Examples with ScanFilter org.zaproxy.zap.extension.ascan.filters.ScanFilter used on opensource projects

Example 1 with ScanFilter

use of org.zaproxy.zap.extension.ascan.filters.ScanFilter in project zaproxy by zaproxy.

the class HostProcess method filterNode.

private boolean filterNode(StructuralNode node) {
    for (ScanFilter scanFilter : parentScanner.getScanFilters()) {
        try {
            FilterResult filterResult = scanFilter.isFiltered(node);
            if (filterResult.isFiltered()) {
                try {
                    HttpMessage msg = node.getHistoryReference().getHttpMessage();
                    parentScanner.notifyFilteredMessage(msg, filterResult.getReason());
                } catch (HttpMalformedHeaderException | DatabaseException e) {
                    log.warn("Error while getting httpmessage from history reference: " + e.getMessage(), e);
                }
                if (log.isDebugEnabled()) {
                    log.debug("Ignoring filtered node: " + node.getName() + " Reason: " + filterResult.getReason());
                }
                return true;
            }
        } catch (Exception ex) {
            log.error(ex.getMessage(), ex);
        }
    }
    return false;
}

Example 2 with ScanFilter

use of org.zaproxy.zap.extension.ascan.filters.ScanFilter in project zaproxy by zaproxy.

the class HostProcessUnitTest method shouldScanNonFilteredNode.

@Test
void shouldScanNonFilteredNode() {
    // Given
    ScanFilter scanFilter = mock(ScanFilter.class);
    given(scanFilter.isFiltered(any())).willReturn(FilterResult.NOT_FILTERED);
    given(scanner.getScanFilters()).willReturn(asList(scanFilter));
    StructuralNode node = createLeafNode("GET:file", "GET", "http://localhost/file");
    hostProcess.setStartNode(node);
    // When
    hostProcess.run();
    // Then
    assertThat(hostProcess.getTestTotalCount(), is(equalTo(1)));
    verify(scanFilter).isFiltered(node);
    verify(scanner, times(0)).notifyFilteredMessage(any(), any());
}

Example 3 with ScanFilter

use of org.zaproxy.zap.extension.ascan.filters.ScanFilter in project zaproxy by zaproxy.

the class HostProcessUnitTest method shouldNotScanFilteredNode.

@Test
void shouldNotScanFilteredNode() throws Exception {
    // Given
    ScanFilter scanFilter = mock(ScanFilter.class);
    String filteredReason = "reason";
    FilterResult filterResult = new FilterResult(filteredReason);
    given(scanFilter.isFiltered(any())).willReturn(filterResult);
    given(scanner.getScanFilters()).willReturn(asList(scanFilter));
    HttpMessage httpMessage = mock(HttpMessage.class);
    StructuralNode node = createLeafNode("GET:file", "GET", "http://localhost/file");
    given(node.getHistoryReference().getHttpMessage()).willReturn(httpMessage);
    hostProcess.setStartNode(node);
    // When
    hostProcess.run();
    // Then
    assertThat(hostProcess.getTestTotalCount(), is(equalTo(0)));
    verify(scanFilter).isFiltered(node);
    verify(scanner).notifyFilteredMessage(httpMessage, filteredReason);
}

Example 4 with ScanFilter

use of org.zaproxy.zap.extension.ascan.filters.ScanFilter in project zaproxy by zaproxy.

the class CustomScanDialog method save.

/**
 * Use the save method to launch a scan
 */
@Override
public void save() {
    List<Object> contextSpecificObjects = new ArrayList<>();
    techTreeState = getTechTree().getTechSet();
    if (!this.getBoolValue(FIELD_ADVANCED)) {
        contextSpecificObjects.add(scanPolicy);
    } else {
        contextSpecificObjects.add(policyPanel.getScanPolicy());
        if (target == null && this.customPanels != null) {
            // One of the custom scan panels must have specified a target
            for (CustomScanPanel customPanel : this.customPanels) {
                target = customPanel.getTarget();
                if (target != null) {
                    break;
                }
            }
        }
        // Save all Variant configurations
        getVariantPanel().saveParam(scannerParam);
        // force all injectable params and rpc model to NULL
        if (getDisableNonCustomVectors().isSelected()) {
            scannerParam.setTargetParamsInjectable(0);
            scannerParam.setTargetParamsEnabledRPC(0);
        }
        if (!getBoolValue(FIELD_RECURSE) && injectionPointModel.getSize() > 0) {
            int[][] injPoints = new int[injectionPointModel.getSize()][];
            for (int i = 0; i < injectionPointModel.getSize(); i++) {
                Highlight hl = injectionPointModel.elementAt(i);
                injPoints[i] = new int[2];
                injPoints[i][0] = hl.getStartOffset();
                injPoints[i][1] = hl.getEndOffset();
            }
            try {
                if (target != null && target.getStartNode() != null) {
                    VariantUserDefined.setInjectionPoints(this.target.getStartNode().getHistoryReference().getURI().toString(), injPoints);
                    enableUserDefinedRPC();
                }
            } catch (Exception e) {
                logger.error(e.getMessage(), e);
            }
        }
        scannerParam.setHostPerScan(extension.getScannerParam().getHostPerScan());
        scannerParam.setThreadPerHost(extension.getScannerParam().getThreadPerHost());
        scannerParam.setHandleAntiCSRFTokens(extension.getScannerParam().getHandleAntiCSRFTokens());
        scannerParam.setMaxResultsToList(extension.getScannerParam().getMaxResultsToList());
        contextSpecificObjects.add(scannerParam);
        contextSpecificObjects.add(techTreeState);
        List<ScanFilter> scanFilterList = filterPanel.getScanFilters();
        for (ScanFilter scanFilter : scanFilterList) {
            contextSpecificObjects.add(scanFilter);
        }
        if (this.customPanels != null) {
            for (CustomScanPanel customPanel : this.customPanels) {
                Object[] objs = customPanel.getContextSpecificObjects();
                if (objs != null) {
                    for (Object obj : objs) {
                        contextSpecificObjects.add(obj);
                    }
                }
            }
        }
    }
    target.setRecurse(this.getBoolValue(FIELD_RECURSE));
    if (target.getContext() == null && getSelectedContext() != null) {
        target.setContext(getSelectedContext());
    }
    this.extension.startScan(target, getSelectedUser(), contextSpecificObjects.toArray());
}

Example 5 with ScanFilter

use of org.zaproxy.zap.extension.ascan.filters.ScanFilter in project zaproxy by zaproxy.

the class ActiveScanController method startScan.

@Override
public int startScan(String name, Target target, User user, Object[] contextSpecificObjects) {
    activeScansLock.lock();
    try {
        int id = this.scanIdCounter++;
        RuleConfigParam ruleConfigParam = null;
        ExtensionRuleConfig extRC = Control.getSingleton().getExtensionLoader().getExtension(ExtensionRuleConfig.class);
        if (extRC != null) {
            ruleConfigParam = extRC.getRuleConfigParam();
        }
        ActiveScan ascan = new ActiveScan(name, extension.getScannerParam(), extension.getModel().getOptionsParam().getConnectionParam(), null, ruleConfigParam) {

            @Override
            public void alertFound(Alert alert) {
                alert.setSource(Alert.Source.ACTIVE);
                if (extAlert != null) {
                    extAlert.alertFound(alert, null);
                }
                super.alertFound(alert);
            }
        };
        Session session = extension.getModel().getSession();
        List<String> excludeList = new ArrayList<>();
        excludeList.addAll(extension.getExcludeList());
        excludeList.addAll(session.getExcludeFromScanRegexs());
        excludeList.addAll(session.getGlobalExcludeURLRegexs());
        ascan.setExcludeList(excludeList);
        ScanPolicy policy = null;
        ascan.setId(id);
        ascan.setUser(user);
        boolean techOverridden = false;
        if (contextSpecificObjects != null) {
            for (Object obj : contextSpecificObjects) {
                if (obj instanceof ScannerParam) {
                    logger.debug("Setting custom scanner params");
                    ascan.setScannerParam((ScannerParam) obj);
                } else if (obj instanceof ScanPolicy) {
                    policy = (ScanPolicy) obj;
                    logger.debug("Setting custom policy " + policy.getName());
                    ascan.setScanPolicy(policy);
                } else if (obj instanceof TechSet) {
                    ascan.setTechSet((TechSet) obj);
                    techOverridden = true;
                } else if (obj instanceof ScriptCollection) {
                    ascan.addScriptCollection((ScriptCollection) obj);
                } else if (obj instanceof ScanFilter) {
                    ascan.addScanFilter((ScanFilter) obj);
                } else {
                    logger.error("Unexpected contextSpecificObject: " + obj.getClass().getCanonicalName());
                }
            }
        }
        if (policy == null) {
            // use the default
            policy = extension.getPolicyManager().getDefaultScanPolicy();
            logger.debug("Setting default policy " + policy.getName());
            ascan.setScanPolicy(policy);
        }
        if (!techOverridden && target.getContext() != null) {
            ascan.setTechSet(target.getContext().getTechSet());
        }
        this.activeScanMap.put(id, ascan);
        this.activeScanList.add(ascan);
        ascan.start(target);
        return id;
    } finally {
        activeScansLock.unlock();
    }
}