Skip to content

Commit ef71c5b

Browse files
psiinonpsiinon
authored
Merge pull request #7 from sshniro/exhancements
Adding html report, support for cmd options
2 parents 041e4b9 + 472d602 commit ef71c5b

File tree

5 files changed

+52
-18
lines changed

5 files changed

+52
-18
lines changed

‎README.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,17 @@ the rules file inside the relevant repository. The following shows a sample rule
3232
10015 IGNORE (Incomplete or No Cache-control and Pragma HTTP Header Set)
3333
```
3434

35+
### `cmd_options`
36+
37+
**Optional** Additional command lines options for the baseline script
38+
3539
## Example usage
3640

3741
** Basic **
3842
```
3943
steps:
4044
- name: ZAP Scan
41-
uses: zaproxy/action-baseline
45+
uses: zaproxy/action-baseline@v0.2.0
4246
with:
4347
token: ${{ secrets.GIT_TOKEN }}
4448
target: 'https://www.zaproxy.org/'
@@ -59,12 +63,13 @@ jobs:
5963
with:
6064
ref: master
6165
- name: ZAP Scan
62-
uses: zaproxy/action-baseline
66+
uses: zaproxy/action-baseline@v0.2.0
6367
with:
6468
token: ${{ secrets.GITHUB_TOKEN }}
6569
docker_name: 'owasp/zap2docker-stable'
6670
target: 'https://www.example.com'
6771
rules_file_name: '.zap/rules.tsv'
72+
cmd_options: '-a'
6873
```
6974

7075
## Additional Information

‎action-helper.js

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,24 @@ let actionHelper = {
5252
const TAB = "\t";
5353
const BULLET = "-";
5454
let msg = '';
55+
let instanceCount = 5;
5556

5657
sites.forEach((site => {
57-
msg = msg + `${BULLET} Site[${site["@name"]}] ${NXT_LINE}`;
58+
msg = msg + `${BULLET} Site: [${site["@name"]}](${site["@name"]}) ${NXT_LINE}`;
5859
if (site.hasOwnProperty('alerts')) {
5960
if (site.alerts.length !== 0) {
6061
msg = `${msg} ${TAB} **New Alerts** ${NXT_LINE}`;
6162
site.alerts.forEach((alert) => {
62-
msg = msg + TAB + `${BULLET} Alert[${alert.pluginid}] count(${alert.instances.length}): ${alert.name} ${NXT_LINE}`
63+
msg = msg + TAB + `${BULLET} **${alert.name}** [${alert.pluginid}] total: ${alert.instances.length}: ${NXT_LINE}`
64+
65+
for (let i = 0; i < alert['instances'].length; i++) {
66+
if (i >= instanceCount) {
67+
msg = msg + TAB + TAB + `${BULLET} .. ${NXT_LINE}`;
68+
break
69+
}
70+
let instance = alert['instances'][i];
71+
msg = msg + TAB + TAB + `${BULLET} [${instance.uri}](${instance.uri}) ${NXT_LINE}`;
72+
}
6373
});
6474
msg = msg + NXT_LINE
6575
}
@@ -69,7 +79,7 @@ let actionHelper = {
6979
if (site.removedAlerts.length !== 0) {
7080
msg = `${msg} ${TAB} **Resolved Alerts** ${NXT_LINE}`;
7181
site.removedAlerts.forEach((alert) => {
72-
msg = msg + TAB + `${BULLET} Alert[${alert.pluginid}] count(${alert.instances.length}): ${alert.name} ${NXT_LINE}`
82+
msg = msg + TAB + `${BULLET} **${alert.name}** [${alert.pluginid}] total: ${alert.instances.length}: ${NXT_LINE}`
7383
});
7484
msg = msg + NXT_LINE
7585
}
@@ -79,7 +89,7 @@ let actionHelper = {
7989
if (site.ignoredAlerts.length !== 0) {
8090
msg = `${msg} ${TAB} **Ignored Alerts** ${NXT_LINE}`;
8191
site.ignoredAlerts.forEach((alert) => {
82-
msg = msg + TAB + `${BULLET} Alert[${alert.pluginid}] count(${alert.instances.length}): ${alert.name} ${NXT_LINE}`
92+
msg = msg + TAB + `${BULLET} **${alert.name}** [${alert.pluginid}] total: ${alert.instances.length}: ${NXT_LINE}`
8393
});
8494
msg = msg + NXT_LINE
8595
}
@@ -222,12 +232,13 @@ let actionHelper = {
222232
return previousReport;
223233
}),
224234

225-
uploadArtifacts: (async (rootDir, mdReport, jsonReport) => {
226-
const artifactClient = artifact.create()
235+
uploadArtifacts: (async (rootDir, mdReport, jsonReport, htmlReport) => {
236+
const artifactClient = artifact.create();
227237
const artifactName = 'zap_scan';
228238
const files = [
229239
`${rootDir}/${mdReport}`,
230240
`${rootDir}/${jsonReport}`,
241+
`${rootDir}/${htmlReport}`,
231242
];
232243
const rootDirectory = rootDir;
233244
const options = {

‎action.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ inputs:
1717
description: 'The Docker file to be executed'
1818
required: true
1919
default: 'owasp/zap2docker-stable'
20+
cmd_options:
21+
description: 'Additional command line options'
22+
required: false
2023
runs:
2124
using: 'node12'
2225
main: 'dist/index.js'

‎dist/index.js

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3744,6 +3744,7 @@ let repo;
37443744
// Default file names
37453745
let jsonReportName = 'report_json.json';
37463746
let mdReportName = 'report_md.md';
3747+
let htmlReportName = 'report_html.html';
37473748

37483749
async function run() {
37493750

@@ -3755,6 +3756,7 @@ async function run() {
37553756
let docker_name = core.getInput('docker_name');
37563757
let target = core.getInput('target');
37573758
let rulesFileLocation = core.getInput('rules_file_name');
3759+
let cmdOptions = core.getInput('cmd_options');
37583760

37593761
console.log('starting the program');
37603762
console.log('github run id :' + currentRunnerID);
@@ -3772,7 +3774,7 @@ async function run() {
37723774
}
37733775

37743776
let command = (`docker run --user root -v ${workspace}:/zap/wrk/:rw --network="host" ` +
3775-
`-t ${docker_name} zap-baseline.py -t ${target} -J ${jsonReportName} -w ${mdReportName}`);
3777+
`-t ${docker_name} zap-baseline.py -t ${target} -J ${jsonReportName} -w ${mdReportName} -r ${htmlReportName} ${cmdOptions}`);
37763778

37773779
if (plugins.length !== 0) {
37783780
command = command + ` -c ${rulesFileLocation}`
@@ -3946,7 +3948,7 @@ async function processReport(token, workSpace, plugins, currentRunnerID) {
39463948
}
39473949
}
39483950

3949-
actionHelper.uploadArtifacts(workSpace, `${mdReportName}`, `${jsonReportName}`);
3951+
actionHelper.uploadArtifacts(workSpace, mdReportName, jsonReportName, htmlReportName);
39503952
}
39513953

39523954

@@ -48985,14 +48987,24 @@ let actionHelper = {
4898548987
const TAB = "\t";
4898648988
const BULLET = "-";
4898748989
let msg = '';
48990+
let instanceCount = 5;
4898848991

4898948992
sites.forEach((site => {
48990-
msg = msg + `${BULLET} Site[${site["@name"]}] ${NXT_LINE}`;
48993+
msg = msg + `${BULLET} Site: [${site["@name"]}](${site["@name"]}) ${NXT_LINE}`;
4899148994
if (site.hasOwnProperty('alerts')) {
4899248995
if (site.alerts.length !== 0) {
4899348996
msg = `${msg} ${TAB} **New Alerts** ${NXT_LINE}`;
4899448997
site.alerts.forEach((alert) => {
48995-
msg = msg + TAB + `${BULLET} Alert[${alert.pluginid}] count(${alert.instances.length}): ${alert.name} ${NXT_LINE}`
48998+
msg = msg + TAB + `${BULLET} **${alert.name}** [${alert.pluginid}] total: ${alert.instances.length}: ${NXT_LINE}`
48999+
49000+
for (let i = 0; i < alert['instances'].length; i++) {
49001+
if (i >= instanceCount) {
49002+
msg = msg + TAB + TAB + `${BULLET} .. ${NXT_LINE}`;
49003+
break
49004+
}
49005+
let instance = alert['instances'][i];
49006+
msg = msg + TAB + TAB + `${BULLET} [${instance.uri}](${instance.uri}) ${NXT_LINE}`;
49007+
}
4899649008
});
4899749009
msg = msg + NXT_LINE
4899849010
}
@@ -49002,7 +49014,7 @@ let actionHelper = {
4900249014
if (site.removedAlerts.length !== 0) {
4900349015
msg = `${msg} ${TAB} **Resolved Alerts** ${NXT_LINE}`;
4900449016
site.removedAlerts.forEach((alert) => {
49005-
msg = msg + TAB + `${BULLET} Alert[${alert.pluginid}] count(${alert.instances.length}): ${alert.name} ${NXT_LINE}`
49017+
msg = msg + TAB + `${BULLET} **${alert.name}** [${alert.pluginid}] total: ${alert.instances.length}: ${NXT_LINE}`
4900649018
});
4900749019
msg = msg + NXT_LINE
4900849020
}
@@ -49012,7 +49024,7 @@ let actionHelper = {
4901249024
if (site.ignoredAlerts.length !== 0) {
4901349025
msg = `${msg} ${TAB} **Ignored Alerts** ${NXT_LINE}`;
4901449026
site.ignoredAlerts.forEach((alert) => {
49015-
msg = msg + TAB + `${BULLET} Alert[${alert.pluginid}] count(${alert.instances.length}): ${alert.name} ${NXT_LINE}`
49027+
msg = msg + TAB + `${BULLET} **${alert.name}** [${alert.pluginid}] total: ${alert.instances.length}: ${NXT_LINE}`
4901649028
});
4901749029
msg = msg + NXT_LINE
4901849030
}
@@ -49155,12 +49167,13 @@ let actionHelper = {
4915549167
return previousReport;
4915649168
}),
4915749169

49158-
uploadArtifacts: (async (rootDir, mdReport, jsonReport) => {
49159-
const artifactClient = artifact.create()
49170+
uploadArtifacts: (async (rootDir, mdReport, jsonReport, htmlReport) => {
49171+
const artifactClient = artifact.create();
4916049172
const artifactName = 'zap_scan';
4916149173
const files = [
4916249174
`${rootDir}/${mdReport}`,
4916349175
`${rootDir}/${jsonReport}`,
49176+
`${rootDir}/${htmlReport}`,
4916449177
];
4916549178
const rootDirectory = rootDir;
4916649179
const options = {

‎index.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ let repo;
1515
// Default file names
1616
let jsonReportName = 'report_json.json';
1717
let mdReportName = 'report_md.md';
18+
let htmlReportName = 'report_html.html';
1819

1920
async function run() {
2021

@@ -26,6 +27,7 @@ async function run() {
2627
let docker_name = core.getInput('docker_name');
2728
let target = core.getInput('target');
2829
let rulesFileLocation = core.getInput('rules_file_name');
30+
let cmdOptions = core.getInput('cmd_options');
2931

3032
console.log('starting the program');
3133
console.log('github run id :' + currentRunnerID);
@@ -43,7 +45,7 @@ async function run() {
4345
}
4446

4547
let command = (`docker run --user root -v ${workspace}:/zap/wrk/:rw --network="host" ` +
46-
`-t ${docker_name} zap-baseline.py -t ${target} -J ${jsonReportName} -w ${mdReportName}`);
48+
`-t ${docker_name} zap-baseline.py -t ${target} -J ${jsonReportName} -w ${mdReportName} -r ${htmlReportName} ${cmdOptions}`);
4749

4850
if (plugins.length !== 0) {
4951
command = command + ` -c ${rulesFileLocation}`
@@ -217,5 +219,5 @@ async function processReport(token, workSpace, plugins, currentRunnerID) {
217219
}
218220
}
219221

220-
actionHelper.uploadArtifacts(workSpace, `${mdReportName}`, `${jsonReportName}`);
222+
actionHelper.uploadArtifacts(workSpace, mdReportName, jsonReportName, htmlReportName);
221223
}

0 commit comments

Comments
 (0)