProgress();
        }
        result = new ApiResponseElement(name, Integer.toString(progress));
    } else if (VIEW_RESULTS.equals(name)) {
        result = new ApiResponseList(name);
        SpiderScan scan = this.getSpiderScan(params);
        synchronized (scan.getResults()) {
            for (String s : scan.getResults()) {
                ((ApiResponseList) result).addItem(new ApiResponseElement("url", s));
            }
        }
    } else if (VIEW_FULL_RESULTS.equals(name)) {
        ApiResponseList resultUrls = new ApiResponseList(name);
        SpiderScan scan = this.getSpiderScan(params);
        ApiResponseList resultList = new ApiResponseList("urlsInScope");
        synchronized (scan.getResourcesFound()) {
            for (SpiderResource sr : scan.getResourcesFound()) {
                resultList.addItem(createApiResponseSet(sr, sr.isProcessed(), sr.getReasonNotProcessed()));
            }
        }
        resultUrls.addItem(resultList);
        resultList = new ApiResponseList("urlsOutOfScope");
        synchronized (scan.getResultsOutOfScope()) {
            for (String url : scan.getResultsOutOfScope()) {
                resultList.addItem(new ApiResponseElement("url", url));
            }
        }
        resultUrls.addItem(resultList);
        resultList = new ApiResponseList("urlsIoError");
        synchronized (scan.getResourcesIoErrors()) {
            for (SpiderResource sr : scan.getResourcesIoErrors()) {
                resultList.addItem(createApiResponseSet(sr, sr.isProcessed(), sr.getReasonNotProcessed()));
            }
        }
        resultUrls.addItem(resultList);
        result = resultUrls;
    } else if (VIEW_EXCLUDED_FROM_SCAN.equals(name)) {
        result = new ApiResponseList(name);
        Session session = Model.getSingleton().getSession();
        List<String> regexs = session.getExcludeFromSpiderRegexs();
        for (String regex : regexs) {
            ((ApiResponseList) result).addItem(new ApiResponseElement("regex", regex));
        }
    } else if (VIEW_SCANS.equals(name)) {
        ApiResponseList resultList = new ApiResponseList(name);
        for (SpiderScan spiderScan : extension.getAllScans()) {
            Map<String, String> map = new HashMap<>();
            map.put("id", Integer.toString(spiderScan.getScanId()));
            map.put("progress", Integer.toString(spiderScan.getProgress()));
            map.put("state", spiderScan.getState());
            resultList.addItem(new ApiResponseSet<>("scan", map));
        }
        result = resultList;
    } else if (VIEW_ALL_URLS.equals(name)) {
        ApiResponseList resultUrls = new ApiResponseList(name);
        Set<String> urlSet = new HashSet<>();
        TableHistory tableHistory = extension.getModel().getDb().getTableHistory();
        List<Integer> ids = Collections.emptyList();
        try {
            ids = tableHistory.getHistoryIdsOfHistType(extension.getModel().getSession().getSessionId(), HistoryReference.TYPE_SPIDER, HistoryReference.TYPE_SPIDER_TASK);
        } catch (DatabaseException e) {
            throw new ApiException(ApiException.Type.INTERNAL_ERROR, e.getMessage());
        }
        String url;
        for (Integer id : ids) {
            try {
                RecordHistory rh = tableHistory.read(id);
                if (rh != null) {
                    url = rh.getHttpMessage().getRequestHeader().getURI().toString();
                    if (urlSet.add(url)) {
                        resultUrls.addItem(new ApiResponseElement("url", url));
                    }
                }
            } catch (HttpMalformedHeaderException | DatabaseException e) {
                throw new ApiException(ApiException.Type.INTERNAL_ERROR, e.getMessage());
            }
        }
        result = resultUrls;
    } else if (VIEW_ADDED_NODES.equals(name)) {
        result = new ApiResponseList(name);
        SpiderScan scan = this.getSpiderScan(params);
        for (String s : scan.getAddedNodesTableModel().getAddedNodes()) {
            ((ApiResponseList) result).addItem(new ApiResponseElement("url", s));
        }
    } else if (VIEW_DOMAINS_ALWAYS_IN_SCOPE.equals(name) || VIEW_OPTION_DOMAINS_ALWAYS_IN_SCOPE.equals(name)) {
        result = domainMatchersToApiResponseList(name, extension.getSpiderParam().getDomainsAlwaysInScope(), false);
    } else if (VIEW_OPTION_DOMAINS_ALWAYS_IN_SCOPE_ENABLED.equals(name)) {
        result = domainMatchersToApiResponseList(name, extension.getSpiderParam().getDomainsAlwaysInScope(), true);
    } else {
        throw new ApiException(ApiException.Type.BAD_VIEW);
    }
    return result;
}

Example 5 with ApiResponse

use of org.zaproxy.zap.extension.api.ApiResponse in project zaproxy by zaproxy.

the class ActiveScanAPI method handleApiView.

@Override
public ApiResponse handleApiView(String name, JSONObject params) throws ApiException {
    ApiResponse result;
    ActiveScan activeScan = null;
    ScanPolicy policy;
    int categoryId;
    switch(name) {
        case VIEW_STATUS:
            activeScan = getActiveScan(params);
            int progress = 0;
            if (activeScan.isStopped()) {
                progress = 100;
            } else {
                progress = activeScan.getProgress();
            }
            result = new ApiResponseElement(name, String.valueOf(progress));
            break;
        case VIEW_SCANS:
            ApiResponseList resultList = new ApiResponseList(name);
            for (ActiveScan scan : controller.getAllScans()) {
                Map<String, String> map = new HashMap<>();
                map.put("id", Integer.toString(scan.getScanId()));
                map.put("progress", Integer.toString(scan.getProgress()));
                map.put("state", scan.getState().name());
                map.put("reqCount", Integer.toString(scan.getTotalRequests()));
                map.put("alertCount", Integer.toString(scan.getAlertsIds().size()));
                map.put("newAlertCount", Integer.toString(scan.getTotalNewAlerts()));
                resultList.addItem(new ApiResponseSet<>("scan", map));
            }
            result = resultList;
            break;
        case VIEW_SCAN_PROGRESS:
            resultList = new ApiResponseList(name);
            activeScan = getActiveScan(params);
            for (HostProcess hp : activeScan.getHostProcesses()) {
                ApiResponseList hpList = new ApiResponseList("HostProcess");
                resultList.addItem(new ApiResponseElement("id", hp.getHostAndPort()));
                for (Plugin plugin : hp.getCompleted()) {
                    long timeTaken = plugin.getTimeFinished().getTime() - plugin.getTimeStarted().getTime();
                    int reqs = hp.getPluginRequestCount(plugin.getId());
                    int alertCount = hp.getPluginStats(plugin.getId()).getAlertCount();
                    hpList.addItem(createPluginProgressEntry(plugin, getStatus(hp, plugin, "Complete"), timeTaken, reqs, alertCount));
                }
                for (Plugin plugin : hp.getRunning()) {
                    int pc = hp.getTestCurrentCount(plugin) * 100 / hp.getTestTotalCount();
                    // enumerated at the beginning.
                    if (pc >= 100) {
                        pc = 99;
                    }
                    long timeTaken = new Date().getTime() - plugin.getTimeStarted().getTime();
                    int reqs = hp.getPluginRequestCount(plugin.getId());
                    int alertCount = hp.getPluginStats(plugin.getId()).getAlertCount();
                    hpList.addItem(createPluginProgressEntry(plugin, pc + "%", timeTaken, reqs, alertCount));
                }
                for (Plugin plugin : hp.getPending()) {
                    hpList.addItem(createPluginProgressEntry(plugin, getStatus(hp, plugin, "Pending"), 0, 0, 0));
                }
                resultList.addItem(hpList);
            }
            result = resultList;
            break;
        case VIEW_MESSAGES_IDS:
            resultList = new ApiResponseList(name);
            activeScan = getActiveScan(params);
            synchronized (activeScan.getMessagesIds()) {
                for (Integer id : activeScan.getMessagesIds()) {
                    resultList.addItem(new ApiResponseElement("id", id.toString()));
                }
            }
            result = resultList;
            break;
        case VIEW_ALERTS_IDS:
            resultList = new ApiResponseList(name);
            activeScan = getActiveScan(params);
            synchronized (activeScan.getAlertsIds()) {
                for (Integer id : activeScan.getAlertsIds()) {
                    resultList.addItem(new ApiResponseElement("id", id.toString()));
                }
            }
            result = resultList;
            break;
        case VIEW_EXCLUDED_FROM_SCAN:
            result = new ApiResponseList(name);
            Session session = Model.getSingleton().getSession();
            List<String> regexs = session.getExcludeFromScanRegexs();
            for (String regex : regexs) {
                ((ApiResponseList) result).addItem(new ApiResponseElement("regex", regex));
            }
            break;
        case VIEW_SCANNERS:
            policy = getScanPolicyFromParams(params);
            List<Plugin> scanners = policy.getPluginFactory().getAllPlugin();
            categoryId = getParam(params, PARAM_CATEGORY_ID, -1);
            if (categoryId != -1 && !hasPolicyWithId(categoryId)) {
                throw new ApiException(ApiException.Type.DOES_NOT_EXIST, PARAM_CATEGORY_ID);
            }
            resultList = new ApiResponseList(name);
            for (Plugin scanner : scanners) {
                if (categoryId == -1 || categoryId == scanner.getCategory()) {
                    resultList.addItem(new ScannerApiResponse(policy, scanner));
                }
            }
            result = resultList;
            break;
        case VIEW_POLICIES:
            policy = getScanPolicyFromParams(params);
            String[] policies = Category.getAllNames();
            resultList = new ApiResponseList(name);
            for (String pluginName : policies) {
                categoryId = Category.getCategory(pluginName);
                Plugin.AttackStrength attackStrength = getPolicyAttackStrength(policy, categoryId);
                Plugin.AlertThreshold alertThreshold = getPolicyAlertThreshold(policy, categoryId);
                Map<String, String> map = new HashMap<>();
                map.put("id", String.valueOf(categoryId));
                map.put("name", pluginName);
                map.put("attackStrength", attackStrength == null ? "" : String.valueOf(attackStrength));
                map.put("alertThreshold", alertThreshold == null ? "" : String.valueOf(alertThreshold));
                map.put("enabled", String.valueOf(isPolicyEnabled(policy, categoryId)));
                resultList.addItem(new ApiResponseSet<>("policy", map));
            }
            result = resultList;
            break;
        case VIEW_SCAN_POLICY_NAMES:
            resultList = new ApiResponseList(name);
            for (String policyName : controller.getPolicyManager().getAllPolicyNames()) {
                resultList.addItem(new ApiResponseElement("policy", policyName));
            }
            result = resultList;
            break;
        case VIEW_ATTACK_MODE_QUEUE:
            result = new ApiResponseElement(name, String.valueOf(controller.getAttackModeStackSize()));
            break;
        case VIEW_OPTION_EXCLUDED_PARAM_LIST:
        case VIEW_EXCLUDED_PARAMS:
            resultList = new ApiResponseList(name);
            List<ScannerParamFilter> excludedParams = controller.getScannerParam().getExcludedParamList();
            for (int i = 0; i < excludedParams.size(); i++) {
                resultList.addItem(new ExcludedParamApiResponse(excludedParams.get(i), i));
            }
            result = resultList;
            break;
        case VIEW_EXCLUDED_PARAM_TYPES:
            resultList = new ApiResponseList(name);
            for (Entry<Integer, String> type : ScannerParamFilter.getTypes().entrySet()) {
                Map<String, String> typeData = new HashMap<>();
                typeData.put("id", Integer.toString(type.getKey()));
                typeData.put("name", type.getValue());
                resultList.addItem(new ApiResponseSet<>("type", typeData));
            }
            result = resultList;
            break;
        default:
            throw new ApiException(ApiException.Type.BAD_VIEW);
    }
    return result;
}