Search in sources :

Example 1 with VariantJSONQuery

use of org.parosproxy.paros.core.scanner.VariantJSONQuery in project zaproxy by zaproxy.

the class VariantFactory method createVariants.

public List<Variant> createVariants(ScannerParam scanOptions, HttpMessage message) {
    List<Variant> listVariant = new ArrayList<>();
    int targets = scanOptions.getTargetParamsInjectable();
    int enabledRPC = scanOptions.getTargetParamsEnabledRPC();
    // First check URL query-string target configuration
    if ((targets & ScannerParam.TARGET_QUERYSTRING) != 0) {
        VariantURLQuery vuq = new VariantURLQuery();
        vuq.setAddQueryParam(scanOptions.isAddQueryParam());
        listVariant.add(vuq);
        if ((enabledRPC & ScannerParam.RPC_ODATA) != 0) {
            listVariant.add(new VariantODataIdQuery());
            listVariant.add(new VariantODataFilterQuery());
        }
        if ((targets & ScannerParam.TARGET_URLPATH) == 0) {
            // If we're not already doing URLPath we should do DDN when doing QueryString
            listVariant.add(new VariantDdnPath());
        }
    }
    // Then check POST data target configuration and RPC enabled methods
    if ((targets & ScannerParam.TARGET_POSTDATA) != 0) {
        listVariant.add(new VariantFormQuery());
        if ((enabledRPC & ScannerParam.RPC_MULTIPART) != 0) {
            listVariant.add(new VariantMultipartFormParameters());
        }
        if ((enabledRPC & ScannerParam.RPC_XML) != 0) {
            listVariant.add(new VariantXMLQuery());
        }
        if ((enabledRPC & ScannerParam.RPC_JSON) != 0) {
            VariantJSONQuery variant = new VariantJSONQuery();
            variant.setScanNullValues(scanOptions.isScanNullJsonValues());
            listVariant.add(variant);
        }
        if ((enabledRPC & ScannerParam.RPC_GWT) != 0) {
            listVariant.add(new VariantGWTQuery());
        }
        if ((enabledRPC & ScannerParam.RPC_DWR) != 0) {
            listVariant.add(new VariantDirectWebRemotingQuery());
        }
    }
    if ((targets & ScannerParam.TARGET_HTTPHEADERS) != 0) {
        boolean addVariant = scanOptions.isScanHeadersAllRequests();
        if (!addVariant) {
            // If not scanning all requests check if it looks like a dynamic or static page
            // (based on query/post parameters)
            char[] query = message.getRequestHeader().getURI().getRawQuery();
            addVariant = (query != null && query.length != 0) || message.getRequestBody().length() != 0;
        }
        if (addVariant) {
            listVariant.add(new VariantHeader());
        }
    }
    if ((targets & ScannerParam.TARGET_URLPATH) != 0) {
        listVariant.add(new VariantURLPath());
    }
    if ((targets & ScannerParam.TARGET_COOKIE) != 0) {
        listVariant.add(new VariantCookie());
    }
    // Now is time to initialize all the custom Variants
    if ((enabledRPC & ScannerParam.RPC_CUSTOM) != 0 && getExtension() != null) {
        List<ScriptWrapper> scripts = getExtension().getScripts(ExtensionActiveScan.SCRIPT_TYPE_VARIANT);
        for (ScriptWrapper script : scripts) {
            if (script.isEnabled()) {
                listVariant.add(new VariantCustom(script, getExtension()));
            }
        }
    }
    if ((enabledRPC & ScannerParam.RPC_USERDEF) != 0) {
        listVariant.add(new VariantUserDefined());
    }
    addCustomVariants(listVariant);
    return listVariant;
}
Also used : VariantODataIdQuery(org.parosproxy.paros.core.scanner.VariantODataIdQuery) VariantJSONQuery(org.parosproxy.paros.core.scanner.VariantJSONQuery) VariantXMLQuery(org.parosproxy.paros.core.scanner.VariantXMLQuery) ArrayList(java.util.ArrayList) VariantURLPath(org.parosproxy.paros.core.scanner.VariantURLPath) VariantMultipartFormParameters(org.parosproxy.paros.core.scanner.VariantMultipartFormParameters) VariantGWTQuery(org.parosproxy.paros.core.scanner.VariantGWTQuery) VariantDirectWebRemotingQuery(org.parosproxy.paros.core.scanner.VariantDirectWebRemotingQuery) Variant(org.parosproxy.paros.core.scanner.Variant) VariantURLQuery(org.parosproxy.paros.core.scanner.VariantURLQuery) VariantFormQuery(org.parosproxy.paros.core.scanner.VariantFormQuery) VariantUserDefined(org.parosproxy.paros.core.scanner.VariantUserDefined) VariantHeader(org.parosproxy.paros.core.scanner.VariantHeader) VariantCookie(org.parosproxy.paros.core.scanner.VariantCookie) ScriptWrapper(org.zaproxy.zap.extension.script.ScriptWrapper) VariantDdnPath(org.parosproxy.paros.core.scanner.VariantDdnPath) VariantODataFilterQuery(org.parosproxy.paros.core.scanner.VariantODataFilterQuery) VariantCustom(org.parosproxy.paros.core.scanner.VariantCustom)

Example 2 with VariantJSONQuery

use of org.parosproxy.paros.core.scanner.VariantJSONQuery in project zaproxy by zaproxy.

the class VariantFactoryUnitTest method shouldScanNullJsonValuesAsDefinedInOptions.

@ParameterizedTest
@ValueSource(booleans = { true, false })
void shouldScanNullJsonValuesAsDefinedInOptions(boolean scanNulls) {
    // Given
    ScannerParam scanOptions = mock(ScannerParam.class);
    given(scanOptions.getTargetParamsInjectable()).willReturn(ScannerParam.TARGET_POSTDATA);
    given(scanOptions.getTargetParamsEnabledRPC()).willReturn(ScannerParam.RPC_JSON);
    given(scanOptions.isScanNullJsonValues()).willReturn(scanNulls);
    HttpMessage message = new HttpMessage();
    // When
    List<Variant> variants = factory.createVariants(scanOptions, message);
    // Then
    VariantJSONQuery jsonVariant = getVariant(variants, VariantJSONQuery.class);
    assertThat(jsonVariant.isScanNullValues(), is(equalTo(scanNulls)));
}
Also used : Variant(org.parosproxy.paros.core.scanner.Variant) ScannerParam(org.parosproxy.paros.core.scanner.ScannerParam) VariantJSONQuery(org.parosproxy.paros.core.scanner.VariantJSONQuery) HttpMessage(org.parosproxy.paros.network.HttpMessage) ValueSource(org.junit.jupiter.params.provider.ValueSource) ParameterizedTest(org.junit.jupiter.params.ParameterizedTest)

Aggregations

Variant (org.parosproxy.paros.core.scanner.Variant)2 VariantJSONQuery (org.parosproxy.paros.core.scanner.VariantJSONQuery)2 ArrayList (java.util.ArrayList)1 ParameterizedTest (org.junit.jupiter.params.ParameterizedTest)1 ValueSource (org.junit.jupiter.params.provider.ValueSource)1 ScannerParam (org.parosproxy.paros.core.scanner.ScannerParam)1 VariantCookie (org.parosproxy.paros.core.scanner.VariantCookie)1 VariantCustom (org.parosproxy.paros.core.scanner.VariantCustom)1 VariantDdnPath (org.parosproxy.paros.core.scanner.VariantDdnPath)1 VariantDirectWebRemotingQuery (org.parosproxy.paros.core.scanner.VariantDirectWebRemotingQuery)1 VariantFormQuery (org.parosproxy.paros.core.scanner.VariantFormQuery)1 VariantGWTQuery (org.parosproxy.paros.core.scanner.VariantGWTQuery)1 VariantHeader (org.parosproxy.paros.core.scanner.VariantHeader)1 VariantMultipartFormParameters (org.parosproxy.paros.core.scanner.VariantMultipartFormParameters)1 VariantODataFilterQuery (org.parosproxy.paros.core.scanner.VariantODataFilterQuery)1 VariantODataIdQuery (org.parosproxy.paros.core.scanner.VariantODataIdQuery)1 VariantURLPath (org.parosproxy.paros.core.scanner.VariantURLPath)1 VariantURLQuery (org.parosproxy.paros.core.scanner.VariantURLQuery)1 VariantUserDefined (org.parosproxy.paros.core.scanner.VariantUserDefined)1 VariantXMLQuery (org.parosproxy.paros.core.scanner.VariantXMLQuery)1