From 97ea941fb33803f43d4f68eb8df1ab61a86b7d44 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Wed, 9 Nov 2022 09:54:07 +0100 Subject: [PATCH 1/5] json-parser-zap: support JSON format produced by OWASP ZAP --- src/lib/CMakeLists.txt | 1 + src/lib/parser-json-zap.cc | 176 ++++++++++++++++ src/lib/parser-json-zap.hh | 43 ++++ src/lib/parser-json.cc | 4 + tests/csgrep/0103-json-parser-zap-args.txt | 1 + tests/csgrep/0103-json-parser-zap-stdin.txt | 106 ++++++++++ tests/csgrep/0103-json-parser-zap-stdout.txt | 199 +++++++++++++++++++ tests/csgrep/CMakeLists.txt | 1 + 8 files changed, 531 insertions(+) create mode 100644 src/lib/parser-json-zap.cc create mode 100644 src/lib/parser-json-zap.hh create mode 100644 tests/csgrep/0103-json-parser-zap-args.txt create mode 100644 tests/csgrep/0103-json-parser-zap-stdin.txt create mode 100644 tests/csgrep/0103-json-parser-zap-stdout.txt diff --git a/src/lib/CMakeLists.txt b/src/lib/CMakeLists.txt index ed974b65..3e3ef5e1 100644 --- a/src/lib/CMakeLists.txt +++ b/src/lib/CMakeLists.txt @@ -36,6 +36,7 @@ add_library(cs STATIC parser-json-sarif.cc parser-json-shchk.cc parser-json-simple.cc + parser-json-zap.cc parser-xml.cc parser-xml-valgrind.cc shared-string.cc diff --git a/src/lib/parser-json-zap.cc b/src/lib/parser-json-zap.cc new file mode 100644 index 00000000..d885eac3 --- /dev/null +++ b/src/lib/parser-json-zap.cc @@ -0,0 +1,176 @@ +/* + * Copyright (C) 2022 Red Hat, Inc. + * + * This file is part of csdiff. + * + * csdiff is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * any later version. + * + * csdiff is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with csdiff. If not, see . + */ + +#include "parser-json-zap.hh" + +struct ZapTreeDecoder::Private { + std::string timeStamp; + Defect defPrototype = Defect("OWASP_ZAP_WARNING"); + const pt::ptree *alertList = nullptr; + pt::ptree::const_iterator alertIter; + + Private() + { + this->defPrototype.tool = "owasp-zap"; + } + + void readAlert(Defect *pDef, const pt::ptree &alertNode); +}; + +template +void readNonEmptyProps( + TEvtList *pDst, + const pt::ptree &node, + const DefEvent &evtProto, + const TPropList &propList) +{ + // make our own copy of the given prototype event + DefEvent evt = evtProto; + + for (const auto &evtName : propList) { + evt.event = evtName; + evt.msg = valueOf(node, evtName); + if (!evt.msg.empty()) + pDst->push_back(evt); + } +} + +void ZapTreeDecoder::Private::readAlert(Defect *pDef, const pt::ptree &alertNode) +{ + // read per-defect properties + *pDef = this->defPrototype; + pDef->cwe = valueOf(alertNode, "cweid"); + pDef->imp = (1 < valueOf(alertNode, "riskcode")); + + // get "uri" for the key event + std::string uri; + const pt::ptree *instList = nullptr; + if (findChildOf(&instList, alertNode, "instances")) { + for (const auto &item : *instList) { + uri = valueOf(item.second, "uri"); + if (!uri.empty()) + // found! + break; + } + } + + TEvtList &events = pDef->events; + if (uri.empty() && !events.empty()) + // fallback to "uri" from the prototype event + uri = events.front().fileName; + + // initialize key event + DefEvent evt("alert"); + evt.fileName = uri; + + // read "alertRef" if available + const auto alertRef = valueOf(alertNode, "alertRef"); + if (!alertRef.empty()) + evt.event += "[" + alertRef + "]"; + + // read "alert" if available + evt.msg = valueOf(alertNode, "alert"); + + // append the key event + pDef->keyEventIdx = events.size(); + events.push_back(evt); + + // read other per-alert events if available + evt.verbosityLevel = /* info event */ 1; + const auto defProps = { "desc", "solution", "otherinfo", "reference" }; + readNonEmptyProps(&events, alertNode, evt, defProps); + + if (!instList) + // no instances to go through + return; + + // read per-instance properties + const auto instProps = { "method", "param", "attack", "evidence" }; + for (const auto &item : *instList) { + const pt::ptree &instNode = item.second; + evt.fileName = valueOf(instNode, "uri"); + if (evt.fileName.empty()) + // no "uri" for this instance + continue; + + readNonEmptyProps(&events, instNode, evt, instProps); + } +} + +ZapTreeDecoder::ZapTreeDecoder(): + d(new Private) +{ +} + +ZapTreeDecoder::~ZapTreeDecoder() = default; + +void ZapTreeDecoder::readScanProps( + TScanProps *pDst, + const pt::ptree *root) +{ + const auto version = valueOf(*root, "@version"); + if (!version.empty()) + (*pDst)["analyzer-version-owasp-zap"] = version; + + d->timeStamp = valueOf(*root, "@generated"); +} + +bool ZapTreeDecoder::readNode(Defect *pDef) +{ + // iterate over sites unless we are processing a site already + while (!d->alertList || d->alertList->end() == d->alertIter) { + const pt::ptree *siteNode = this->nextNode(); + if (!siteNode) + // failed initialization or EOF + return false; + + if (!findChildOf(&d->alertList, *siteNode, "alerts")) { + // "alerts" node missing for this site + d->alertList = nullptr; + continue; + } + + // initialize iteration over alerts + d->alertIter = d->alertList->begin(); + + if (d->alertList->end() != d->alertIter) { + // site with alerts found -> update defect prototype based on site + d->defPrototype.events.clear(); + const auto siteName = valueOf(*siteNode, "@name"); + if (!siteName.empty() && !d->timeStamp.empty()) { + // create a prototype "note" event + DefEvent siteEvt("note"); + siteEvt.fileName = std::move(siteName); + siteEvt.msg = "dynamically analyzed on " + d->timeStamp; + siteEvt.verbosityLevel = /* info event */ 1; + d->defPrototype.events.push_back(std::move(siteEvt)); + } + + break; + } + } + + // get the current alert and move to the next one + const auto itNow = d->alertIter++; + + // process the current alert + d->readAlert(pDef, itNow->second); + + return true; +} diff --git a/src/lib/parser-json-zap.hh b/src/lib/parser-json-zap.hh new file mode 100644 index 00000000..012e2012 --- /dev/null +++ b/src/lib/parser-json-zap.hh @@ -0,0 +1,43 @@ +/* + * Copyright (C) 2012-2022 Red Hat, Inc. + * + * This file is part of csdiff. + * + * csdiff is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * any later version. + * + * csdiff is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with csdiff. If not, see . + */ + +#ifndef H_GUARD_PARSER_JSON_ZAP_H +#define H_GUARD_PARSER_JSON_ZAP_H + +#include "abstract-tree.hh" + +/// tree decoder of the OWASP ZAP JSON format +class ZapTreeDecoder: public AbstractTreeDecoder { + public: + ZapTreeDecoder(); + ~ZapTreeDecoder() override; + + void readScanProps( + TScanProps *pDst, + const pt::ptree *root) + override; + + bool readNode(Defect *def) override; + + private: + struct Private; + std::unique_ptr d; +}; + +#endif /* H_GUARD_PARSER_JSON_ZAP_H */ diff --git a/src/lib/parser-json.cc b/src/lib/parser-json.cc index 0b3a74f0..8b4fe30e 100644 --- a/src/lib/parser-json.cc +++ b/src/lib/parser-json.cc @@ -24,6 +24,7 @@ #include "parser-json-sarif.hh" #include "parser-json-shchk.hh" #include "parser-json-simple.hh" +#include "parser-json-zap.hh" #include @@ -83,6 +84,9 @@ JsonParser::JsonParser(InStream &input): else if (findChildOf(&node, d->root, "comments")) // ShellCheck JSON format d->decoder.reset(new ShellCheckTreeDecoder); + else if (findChildOf(&node, d->root, "site")) + // OWASP ZAP JSON format + d->decoder.reset(new ZapTreeDecoder); else if (first.not_found() != first.find("kind")) // GCC JSON format d->decoder.reset(new GccTreeDecoder); diff --git a/tests/csgrep/0103-json-parser-zap-args.txt b/tests/csgrep/0103-json-parser-zap-args.txt new file mode 100644 index 00000000..7df3c951 --- /dev/null +++ b/tests/csgrep/0103-json-parser-zap-args.txt @@ -0,0 +1 @@ +--mode=json diff --git a/tests/csgrep/0103-json-parser-zap-stdin.txt b/tests/csgrep/0103-json-parser-zap-stdin.txt new file mode 100644 index 00000000..7373fc65 --- /dev/null +++ b/tests/csgrep/0103-json-parser-zap-stdin.txt @@ -0,0 +1,106 @@ +{ + "@version": "2.11.1", + "@generated": "Tue, 9 Aug 2022 14:38:31", + "site":[ + { + "@name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "@host": "rhos-fedora-devel.usersys.redhat.com", + "@port": "5000", + "@ssl": "false", + "alerts": [ + { + "pluginid": "90022", + "alertRef": "90022", + "alert": "Application Error Disclosure", + "name": "Application Error Disclosure", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

", + "instances":[ + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "method": "GET", + "param": "", + "attack": "", + "evidence": "HTTP/1.1 500 INTERNAL SERVER ERROR" + } + ], + "count": "1", + "solution": "

Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.

", + "otherinfo": "", + "reference": "", + "cweid": "200", + "wascid": "13", + "sourceid": "7" + }, + { + "pluginid": "10023", + "alertRef": "10023", + "alert": "Information Disclosure - Debug Error Messages", + "name": "Information Disclosure - Debug Error Messages", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.

", + "instances":[ + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Internal Server Error" + } + ], + "count": "1", + "solution": "

Disable debugging messages before pushing to production.

", + "otherinfo": "", + "reference": "", + "cweid": "200", + "wascid": "13", + "sourceid": "7" + }, + { + "pluginid": "10021", + "alertRef": "10021", + "alert": "X-Content-Type-Options Header Missing", + "name": "X-Content-Type-Options Header Missing", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "instances":[ + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "method": "GET", + "param": "X-Content-Type-Options", + "attack": "", + "evidence": "" + }, + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "method": "GET", + "param": "X-Content-Type-Options", + "attack": "", + "evidence": "" + }, + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "method": "GET", + "param": "X-Content-Type-Options", + "attack": "", + "evidence": "" + } + ], + "count": "3", + "solution": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "otherinfo": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "reference": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "cweid": "693", + "wascid": "15", + "sourceid": "1" + } + ] + } + ] +} diff --git a/tests/csgrep/0103-json-parser-zap-stdout.txt b/tests/csgrep/0103-json-parser-zap-stdout.txt new file mode 100644 index 00000000..625455e0 --- /dev/null +++ b/tests/csgrep/0103-json-parser-zap-stdout.txt @@ -0,0 +1,199 @@ +{ + "scan": { + "analyzer-version-owasp-zap": "2.11.1" + }, + "defects": [ + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 200, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "alert[90022]", + "message": "Application Error Disclosure", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "desc", + "message": "

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "solution", + "message": "

Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "evidence", + "message": "HTTP/1.1 500 INTERNAL SERVER ERROR", + "verbosity_level": 1 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 200, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "alert[10023]", + "message": "Information Disclosure - Debug Error Messages", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "desc", + "message": "

The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "solution", + "message": "

Disable debugging messages before pushing to production.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "evidence", + "message": "Internal Server Error", + "verbosity_level": 1 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 693, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "alert[10021]", + "message": "X-Content-Type-Options Header Missing", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "desc", + "message": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "solution", + "message": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "otherinfo", + "message": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "reference", + "message": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 1 + } + ] + } + ] +} diff --git a/tests/csgrep/CMakeLists.txt b/tests/csgrep/CMakeLists.txt index 701007ea..94fb2a22 100644 --- a/tests/csgrep/CMakeLists.txt +++ b/tests/csgrep/CMakeLists.txt @@ -146,6 +146,7 @@ test_csgrep("0099-csparser-his-metrics" ) test_csgrep("0100-sarif-parser-gitleaks" ) test_csgrep("0101-json-parser-empty" ) test_csgrep("0102-xml-parser-empty" ) +test_csgrep("0103-json-parser-zap" ) test_csgrep("0106-snyk-prepend-path" ) test_csgrep("0107-gcc-prepend-path" ) test_csgrep("0108-sarif-empty-results" ) From 5733c09ca144ca310d3b9320dda7754c204baef3 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Wed, 9 Nov 2022 15:47:37 +0100 Subject: [PATCH 2/5] parser-cov: accept http:// and https:// URLs as path --- src/lib/parser-common.hh | 4 + src/lib/parser-cov.cc | 2 +- tests/csgrep/0104-cov-parser-zap-args.txt | 1 + tests/csgrep/0104-cov-parser-zap-stdin.txt | 29 +++ tests/csgrep/0104-cov-parser-zap-stdout.txt | 199 ++++++++++++++++++++ tests/csgrep/CMakeLists.txt | 1 + 6 files changed, 235 insertions(+), 1 deletion(-) create mode 100644 tests/csgrep/0104-cov-parser-zap-args.txt create mode 100644 tests/csgrep/0104-cov-parser-zap-stdin.txt create mode 100644 tests/csgrep/0104-cov-parser-zap-stdout.txt diff --git a/src/lib/parser-common.hh b/src/lib/parser-common.hh index 4c53dd98..a58ff135 100644 --- a/src/lib/parser-common.hh +++ b/src/lib/parser-common.hh @@ -29,6 +29,10 @@ #define RE_CHECKER_NAME_MISRA "(?:MISRA C(?:\\+\\+)?-[0-9]+ (?:Directive|Rule) [0-9.-]+)" #define RE_CHECKER_NAME RE_CHECKER_NAME_SA "|" RE_CHECKER_NAME_CERT "|" RE_CHECKER_NAME_MISRA +#define RE_PATH_LOCAL "[^:]+" +#define RE_PATH_URL "http(?:s)?://[^:]+(?::[0-9]+)?[^:]+" +#define RE_PATH RE_PATH_LOCAL "|" RE_PATH_URL + #define RE_EVENT_GCC "(?:(?:(?:fatal|internal) )?[A-Za-z][A-Za-z0-9_-]+)(?:\\[[^ \\]]+\\])?" #define RE_EVENT_PROSPECTOR "(?:[A-Z]+[0-9]+\\[[a-z0-9-]+\\])" #define RE_EVENT RE_EVENT_GCC "|" RE_EVENT_PROSPECTOR diff --git a/src/lib/parser-cov.cc b/src/lib/parser-cov.cc index 50d2a387..b303f724 100644 --- a/src/lib/parser-cov.cc +++ b/src/lib/parser-cov.cc @@ -151,7 +151,7 @@ class ErrFileLexer { RE("^Error: *(" RE_CHECKER_NAME ")( *\\([^)]+\\))? *:(?: \\[#def[0-9]+\\])?$"); const RE reEvent_ = - RE(/* location */ "^([^:]+)(?::([0-9]+|<[Uu]nknown>))?(?::([0-9]+))?" + RE(/* location */ "^(" RE_PATH ")(?::([0-9]+|<[Uu]nknown>))?(?::([0-9]+))?" /* evt/mesg */ ": (" RE_EVENT "): (.*)$"); }; diff --git a/tests/csgrep/0104-cov-parser-zap-args.txt b/tests/csgrep/0104-cov-parser-zap-args.txt new file mode 100644 index 00000000..888ec755 --- /dev/null +++ b/tests/csgrep/0104-cov-parser-zap-args.txt @@ -0,0 +1 @@ +--mode=json --set-scan-prop=analyzer-version-zap:2.11.1 diff --git a/tests/csgrep/0104-cov-parser-zap-stdin.txt b/tests/csgrep/0104-cov-parser-zap-stdin.txt new file mode 100644 index 00000000..8572b255 --- /dev/null +++ b/tests/csgrep/0104-cov-parser-zap-stdin.txt @@ -0,0 +1,29 @@ +Error: OWASP_ZAP_WARNING (CWE-200): +http://rhos-fedora-devel.usersys.redhat.com:5000: note: dynamically analyzed on Tue, 9 Aug 2022 14:38:31 +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: alert[90022]: Application Error Disclosure +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: desc:

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: solution:

Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.

+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: method: GET +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: evidence: HTTP/1.1 500 INTERNAL SERVER ERROR + +Error: OWASP_ZAP_WARNING (CWE-200): +http://rhos-fedora-devel.usersys.redhat.com:5000: note: dynamically analyzed on Tue, 9 Aug 2022 14:38:31 +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: alert[10023]: Information Disclosure - Debug Error Messages +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: desc:

The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.

+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: solution:

Disable debugging messages before pushing to production.

+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: method: GET +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: evidence: Internal Server Error + +Error: OWASP_ZAP_WARNING (CWE-693): +http://rhos-fedora-devel.usersys.redhat.com:5000: note: dynamically analyzed on Tue, 9 Aug 2022 14:38:31 +http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: alert[10021]: X-Content-Type-Options Header Missing +http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: desc:

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: solution:

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: otherinfo:

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At "High" threshold this scan rule will not alert on client or server error responses.

+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: reference:

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: method: GET +http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: param: X-Content-Type-Options +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/: method: GET +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/: param: X-Content-Type-Options +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name: method: GET +http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name: param: X-Content-Type-Options diff --git a/tests/csgrep/0104-cov-parser-zap-stdout.txt b/tests/csgrep/0104-cov-parser-zap-stdout.txt new file mode 100644 index 00000000..2ab13011 --- /dev/null +++ b/tests/csgrep/0104-cov-parser-zap-stdout.txt @@ -0,0 +1,199 @@ +{ + "scan": { + "analyzer-version-zap": "2.11.1" + }, + "defects": [ + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 200, + "tool": "owasp-zap", + "key_event_idx": 5, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "alert[90022]", + "message": "Application Error Disclosure", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "desc", + "message": "

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "solution", + "message": "

Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "evidence", + "message": "HTTP/1.1 500 INTERNAL SERVER ERROR", + "verbosity_level": 0 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 200, + "tool": "owasp-zap", + "key_event_idx": 5, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "alert[10023]", + "message": "Information Disclosure - Debug Error Messages", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "desc", + "message": "

The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "solution", + "message": "

Disable debugging messages before pushing to production.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", + "line": 0, + "event": "evidence", + "message": "Internal Server Error", + "verbosity_level": 0 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 693, + "tool": "owasp-zap", + "key_event_idx": 11, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "alert[10021]", + "message": "X-Content-Type-Options Header Missing", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "desc", + "message": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "solution", + "message": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "otherinfo", + "message": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "reference", + "message": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "method", + "message": "GET", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 0 + } + ] + } + ] +} diff --git a/tests/csgrep/CMakeLists.txt b/tests/csgrep/CMakeLists.txt index 94fb2a22..841a2f5e 100644 --- a/tests/csgrep/CMakeLists.txt +++ b/tests/csgrep/CMakeLists.txt @@ -147,6 +147,7 @@ test_csgrep("0100-sarif-parser-gitleaks" ) test_csgrep("0101-json-parser-empty" ) test_csgrep("0102-xml-parser-empty" ) test_csgrep("0103-json-parser-zap" ) +test_csgrep("0104-cov-parser-zap" ) test_csgrep("0106-snyk-prepend-path" ) test_csgrep("0107-gcc-prepend-path" ) test_csgrep("0108-sarif-empty-results" ) From b49256bb7403cd2dad05daac23295b61e62dcdd8 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Wed, 9 Nov 2022 16:32:35 +0100 Subject: [PATCH 3/5] parser-cov: recognize `alert` as key event for OWASP_ZAP_WARNING --- src/lib/parser-cov.cc | 3 +++ tests/csgrep/0104-cov-parser-zap-stdout.txt | 18 +++++++++--------- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/src/lib/parser-cov.cc b/src/lib/parser-cov.cc index b303f724..39fc87b1 100644 --- a/src/lib/parser-cov.cc +++ b/src/lib/parser-cov.cc @@ -279,6 +279,9 @@ KeyEventDigger::KeyEventDigger(): d->hMap["GCC_ANALYZER_WARNING"] .insert("warning"); d->hMap["GCC_ANALYZER_WARNING"] .insert("fatal error"); + // OWASP ZAP uses "alert" as the key event + d->hMap["OWASP_ZAP_WARNING"] .insert("alert"); + // events that should never be used as key events (excluding trace events) d->denyList.insert("another_instance"); d->denyList.insert("comparison_remediation"); diff --git a/tests/csgrep/0104-cov-parser-zap-stdout.txt b/tests/csgrep/0104-cov-parser-zap-stdout.txt index 2ab13011..719cc3a9 100644 --- a/tests/csgrep/0104-cov-parser-zap-stdout.txt +++ b/tests/csgrep/0104-cov-parser-zap-stdout.txt @@ -7,7 +7,7 @@ "checker": "OWASP_ZAP_WARNING", "cwe": 200, "tool": "owasp-zap", - "key_event_idx": 5, + "key_event_idx": 1, "events": [ { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", @@ -21,7 +21,7 @@ "line": 0, "event": "alert[90022]", "message": "Application Error Disclosure", - "verbosity_level": 1 + "verbosity_level": 0 }, { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", @@ -49,7 +49,7 @@ "line": 0, "event": "evidence", "message": "HTTP/1.1 500 INTERNAL SERVER ERROR", - "verbosity_level": 0 + "verbosity_level": 1 } ] }, @@ -57,7 +57,7 @@ "checker": "OWASP_ZAP_WARNING", "cwe": 200, "tool": "owasp-zap", - "key_event_idx": 5, + "key_event_idx": 1, "events": [ { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", @@ -71,7 +71,7 @@ "line": 0, "event": "alert[10023]", "message": "Information Disclosure - Debug Error Messages", - "verbosity_level": 1 + "verbosity_level": 0 }, { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", @@ -99,7 +99,7 @@ "line": 0, "event": "evidence", "message": "Internal Server Error", - "verbosity_level": 0 + "verbosity_level": 1 } ] }, @@ -107,7 +107,7 @@ "checker": "OWASP_ZAP_WARNING", "cwe": 693, "tool": "owasp-zap", - "key_event_idx": 11, + "key_event_idx": 1, "events": [ { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", @@ -121,7 +121,7 @@ "line": 0, "event": "alert[10021]", "message": "X-Content-Type-Options Header Missing", - "verbosity_level": 1 + "verbosity_level": 0 }, { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", @@ -191,7 +191,7 @@ "line": 0, "event": "param", "message": "X-Content-Type-Options", - "verbosity_level": 0 + "verbosity_level": 1 } ] } From 933decc625264cec24219f4b2d0480396cac2a95 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Wed, 9 Nov 2022 16:59:27 +0100 Subject: [PATCH 4/5] json-parser-zap: cover by one more test --- tests/csgrep/0105-json-parser-zap-args.txt | 1 + tests/csgrep/0105-json-parser-zap-stdin.txt | 100 +++++++++ tests/csgrep/0105-json-parser-zap-stdout.txt | 222 +++++++++++++++++++ tests/csgrep/CMakeLists.txt | 1 + 4 files changed, 324 insertions(+) create mode 100644 tests/csgrep/0105-json-parser-zap-args.txt create mode 100644 tests/csgrep/0105-json-parser-zap-stdin.txt create mode 100644 tests/csgrep/0105-json-parser-zap-stdout.txt diff --git a/tests/csgrep/0105-json-parser-zap-args.txt b/tests/csgrep/0105-json-parser-zap-args.txt new file mode 100644 index 00000000..7df3c951 --- /dev/null +++ b/tests/csgrep/0105-json-parser-zap-args.txt @@ -0,0 +1 @@ +--mode=json diff --git a/tests/csgrep/0105-json-parser-zap-stdin.txt b/tests/csgrep/0105-json-parser-zap-stdin.txt new file mode 100644 index 00000000..b7f6ac7d --- /dev/null +++ b/tests/csgrep/0105-json-parser-zap-stdin.txt @@ -0,0 +1,100 @@ +{ + "@version": "2.11.1", + "@generated": "Wed, 10 Aug 2022 10:13:02", + "site":[ + { + "@name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "@host": "rhos-fedora-devel.usersys.redhat.com", + "@port": "9000", + "@ssl": "false", + "alerts": [ + { + "pluginid": "40018", + "alertRef": "40018", + "alert": "SQL Injection - SQLite", + "name": "SQL Injection - SQLite", + "riskcode": "3", + "confidence": "2", + "riskdesc": "High (Medium)", + "desc": "

SQL injection may be possible.

", + "instances":[ + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "method": "POST", + "param": "month", + "attack": ";", + "evidence": "near \";\": syntax error" + } + ], + "count": "1", + "solution": "

Do not trust client side input, even if there is client side validation in place.

In general, type check all data on the server side.

If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'

If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.

If database Stored Procedures can be used, use them.

Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!

Do not create dynamic SQL queries using simple string concatenation.

Escape all data received from the client.

Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.

Apply the principle of least privilege by using the least privileged database user possible.

In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.

Grant the minimum database access that is necessary for the application.

", + "otherinfo": "

RDBMS [SQLite] likely, given error message regular expression [near \".+\": syntax error] matched by the HTML results.

The vulnerability was detected by manipulating the parameter to cause a database error message to be returned and recognised

", + "reference": "

https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

", + "cweid": "89", + "wascid": "19", + "sourceid": "63" + }, + { + "pluginid": "40009", + "alertRef": "40009", + "alert": "Server Side Include", + "name": "Server Side Include", + "riskcode": "3", + "confidence": "2", + "riskdesc": "High (Medium)", + "desc": "

Certain parameters may cause Server Side Include commands to be executed. This may allow database connection or arbitrary code to be executed.

", + "instances":[ + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "method": "POST", + "param": "month", + "attack": "", + "evidence": "root'\nHOSTNAME = 'dfd2f63e3bbf'\nHTTP_ACCEPT = '*/*'\nHTTP_CACHE_CONTROL = 'no-cache'\nHTTP_HOST = 'rhos-fedora-devel.usersys.redhat.com:9000'\nHTTP_PRAGMA = 'no-cache'\nHTTP_USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0'\nPATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr" + } + ], + "count": "1", + "solution": "

Do not trust client side input and enforce a tight check in the server side. Disable server side includes.

", + "otherinfo": "", + "reference": "

http://www.carleton.ca/~dmcfet/html/ssi.html

", + "cweid": "97", + "wascid": "31", + "sourceid": "38" + }, + { + "pluginid": "10021", + "alertRef": "10021", + "alert": "X-Content-Type-Options Header Missing", + "name": "X-Content-Type-Options Header Missing", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "instances":[ + { + "uri": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "method": "POST", + "param": "X-Content-Type-Options", + "attack": "", + "evidence": "" + } + ], + "count": "1", + "solution": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "otherinfo": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "reference": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "cweid": "693", + "wascid": "15", + "sourceid": "3" + } + ] + }, + { + "@name": "http://rhos-fedora-devel.usersys.redhat.com:9001", + "@host": "rhos-fedora-devel.usersys.redhat.com", + "@port": "9001", + "@ssl": "false", + "alerts": [ + ] + } + ] +} diff --git a/tests/csgrep/0105-json-parser-zap-stdout.txt b/tests/csgrep/0105-json-parser-zap-stdout.txt new file mode 100644 index 00000000..12e3de8a --- /dev/null +++ b/tests/csgrep/0105-json-parser-zap-stdout.txt @@ -0,0 +1,222 @@ +{ + "scan": { + "analyzer-version-owasp-zap": "2.11.1" + }, + "defects": [ + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 89, + "imp": 1, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "alert[40018]", + "message": "SQL Injection - SQLite", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "desc", + "message": "

SQL injection may be possible.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "solution", + "message": "

Do not trust client side input, even if there is client side validation in place.

In general, type check all data on the server side.

If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'

If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.

If database Stored Procedures can be used, use them.

Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!

Do not create dynamic SQL queries using simple string concatenation.

Escape all data received from the client.

Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.

Apply the principle of least privilege by using the least privileged database user possible.

In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.

Grant the minimum database access that is necessary for the application.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "otherinfo", + "message": "

RDBMS [SQLite] likely, given error message regular expression [near \".+\": syntax error] matched by the HTML results.

The vulnerability was detected by manipulating the parameter to cause a database error message to be returned and recognised

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "reference", + "message": "

https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "method", + "message": "POST", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "param", + "message": "month", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "attack", + "message": ";", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "evidence", + "message": "near \";\": syntax error", + "verbosity_level": 1 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 97, + "imp": 1, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "alert[40009]", + "message": "Server Side Include", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "desc", + "message": "

Certain parameters may cause Server Side Include commands to be executed. This may allow database connection or arbitrary code to be executed.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "solution", + "message": "

Do not trust client side input and enforce a tight check in the server side. Disable server side includes.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "reference", + "message": "

http://www.carleton.ca/~dmcfet/html/ssi.html

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "method", + "message": "POST", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "param", + "message": "month", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "attack", + "message": "", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "evidence", + "message": "root'\nHOSTNAME = 'dfd2f63e3bbf'\nHTTP_ACCEPT = '*/*'\nHTTP_CACHE_CONTROL = 'no-cache'\nHTTP_HOST = 'rhos-fedora-devel.usersys.redhat.com:9000'\nHTTP_PRAGMA = 'no-cache'\nHTTP_USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0'\nPATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr", + "verbosity_level": 1 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 693, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "alert[10021]", + "message": "X-Content-Type-Options Header Missing", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "desc", + "message": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "solution", + "message": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "otherinfo", + "message": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "reference", + "message": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "method", + "message": "POST", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", + "line": 0, + "event": "param", + "message": "X-Content-Type-Options", + "verbosity_level": 1 + } + ] + } + ] +} diff --git a/tests/csgrep/CMakeLists.txt b/tests/csgrep/CMakeLists.txt index 841a2f5e..eb38a528 100644 --- a/tests/csgrep/CMakeLists.txt +++ b/tests/csgrep/CMakeLists.txt @@ -148,6 +148,7 @@ test_csgrep("0101-json-parser-empty" ) test_csgrep("0102-xml-parser-empty" ) test_csgrep("0103-json-parser-zap" ) test_csgrep("0104-cov-parser-zap" ) +test_csgrep("0105-json-parser-zap" ) test_csgrep("0106-snyk-prepend-path" ) test_csgrep("0107-gcc-prepend-path" ) test_csgrep("0108-sarif-empty-results" ) From 3f3742a983bd6825e0de6a662b756104eda8291d Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Tue, 3 Jan 2023 18:22:18 +0100 Subject: [PATCH 5/5] json-parser-zap: unfold instances of each alert ... so that we can match each instance separately Fixes: https://github.com/csutils/csdiff/issues/90 Closes: https://github.com/csutils/csdiff/pull/94 --- src/lib/parser-json-zap.cc | 150 ++++++++++++------- src/lib/parser-json-zap.hh | 1 + tests/csgrep/0103-json-parser-zap-stdout.txt | 106 ++++++++++++- tests/csgrep/0105-json-parser-zap-stdout.txt | 6 +- 4 files changed, 199 insertions(+), 64 deletions(-) diff --git a/src/lib/parser-json-zap.cc b/src/lib/parser-json-zap.cc index d885eac3..89f3cca0 100644 --- a/src/lib/parser-json-zap.cc +++ b/src/lib/parser-json-zap.cc @@ -21,16 +21,22 @@ struct ZapTreeDecoder::Private { std::string timeStamp; - Defect defPrototype = Defect("OWASP_ZAP_WARNING"); + Defect sitePrototype; + Defect alertPrototype; const pt::ptree *alertList = nullptr; + const pt::ptree *instList = nullptr; pt::ptree::const_iterator alertIter; + pt::ptree::const_iterator instIter; Private() { - this->defPrototype.tool = "owasp-zap"; + this->sitePrototype.checker = "OWASP_ZAP_WARNING"; + this->sitePrototype.tool = "owasp-zap"; } - void readAlert(Defect *pDef, const pt::ptree &alertNode); + void readSiteProto(const pt::ptree &siteNode); + void readAlertProto(const pt::ptree &alertNode); + void readAlertInst(Defect *pDef, const pt::ptree &instNode); }; template @@ -51,33 +57,35 @@ void readNonEmptyProps( } } -void ZapTreeDecoder::Private::readAlert(Defect *pDef, const pt::ptree &alertNode) +void ZapTreeDecoder::Private::readSiteProto(const pt::ptree &siteNode) { - // read per-defect properties - *pDef = this->defPrototype; - pDef->cwe = valueOf(alertNode, "cweid"); - pDef->imp = (1 < valueOf(alertNode, "riskcode")); - - // get "uri" for the key event - std::string uri; - const pt::ptree *instList = nullptr; - if (findChildOf(&instList, alertNode, "instances")) { - for (const auto &item : *instList) { - uri = valueOf(item.second, "uri"); - if (!uri.empty()) - // found! - break; - } - } + this->sitePrototype.events.clear(); + const auto siteName = valueOf(siteNode, "@name"); + if (siteName.empty() || this->timeStamp.empty()) + return; - TEvtList &events = pDef->events; - if (uri.empty() && !events.empty()) - // fallback to "uri" from the prototype event - uri = events.front().fileName; + // create a prototype "note" event + DefEvent siteEvt("note"); + siteEvt.fileName = std::move(siteName); + siteEvt.msg = "dynamically analyzed on " + this->timeStamp; + siteEvt.verbosityLevel = /* info event */ 1; + this->sitePrototype.events.push_back(std::move(siteEvt)); +} + +void ZapTreeDecoder::Private::readAlertProto(const pt::ptree &alertNode) +{ + // read per-alert properties + this->alertPrototype = this->sitePrototype; + this->alertPrototype.cwe = valueOf(alertNode, "cweid"); + this->alertPrototype.imp = (1 < valueOf(alertNode, "riskcode")); // initialize key event DefEvent evt("alert"); - evt.fileName = uri; + + // get "uri" from the prototype event + TEvtList &events = this->alertPrototype.events; + if (!events.empty()) + evt.fileName = events.front().fileName; // read "alertRef" if available const auto alertRef = valueOf(alertNode, "alertRef"); @@ -88,29 +96,36 @@ void ZapTreeDecoder::Private::readAlert(Defect *pDef, const pt::ptree &alertNode evt.msg = valueOf(alertNode, "alert"); // append the key event - pDef->keyEventIdx = events.size(); + this->alertPrototype.keyEventIdx = events.size(); events.push_back(evt); // read other per-alert events if available evt.verbosityLevel = /* info event */ 1; const auto defProps = { "desc", "solution", "otherinfo", "reference" }; readNonEmptyProps(&events, alertNode, evt, defProps); +} - if (!instList) - // no instances to go through - return; +void ZapTreeDecoder::Private::readAlertInst( + Defect *pDef, + const pt::ptree &instNode) +{ + // start with the prototype initialized by readAlertProto() + *pDef = this->alertPrototype; + TEvtList &events = pDef->events; + + // reinitialize events with "uri" specific for this instance (if available) + const std::string uri = valueOf(instNode, "uri"); + if (!uri.empty()) + for (DefEvent &evt : events) + evt.fileName = uri; + + // use the key event as a prototype for instance-specific events + DefEvent evtProto = events[pDef->keyEventIdx]; + evtProto.verbosityLevel = /* info event */ 1; // read per-instance properties const auto instProps = { "method", "param", "attack", "evidence" }; - for (const auto &item : *instList) { - const pt::ptree &instNode = item.second; - evt.fileName = valueOf(instNode, "uri"); - if (evt.fileName.empty()) - // no "uri" for this instance - continue; - - readNonEmptyProps(&events, instNode, evt, instProps); - } + readNonEmptyProps(&events, instNode, evtProto, instProps); } ZapTreeDecoder::ZapTreeDecoder(): @@ -131,14 +146,14 @@ void ZapTreeDecoder::readScanProps( d->timeStamp = valueOf(*root, "@generated"); } -bool ZapTreeDecoder::readNode(Defect *pDef) +const pt::ptree* ZapTreeDecoder::nextAlert() { // iterate over sites unless we are processing a site already while (!d->alertList || d->alertList->end() == d->alertIter) { const pt::ptree *siteNode = this->nextNode(); if (!siteNode) // failed initialization or EOF - return false; + return nullptr; if (!findChildOf(&d->alertList, *siteNode, "alerts")) { // "alerts" node missing for this site @@ -148,29 +163,48 @@ bool ZapTreeDecoder::readNode(Defect *pDef) // initialize iteration over alerts d->alertIter = d->alertList->begin(); + d->instList = nullptr; - if (d->alertList->end() != d->alertIter) { - // site with alerts found -> update defect prototype based on site - d->defPrototype.events.clear(); - const auto siteName = valueOf(*siteNode, "@name"); - if (!siteName.empty() && !d->timeStamp.empty()) { - // create a prototype "note" event - DefEvent siteEvt("note"); - siteEvt.fileName = std::move(siteName); - siteEvt.msg = "dynamically analyzed on " + d->timeStamp; - siteEvt.verbosityLevel = /* info event */ 1; - d->defPrototype.events.push_back(std::move(siteEvt)); - } - - break; - } + if (!d->alertList->empty()) + // site with alerts found --> update site prototype + d->readSiteProto(*siteNode); } // get the current alert and move to the next one - const auto itNow = d->alertIter++; + const auto itAlertNow = d->alertIter++; + return &itAlertNow->second; +} + +bool ZapTreeDecoder::readNode(Defect *pDef) +{ + if (!d->instList || d->instList->end() == d->instIter) { + // iterate over alerts + const pt::ptree *alertNode = this->nextAlert(); + if (!alertNode) + // failed initialization or EOF + return false; + + // process the current alert + d->readAlertProto(*alertNode); + + // read the list of instances + if (!findChildOf(&d->instList, *alertNode, "instances") + || d->instList->empty()) + { + // no instances for this alert --> emit the prototype + d->instList = nullptr; + *pDef = d->alertPrototype; + return true; + } + + // initialize iteration over instances + d->instIter = d->instList->begin(); + } - // process the current alert - d->readAlert(pDef, itNow->second); + // get the current instance and move to the next one + const auto itInstNow = d->instIter++; + // process the current instance + d->readAlertInst(pDef, itInstNow->second); return true; } diff --git a/src/lib/parser-json-zap.hh b/src/lib/parser-json-zap.hh index 012e2012..3300a7cc 100644 --- a/src/lib/parser-json-zap.hh +++ b/src/lib/parser-json-zap.hh @@ -38,6 +38,7 @@ class ZapTreeDecoder: public AbstractTreeDecoder { private: struct Private; std::unique_ptr d; + const pt::ptree* nextAlert(); }; #endif /* H_GUARD_PARSER_JSON_ZAP_H */ diff --git a/tests/csgrep/0103-json-parser-zap-stdout.txt b/tests/csgrep/0103-json-parser-zap-stdout.txt index 625455e0..bb6921eb 100644 --- a/tests/csgrep/0103-json-parser-zap-stdout.txt +++ b/tests/csgrep/0103-json-parser-zap-stdout.txt @@ -10,7 +10,7 @@ "key_event_idx": 1, "events": [ { - "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", "line": 0, "event": "note", "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", @@ -60,7 +60,7 @@ "key_event_idx": 1, "events": [ { - "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id", "line": 0, "event": "note", "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", @@ -110,7 +110,7 @@ "key_event_idx": 1, "events": [ { - "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000", + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json", "line": 0, "event": "note", "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", @@ -164,6 +164,56 @@ "event": "param", "message": "X-Content-Type-Options", "verbosity_level": 1 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 693, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "alert[10021]", + "message": "X-Content-Type-Options Header Missing", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "desc", + "message": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "solution", + "message": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "otherinfo", + "message": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", + "line": 0, + "event": "reference", + "message": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "verbosity_level": 1 }, { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/", @@ -178,6 +228,56 @@ "event": "param", "message": "X-Content-Type-Options", "verbosity_level": 1 + } + ] + }, + { + "checker": "OWASP_ZAP_WARNING", + "cwe": 693, + "tool": "owasp-zap", + "key_event_idx": 1, + "events": [ + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "note", + "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "alert[10021]", + "message": "X-Content-Type-Options Header Missing", + "verbosity_level": 0 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "desc", + "message": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "solution", + "message": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "otherinfo", + "message": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "verbosity_level": 1 + }, + { + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", + "line": 0, + "event": "reference", + "message": "

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

", + "verbosity_level": 1 }, { "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name", diff --git a/tests/csgrep/0105-json-parser-zap-stdout.txt b/tests/csgrep/0105-json-parser-zap-stdout.txt index 12e3de8a..42f23b00 100644 --- a/tests/csgrep/0105-json-parser-zap-stdout.txt +++ b/tests/csgrep/0105-json-parser-zap-stdout.txt @@ -11,7 +11,7 @@ "key_event_idx": 1, "events": [ { - "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", "line": 0, "event": "note", "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02", @@ -90,7 +90,7 @@ "key_event_idx": 1, "events": [ { - "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", "line": 0, "event": "note", "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02", @@ -161,7 +161,7 @@ "key_event_idx": 1, "events": [ { - "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000", + "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/", "line": 0, "event": "note", "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02",