Skip to content

Commit 4a7e682

Browse files
kingthorinkingthorin
committed
scan rules: Clean code tweaks
- Add static modifier where applicable. - CHANGELOG > Add maintenance note (if there wasn't already one present). - pscanrules > Made resource message methods private again where example alerts have been implemented, or removed them where there was only a single usage (inlining the Constant resource message usage).
1 parent 354c81b commit 4a7e682

File tree

130 files changed

+519
-1317
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

130 files changed

+519
-1317
lines changed

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/BufferOverflowScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ public int getWascId() {
169169
return 7;
170170
}
171171

172-
private String randomCharacterString(int length) {
172+
private static String randomCharacterString(int length) {
173173
StringBuilder sb1 = new StringBuilder(length + 1);
174174
int counter = 0;
175175
int character = 0;

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/CommandInjectionScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ public int getRisk() {
366366
return Alert.RISK_HIGH;
367367
}
368368

369-
private String getOtherInfo(TestType testType, String testValue) {
369+
private static String getOtherInfo(TestType testType, String testValue) {
370370
return Constant.messages.getString(
371371
MESSAGE_PREFIX + "otherinfo." + testType.getNameKey(), testValue);
372372
}

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/DirectoryBrowsingScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ public String getReference() {
9595
return Constant.messages.getString(MESSAGE_PREFIX + "refs");
9696
}
9797

98-
private void checkIfDirectory(HttpMessage msg) throws URIException {
98+
private static void checkIfDirectory(HttpMessage msg) throws URIException {
9999

100100
URI uri = msg.getRequestHeader().getURI();
101101
uri.setQuery(null);

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -342,7 +342,7 @@ private static boolean isRedirectHost(String value, boolean escaped) throws URIE
342342
* @param msg the current message where reflected redirection should be check into
343343
* @return get back the redirection type if exists
344344
*/
345-
private int isRedirected(String payload, HttpMessage msg) {
345+
private static int isRedirected(String payload, HttpMessage msg) {
346346

347347
// (1) Check if redirection by "Location" header
348348
// http://en.wikipedia.org/wiki/HTTP_location
@@ -471,7 +471,7 @@ private static boolean isRedirectPresent(Pattern pattern, String value) {
471471
* @param type the redirection type
472472
* @return a string representing the reason of this redirection
473473
*/
474-
private String getRedirectionReason(int type) {
474+
private static String getRedirectionReason(int type) {
475475
switch (type) {
476476
case REDIRECT_LOCATION_HEADER:
477477
return Constant.messages.getString(MESSAGE_PREFIX + "reason.location.header");

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/FormatStringScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ public String getReference() {
105105
return Constant.messages.getString(MESSAGE_PREFIX + "refs");
106106
}
107107

108-
private String getError(char c) {
108+
private static String getError(char c) {
109109
return Constant.messages.getString(MESSAGE_PREFIX + "error" + c);
110110
}
111111

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/PaddingOracleScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ private String getEmptyValueResponse(String paramName) throws IOException {
267267
* @param value the value that need to be checked
268268
* @return true if it seems to be encrypted
269269
*/
270-
private boolean isEncrypted(byte[] value) {
270+
private static boolean isEncrypted(byte[] value) {
271271

272272
// Make sure we have a reasonable sized string
273273
// (encrypted strings tend to be long, and short strings tend to break our numbers)

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/PathTraversalScanRule.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -608,7 +608,7 @@ private boolean sendAndCheckPayload(
608608
return false;
609609
}
610610

611-
private String getContentsToMatch(HttpMessage message) {
611+
private static String getContentsToMatch(HttpMessage message) {
612612
return message.getResponseHeader().isHtml()
613613
? StringEscapeUtils.unescapeHtml4(message.getResponseBody().toString())
614614
: message.getResponseHeader().toString() + message.getResponseBody().toString();
@@ -700,7 +700,7 @@ public String match(String contents) {
700700
return matchWinDirectories(contents);
701701
}
702702

703-
private String matchNixDirectories(String contents) {
703+
private static String matchNixDirectories(String contents) {
704704
Pattern procPattern =
705705
Pattern.compile("(?:^|\\W)proc(?:\\W|$)", Pattern.CASE_INSENSITIVE);
706706
Pattern etcPattern = Pattern.compile("(?:^|\\W)etc(?:\\W|$)", Pattern.CASE_INSENSITIVE);
@@ -727,7 +727,7 @@ private String matchNixDirectories(String contents) {
727727
return null;
728728
}
729729

730-
private String matchWinDirectories(String contents) {
730+
private static String matchWinDirectories(String contents) {
731731
if (contents.contains("Windows")
732732
&& Pattern.compile("Program\\sFiles").matcher(contents).find()) {
733733
return "Windows";

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SourceCodeDisclosureWebInfScanRule.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ private HttpMessage createHttpMessage(URI uri) throws HttpMalformedHeaderExcepti
277277
* @return
278278
* @throws URIException
279279
*/
280-
private URI getClassURI(URI hostURI, String classname) throws URIException {
280+
private static URI getClassURI(URI hostURI, String classname) throws URIException {
281281
return new URI(
282282
hostURI.getScheme()
283283
+ "://"
@@ -288,7 +288,7 @@ private URI getClassURI(URI hostURI, String classname) throws URIException {
288288
false);
289289
}
290290

291-
private URI getPropsFileURI(URI hostURI, String propsfilename) throws URIException {
291+
private static URI getPropsFileURI(URI hostURI, String propsfilename) throws URIException {
292292
return new URI(
293293
hostURI.getScheme()
294294
+ "://"

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/Spring4ShellScanRule.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,11 @@ public String getDescription() {
7676
return Constant.messages.getString("ascanrules.spring4shell.desc");
7777
}
7878

79-
private boolean is400Response(HttpMessage msg) {
79+
private static boolean is400Response(HttpMessage msg) {
8080
return !msg.getResponseHeader().isEmpty() && msg.getResponseHeader().getStatusCode() == 400;
8181
}
8282

83-
private void setGetPayload(HttpMessage msg, String payload) throws URIException {
83+
private static void setGetPayload(HttpMessage msg, String payload) throws URIException {
8484
msg.getRequestHeader().setMethod("GET");
8585
URI uri = msg.getRequestHeader().getURI();
8686
String query = uri.getEscapedQuery();
@@ -92,7 +92,7 @@ private void setGetPayload(HttpMessage msg, String payload) throws URIException
9292
uri.setEscapedQuery(query);
9393
}
9494

95-
private void setPostPayload(HttpMessage msg, String payload) {
95+
private static void setPostPayload(HttpMessage msg, String payload) {
9696
msg.getRequestHeader().setMethod("POST");
9797
String body = msg.getRequestBody().toString();
9898
if (body.isEmpty()

‎addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,11 @@ private enum PayloadHandling {
8080
CONCAT_PATH
8181
};
8282

83-
private NanoServerHandler createHttpRedirectHandler(String path, String header) {
83+
private static NanoServerHandler createHttpRedirectHandler(String path, String header) {
8484
return createHttpRedirectHandler(path, header, PayloadHandling.NEITHER);
8585
}
8686

87-
private NanoServerHandler createHttpRedirectHandler(
87+
private static NanoServerHandler createHttpRedirectHandler(
8888
String path, String header, PayloadHandling payloadHandling) {
8989
return new NanoServerHandler(path) {
9090
@Override

‎addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/HiddenFilesScanRuleUnitTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ void checkNoPathsHaveLeadingSlash() {
110110
}
111111
}
112112

113-
private void assertNoLeadingSlash(String message, String path) {
113+
private static void assertNoLeadingSlash(String message, String path) {
114114
assertThat(message.replace(REPLACE_TOKEN, path), !path.startsWith("/"), is(true));
115115
}
116116

‎addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/XxeScanRuleUnitTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -314,7 +314,7 @@ void shouldAlertOnlyIfCertainTagValuesArePresent()
314314
assertThat(alert.getConfidence(), equalTo(Alert.CONFIDENCE_MEDIUM));
315315
}
316316

317-
private NanoServerHandler createNanoHandler(
317+
private static NanoServerHandler createNanoHandler(
318318
String path, NanoHTTPD.Response.IStatus status, String responseBody) {
319319
return new NanoServerHandler(path) {
320320
@Override

‎addOns/ascanrulesAlpha/CHANGELOG.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ All notable changes to this add-on will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
55

66
## Unreleased
7-
7+
### Changed
8+
- Maintenance changes.
89

910
## [48] - 2024-09-02
1011
### Changed

‎addOns/ascanrulesAlpha/src/test/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleFileActiveScanRuleUnitTest.java

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*
2+
* Zed Attack Proxy (ZAP) and its related class files.
3+
*
4+
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
5+
*
6+
* Copyright 2024 The ZAP Development Team
7+
*
8+
* Licensed under the Apache License, Version 2.0 (the "License");
9+
* you may not use this file except in compliance with the License.
10+
* You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package org.zaproxy.zap.extension.ascanrulesAlpha;
21+
22+
import static org.hamcrest.MatcherAssert.assertThat;
23+
import static org.hamcrest.Matchers.equalTo;
24+
import static org.hamcrest.Matchers.hasSize;
25+
import static org.hamcrest.Matchers.is;
26+
27+
import java.util.List;
28+
import org.junit.jupiter.api.Test;
29+
import org.parosproxy.paros.core.scanner.Alert;
30+
31+
class ExampleFileActiveScanRuleUnitTest extends ActiveScannerTest<ExampleFileActiveScanRule> {
32+
33+
@Override
34+
protected ExampleFileActiveScanRule createScanner() {
35+
return new ExampleFileActiveScanRule();
36+
}
37+
38+
@Test
39+
void shouldHaveExpectedExample() {
40+
// Given / When
41+
List<Alert> alerts = rule.getExampleAlerts();
42+
// Then
43+
assertThat(alerts, hasSize(1));
44+
Alert alert = alerts.get(0);
45+
assertThat(alert.getParam(), is(equalTo("foo")));
46+
}
47+
48+
@Test
49+
@Override
50+
public void shouldHaveValidReferences() {
51+
super.shouldHaveValidReferences();
52+
}
53+
}

‎addOns/ascanrulesAlpha/src/test/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleSimpleActiveScanRuleUnitTest.java

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*
2+
* Zed Attack Proxy (ZAP) and its related class files.
3+
*
4+
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
5+
*
6+
* Copyright 2024 The ZAP Development Team
7+
*
8+
* Licensed under the Apache License, Version 2.0 (the "License");
9+
* you may not use this file except in compliance with the License.
10+
* You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package org.zaproxy.zap.extension.ascanrulesAlpha;
21+
22+
import static org.hamcrest.MatcherAssert.assertThat;
23+
import static org.hamcrest.Matchers.equalTo;
24+
import static org.hamcrest.Matchers.hasSize;
25+
import static org.hamcrest.Matchers.is;
26+
27+
import java.util.List;
28+
import org.junit.jupiter.api.Test;
29+
import org.parosproxy.paros.core.scanner.Alert;
30+
31+
class ExampleSimpleActiveScanRuleUnitTest extends ActiveScannerTest<ExampleSimpleActiveScanRule> {
32+
33+
@Override
34+
protected ExampleSimpleActiveScanRule createScanner() {
35+
return new ExampleSimpleActiveScanRule();
36+
}
37+
38+
@Test
39+
void shouldHaveExpectedExample() {
40+
// Given / When
41+
List<Alert> alerts = rule.getExampleAlerts();
42+
// Then
43+
assertThat(alerts, hasSize(1));
44+
Alert alert = alerts.get(0);
45+
assertThat(alert.getParam(), is(equalTo("foo")));
46+
}
47+
48+
@Test
49+
@Override
50+
public void shouldHaveValidReferences() {
51+
super.shouldHaveValidReferences();
52+
}
53+
}

‎addOns/ascanrulesBeta/CHANGELOG.md

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
66
## Unreleased
77
### Changed
88
- Log exception details in Out of Band XSS scan rule.
9+
- Removed misleading "Attack" from the Proxy Disclosure scan rule alerts (Issue 8556).
10+
- Maintenance changes.
911

1012
## [55] - 2024-09-02
1113
### Changed

‎addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/BackupFileDisclosureScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,7 @@ public List<Alert> getExampleAlerts() {
426426
.build());
427427
}
428428

429-
private boolean isEmptyResponse(byte[] response) {
429+
private static boolean isEmptyResponse(byte[] response) {
430430
return response.length == 0;
431431
}
432432

‎addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/HttpParameterPollutionScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ public TreeSet<HtmlParameter> getParams(Source s, List<Element> inputTags) {
242242
* @param url found in the body of the targeted page
243243
* @return a hashmap of the query string
244244
*/
245-
private Map<String, List<String>> getUrlParameters(String url) {
245+
private static Map<String, List<String>> getUrlParameters(String url) {
246246
Map<String, List<String>> params = new HashMap<>();
247247

248248
if (url != null) {

‎addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/IntegerOverflowScanRule.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public String getReference() {
8585
return Constant.messages.getString(MESSAGE_PREFIX + "refs");
8686
}
8787

88-
private String getError(char c) {
88+
private static String getError(char c) {
8989
return Constant.messages.getString(MESSAGE_PREFIX + "error" + c);
9090
}
9191

@@ -145,7 +145,7 @@ public Map<String, String> getAlertTags() {
145145
return ALERT_TAGS;
146146
}
147147

148-
private String randomIntegerString(int length) {
148+
private static String randomIntegerString(int length) {
149149

150150
int numbercounter = 0;
151151
int character = 0;
@@ -169,7 +169,7 @@ private String randomIntegerString(int length) {
169169
return sb1.toString();
170170
}
171171

172-
private String singleString(int length, char c) // Single Character String
172+
private static String singleString(int length, char c) // Single Character String
173173
{
174174

175175
int numbercounter = 0;
@@ -241,7 +241,7 @@ private AlertBuilder buildAlert(
241241
.setUri(url)
242242
.setParam(param)
243243
.setAttack(attack)
244-
.setOtherInfo(this.getError(type))
244+
.setOtherInfo(getError(type))
245245
.setEvidence(evidence);
246246
}
247247
}

‎addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/ProxyDisclosureScanRule.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -765,15 +765,16 @@ public void scan() {
765765
}
766766
}
767767

768-
private String getPath(URI uri) {
768+
private static String getPath(URI uri) {
769769
String path = uri.getEscapedPath();
770770
if (path != null) {
771771
return path;
772772
}
773773
return "/";
774774
}
775775

776-
private String getAttack() {
776+
777+
private static String getAttack() {
777778
return Constant.messages.getString(MESSAGE_PREFIX + "attack");
778779
}
779780

‎addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/RelativePathConfusionScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -645,7 +645,7 @@ private AlertBuilder buildAlert(String attack, String otherInfo, String evidence
645645
.setEvidence(evidence);
646646
}
647647

648-
private Matcher matchStyles(String body) {
648+
private static Matcher matchStyles(String body) {
649649
// remove all " and ' for proper matching url('somefile.png')
650650
String styleBody = body.replaceAll("['\"]", "");
651651
return STYLE_URL_LOAD.matcher(styleBody);

‎addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/SessionFixationScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -1317,7 +1317,7 @@ private static void logSessionFixation(
13171317
* @param cookieName
13181318
* @return the HtmlParameter representing the cookie, or null if no matching cookie was found
13191319
*/
1320-
private HtmlParameter getResponseCookie(HttpMessage message, String cookieName) {
1320+
private static HtmlParameter getResponseCookie(HttpMessage message, String cookieName) {
13211321
TreeSet<HtmlParameter> cookieBackParams = message.getResponseHeader().getCookieParams();
13221322
if (cookieBackParams.isEmpty()) {
13231323
// no cookies

0 commit comments

Comments
 (0)