Giter Club home page Giter Club logo

Comments (12)

brentufkes avatar brentufkes commented on June 16, 2024 3

There any action here? @psiinon

This is very helpful as be able to show these results in the Advanced Security UI (acknowledging the disclaimer)

from action-baseline.

derekmurawsky avatar derekmurawsky commented on June 16, 2024 1

This would be fantastic. I would love to see this action enable sarif output as well so an intermediate step/action is not needed.

from action-baseline.

DanBradbury avatar DanBradbury commented on June 16, 2024 1

With a scan hook you could create the report without doing changes everywhere: https://www.zaproxy.org/docs/docker/scan-hooks/

Wondering if that solve makes sense for folks supporting 100s of applications and needing to add that hook.py file to all repos. Was mostly hoping for it to be supported with a command line option

from action-baseline.

psiinon avatar psiinon commented on June 16, 2024

@SvanBoxel thank you for creating this and telling us about it :)
It looks very interesting - we'll have a look at it and get back to you asap!

from action-baseline.

DanBradbury avatar DanBradbury commented on June 16, 2024

Ran into this requirement recently so I took a quick stab at hacking out a solution to let us proceed and I'd very much like to help make this be part of the main action without requiring an additional action to be used.

My understanding is that this would require changes to this repo (#110) & zaproxy (zaproxy/zaproxy#8005)

In my case I had to create a new docker image with these files updated (zap-baseline.py and zap_common.py) to confirm that the entire scenario works correctly.

Would gladly take suggestions / work on produtionizing the code if this path doesn't seem to out there.. would require input from folks who are far more knowledgable than I (@psiinon or any others)

from action-baseline.

thc202 avatar thc202 commented on June 16, 2024

With a scan hook you could create the report without doing changes everywhere: https://www.zaproxy.org/docs/docker/scan-hooks/

from action-baseline.

thc202 avatar thc202 commented on June 16, 2024

The hook can be created by the workflow and one can use reusable workflows, so no need to add a file to 100s repos.

It's not necessary to add a command line option when this can be implemented just in the action (or the common package).

from action-baseline.

DanBradbury avatar DanBradbury commented on June 16, 2024

ack. My issue with that solution is that it requires something beyond the baseline scan options that come out of the box. Seems like a workaround to use a hook rather than have something supported properly in the main action.

Definitely not a fan of that solution but if the guidance is to not support sairf within the baseline scan in the future I guess we will go with the gross hook solve / keep rolling our own docker image + maintain our own fork

from action-baseline.

thc202 avatar thc202 commented on June 16, 2024

What do you want to use? The action or the packaged scan? Both?

from action-baseline.

DanBradbury avatar DanBradbury commented on June 16, 2024

My understanding from the docs was that "GitHub Actions wrap the above packaged scans " (Baseline, Full Scan, API Scan)

What do you want to use? The action or the packaged scan? Both?

doesn't the action-baseline action use the Baseline packaged scan? I believe that's the reason I had to make changes to both the repos to support the new -S option for sarif support. I'd like to improve the baseline action and if that requires changes to the packaged scan then I think that work should be done in parallel.. even if there is a sunset plan for the old packaged scans to be unified with the automation framework it looks like there is still work being done zap-baseline.py to attempt to use the AF when possible
https://github.com/zaproxy/zaproxy/blob/main/docker/zap-baseline.py#L344-L352

Ideally it would be great to have sarif support figured out in the action here now and then make the change to move the AF completely seamless and update the old zap-baseline.py to fully use the automation framework when the time is right.. obviously I'm naive to priorities, etc for the team but as someone who is selfishly trying to use ZAP at scale we'd like have this a default / configurable behavior at the action level.

from action-baseline.

elgohr avatar elgohr commented on June 16, 2024

Looks like a SARIF report exporter is already part of ZAP. See

Sadly I didn't find a way/documentation to use it.

from action-baseline.

elgohr avatar elgohr commented on June 16, 2024

Find an idea at GSA-TTS/FAC#1654

from action-baseline.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.