Skip to content

Commit 0f551a8

Browse files
psiinonpsiinon
committed
Changed ViewState and XFrameOption to return example alerts for the docs
Part of zaproxy/zaproxy#6119 Associated script changes will follow v shortly... Signed-off-by: Simon Bennetts <[email protected]>
1 parent 90193bb commit 0f551a8

File tree

3 files changed

+65
-34
lines changed

3 files changed

+65
-34
lines changed

‎addOns/pscanrules/CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
88
- The CSP scan rule now checks if the form-action directive allows wildcards.
99
- The CSP scan rule now includes further information in the description of allowed wildcard directives alerts when the impacted directive is one (or more) which doesn't fallback to default-src.
1010
- Maintenance changes.
11+
- Changed ViewState and XFrameOption rules to return example alerts for the docs
1112

1213
## [29] - 2020-06-01
1314
### Changed

‎addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/ViewstateScanRule.java

+48-26
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import java.io.IOException;
2323
import java.nio.charset.Charset;
2424
import java.util.ArrayList;
25+
import java.util.Collections;
2526
import java.util.HashSet;
2627
import java.util.List;
2728
import java.util.Map;
@@ -64,83 +65,104 @@ public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
6465
if (!v.isValid()) return;
6566

6667
if (!v.hasMACtest1() || !v.hasMACtest2())
67-
if (!v.hasMACtest1() && !v.hasMACtest2()) alertNoMACforSure(msg, id);
68-
else alertNoMACUnsure(msg, id);
68+
if (!v.hasMACtest1() && !v.hasMACtest2()) alertNoMACforSure().raise();
69+
else alertNoMACUnsure().raise();
6970

70-
if (!v.isLatestAspNetVersion()) alertOldAspVersion(msg, id);
71+
if (!v.isLatestAspNetVersion()) alertOldAspVersion().raise();
7172

7273
List<ViewstateAnalyzerResult> listOfMatches = ViewstateAnalyzer.getSearchResults(v, this);
7374
for (ViewstateAnalyzerResult var : listOfMatches) {
74-
if (var.hasResults()) alertViewstateAnalyzerResult(msg, id, var);
75+
if (var.hasResults()) alertViewstateAnalyzerResult(var).raise();
7576
}
7677

77-
if (v.isSplit()) alertSplitViewstate(msg, id);
78+
if (v.isSplit()) alertSplitViewstate().raise();
7879
}
7980

80-
private void alertViewstateAnalyzerResult(
81-
HttpMessage msg, int id, ViewstateAnalyzerResult var) {
82-
newAlert()
81+
private AlertBuilder alertViewstateAnalyzerResult(ViewstateAnalyzerResult var) {
82+
return newAlert()
8383
.setName(var.pattern.getAlertHeader())
8484
.setRisk(Alert.RISK_MEDIUM)
8585
.setConfidence(Alert.CONFIDENCE_MEDIUM)
8686
.setDescription(var.pattern.getAlertDescription())
8787
.setOtherInfo(var.getResultExtract().toString())
8888
.setSolution(getSolution())
8989
.setCweId(16) // CWE Id 16 - Configuration
90-
.setWascId(14) // WASC Id - Server Misconfiguration
91-
.raise();
90+
.setWascId(14); // WASC Id - Server Misconfiguration
9291
}
9392

94-
private void alertOldAspVersion(HttpMessage msg, int id) {
95-
newAlert()
93+
private AlertBuilder alertOldAspVersion() {
94+
return newAlert()
9695
.setName(Constant.messages.getString(MESSAGE_PREFIX + "oldver.name"))
9796
.setRisk(Alert.RISK_LOW)
9897
.setConfidence(Alert.CONFIDENCE_MEDIUM)
9998
.setDescription(Constant.messages.getString(MESSAGE_PREFIX + "oldver.desc"))
10099
.setSolution(Constant.messages.getString(MESSAGE_PREFIX + "oldver.soln"))
101100
.setCweId(16) // CWE Id 16 - Configuration
102-
.setWascId(14) // WASC Id - Server Misconfiguration
103-
.raise();
101+
.setWascId(14); // WASC Id - Server Misconfiguration
104102
}
105103

106104
// TODO: see if this alert triggers too often, as the detection rule is far from being robust
107105
// for the moment
108-
private void alertNoMACUnsure(HttpMessage msg, int id) {
109-
newAlert()
106+
private AlertBuilder alertNoMACUnsure() {
107+
return newAlert()
110108
.setName(Constant.messages.getString(MESSAGE_PREFIX + "nomac.unsure.name"))
111109
.setRisk(Alert.RISK_HIGH)
112110
.setConfidence(Alert.CONFIDENCE_LOW)
113111
.setDescription(Constant.messages.getString(MESSAGE_PREFIX + "nomac.unsure.desc"))
114112
.setSolution(Constant.messages.getString(MESSAGE_PREFIX + "nomac.unsure.soln"))
115113
.setReference(Constant.messages.getString(MESSAGE_PREFIX + "nomac.unsure.refs"))
116114
.setCweId(642) // CWE Id 642 - External Control of Critical State Data
117-
.setWascId(14) // WASC Id - Server Misconfiguration
118-
.raise();
115+
.setWascId(14); // WASC Id - Server Misconfiguration
119116
}
120117

121-
private void alertNoMACforSure(HttpMessage msg, int id) {
122-
newAlert()
118+
private AlertBuilder alertNoMACforSure() {
119+
return newAlert()
123120
.setName(Constant.messages.getString(MESSAGE_PREFIX + "nomac.sure.name"))
124121
.setRisk(Alert.RISK_HIGH)
125122
.setConfidence(Alert.CONFIDENCE_MEDIUM)
126123
.setDescription(Constant.messages.getString(MESSAGE_PREFIX + "nomac.sure.desc"))
127124
.setSolution(Constant.messages.getString(MESSAGE_PREFIX + "nomac.sure.soln"))
128125
.setReference(Constant.messages.getString(MESSAGE_PREFIX + "nomac.sure.refs"))
129126
.setCweId(642) // CWE Id 642 - External Control of Critical State Data
130-
.setWascId(14) // WASC Id - Server Misconfiguration
131-
.raise();
127+
.setWascId(14); // WASC Id - Server Misconfiguration
132128
}
133129

134-
private void alertSplitViewstate(HttpMessage msg, int id) {
135-
newAlert()
130+
private AlertBuilder alertSplitViewstate() {
131+
return newAlert()
136132
.setName(Constant.messages.getString(MESSAGE_PREFIX + "split.name"))
137133
.setRisk(Alert.RISK_INFO)
138134
.setConfidence(Alert.CONFIDENCE_LOW)
139135
.setDescription(Constant.messages.getString(MESSAGE_PREFIX + "split.desc"))
140136
.setSolution(Constant.messages.getString(MESSAGE_PREFIX + "split.soln"))
141137
.setCweId(16) // CWE Id 16 - Configuration
142-
.setWascId(14) // WASC Id - Server Misconfiguration
143-
.raise();
138+
.setWascId(14); // WASC Id - Server Misconfiguration
139+
}
140+
141+
public List<Alert> getExampleAlerts() {
142+
List<Alert> alerts = new ArrayList<Alert>();
143+
alerts.add(
144+
alertViewstateAnalyzerResult(
145+
new ViewstateAnalyzerResult(ViewstateAnalyzerPattern.IPADDRESS) {
146+
@Override
147+
public Set<String> getResultExtract() {
148+
return Collections.emptySet();
149+
}
150+
})
151+
.build());
152+
alerts.add(
153+
alertViewstateAnalyzerResult(
154+
new ViewstateAnalyzerResult(ViewstateAnalyzerPattern.EMAIL) {
155+
@Override
156+
public Set<String> getResultExtract() {
157+
return Collections.emptySet();
158+
}
159+
})
160+
.build());
161+
alerts.add(alertOldAspVersion().build());
162+
alerts.add(alertNoMACUnsure().build());
163+
alerts.add(alertNoMACforSure().build());
164+
alerts.add(alertSplitViewstate().build());
165+
return alerts;
144166
}
145167

146168
@Override

‎addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/XFrameOptionScanRule.java

+16-8
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
*/
2020
package org.zaproxy.zap.extension.pscanrules;
2121

22+
import java.util.ArrayList;
2223
import java.util.List;
2324
import net.htmlparser.jericho.Element;
2425
import net.htmlparser.jericho.HTMLElementName;
@@ -92,34 +93,34 @@ public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
9293
if (xFrameOptionParam.toLowerCase().indexOf("deny") < 0
9394
&& xFrameOptionParam.toLowerCase().indexOf("sameorigin") < 0
9495
&& xFrameOptionParam.toLowerCase().indexOf("allow-from") < 0) {
95-
raiseAlert(msg, id, xFrameOptionParam, VulnType.XFO_MALFORMED_SETTING);
96+
buildAlert(xFrameOptionParam, VulnType.XFO_MALFORMED_SETTING).raise();
9697
}
9798
}
9899
if (xFrameOption.size() > 1) { // Multiple headers
99-
raiseAlert(msg, id, "", VulnType.XFO_MULTIPLE_HEADERS);
100+
buildAlert("", VulnType.XFO_MULTIPLE_HEADERS).raise();
100101
}
101102
} else {
102-
raiseAlert(msg, id, "", VulnType.XFO_MISSING);
103+
buildAlert("", VulnType.XFO_MISSING).raise();
103104
}
104105

105106
String metaXFO = getMetaXFOEvidence(source);
106107

107108
if (metaXFO != null) {
108109
// XFO found defined by META tag
109-
raiseAlert(msg, id, metaXFO, VulnType.XFO_META);
110+
buildAlert(metaXFO, VulnType.XFO_META).raise();
110111
}
111112
}
112113
}
113114

114-
private void raiseAlert(HttpMessage msg, int id, String evidence, VulnType currentVT) {
115+
private AlertBuilder buildAlert(String evidence, VulnType currentVT) {
115116
int risk = Alert.RISK_MEDIUM;
116117
String other = "";
117118
if (this.includedInCsp) {
118119
risk = Alert.RISK_LOW;
119120
other = Constant.messages.getString(MESSAGE_PREFIX + "incInCsp");
120121
}
121122

122-
newAlert()
123+
return newAlert()
123124
.setName(getAlertElement(currentVT, "name"))
124125
.setRisk(risk)
125126
.setConfidence(Alert.CONFIDENCE_MEDIUM)
@@ -130,8 +131,7 @@ private void raiseAlert(HttpMessage msg, int id, String evidence, VulnType curre
130131
.setReference(getAlertElement(currentVT, "refs"))
131132
.setEvidence(evidence)
132133
.setCweId(16) // CWE-16: Configuration
133-
.setWascId(15) // WASC-15: Application Misconfiguration
134-
.raise();
134+
.setWascId(15); // WASC-15: Application Misconfiguration
135135
}
136136

137137
@Override
@@ -188,4 +188,12 @@ private String getMetaXFOEvidence(Source source) {
188188
}
189189
return null;
190190
}
191+
192+
public List<Alert> getExampleAlerts() {
193+
List<Alert> alerts = new ArrayList<Alert>();
194+
for (VulnType vulnType : VulnType.values()) {
195+
alerts.add(buildAlert("", vulnType).build());
196+
}
197+
return alerts;
198+
}
191199
}

0 commit comments

Comments
 (0)