use of org.parosproxy.paros.core.scanner.VariantJSONQuery in project zaproxy by zaproxy.
the class VariantFactory method createVariants.
public List<Variant> createVariants(ScannerParam scanOptions, HttpMessage message) {
List<Variant> listVariant = new ArrayList<>();
int targets = scanOptions.getTargetParamsInjectable();
int enabledRPC = scanOptions.getTargetParamsEnabledRPC();
// First check URL query-string target configuration
if ((targets & ScannerParam.TARGET_QUERYSTRING) != 0) {
VariantURLQuery vuq = new VariantURLQuery();
vuq.setAddQueryParam(scanOptions.isAddQueryParam());
listVariant.add(vuq);
if ((enabledRPC & ScannerParam.RPC_ODATA) != 0) {
listVariant.add(new VariantODataIdQuery());
listVariant.add(new VariantODataFilterQuery());
}
if ((targets & ScannerParam.TARGET_URLPATH) == 0) {
// If we're not already doing URLPath we should do DDN when doing QueryString
listVariant.add(new VariantDdnPath());
}
}
// Then check POST data target configuration and RPC enabled methods
if ((targets & ScannerParam.TARGET_POSTDATA) != 0) {
listVariant.add(new VariantFormQuery());
if ((enabledRPC & ScannerParam.RPC_MULTIPART) != 0) {
listVariant.add(new VariantMultipartFormParameters());
}
if ((enabledRPC & ScannerParam.RPC_XML) != 0) {
listVariant.add(new VariantXMLQuery());
}
if ((enabledRPC & ScannerParam.RPC_JSON) != 0) {
VariantJSONQuery variant = new VariantJSONQuery();
variant.setScanNullValues(scanOptions.isScanNullJsonValues());
listVariant.add(variant);
}
if ((enabledRPC & ScannerParam.RPC_GWT) != 0) {
listVariant.add(new VariantGWTQuery());
}
if ((enabledRPC & ScannerParam.RPC_DWR) != 0) {
listVariant.add(new VariantDirectWebRemotingQuery());
}
}
if ((targets & ScannerParam.TARGET_HTTPHEADERS) != 0) {
boolean addVariant = scanOptions.isScanHeadersAllRequests();
if (!addVariant) {
// If not scanning all requests check if it looks like a dynamic or static page
// (based on query/post parameters)
char[] query = message.getRequestHeader().getURI().getRawQuery();
addVariant = (query != null && query.length != 0) || message.getRequestBody().length() != 0;
}
if (addVariant) {
listVariant.add(new VariantHeader());
}
}
if ((targets & ScannerParam.TARGET_URLPATH) != 0) {
listVariant.add(new VariantURLPath());
}
if ((targets & ScannerParam.TARGET_COOKIE) != 0) {
listVariant.add(new VariantCookie());
}
// Now is time to initialize all the custom Variants
if ((enabledRPC & ScannerParam.RPC_CUSTOM) != 0 && getExtension() != null) {
List<ScriptWrapper> scripts = getExtension().getScripts(ExtensionActiveScan.SCRIPT_TYPE_VARIANT);
for (ScriptWrapper script : scripts) {
if (script.isEnabled()) {
listVariant.add(new VariantCustom(script, getExtension()));
}
}
}
if ((enabledRPC & ScannerParam.RPC_USERDEF) != 0) {
listVariant.add(new VariantUserDefined());
}
addCustomVariants(listVariant);
return listVariant;
}
use of org.parosproxy.paros.core.scanner.VariantJSONQuery in project zaproxy by zaproxy.
the class VariantFactoryUnitTest method shouldScanNullJsonValuesAsDefinedInOptions.
@ParameterizedTest
@ValueSource(booleans = { true, false })
void shouldScanNullJsonValuesAsDefinedInOptions(boolean scanNulls) {
// Given
ScannerParam scanOptions = mock(ScannerParam.class);
given(scanOptions.getTargetParamsInjectable()).willReturn(ScannerParam.TARGET_POSTDATA);
given(scanOptions.getTargetParamsEnabledRPC()).willReturn(ScannerParam.RPC_JSON);
given(scanOptions.isScanNullJsonValues()).willReturn(scanNulls);
HttpMessage message = new HttpMessage();
// When
List<Variant> variants = factory.createVariants(scanOptions, message);
// Then
VariantJSONQuery jsonVariant = getVariant(variants, VariantJSONQuery.class);
assertThat(jsonVariant.isScanNullValues(), is(equalTo(scanNulls)));
}
Aggregations