Skip to content

Commit dbc199b

Browse files
psiinonpsiinon
authored
Merge pull request #5541 from kingthorin/rules-clean
scan rules: Clean code tweaks
2 parents 9d6a710 + 141375b commit dbc199b

File tree

134 files changed

+553
-1338
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

134 files changed

+553
-1338
lines changed

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/BufferOverflowScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ public int getWascId() {
169169
return 7;
170170
}
171171

172-
private String randomCharacterString(int length) {
172+
private static String randomCharacterString(int length) {
173173
StringBuilder sb1 = new StringBuilder(length + 1);
174174
int counter = 0;
175175
int character = 0;

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/CommandInjectionScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ public int getRisk() {
366366
return Alert.RISK_HIGH;
367367
}
368368

369-
private String getOtherInfo(TestType testType, String testValue) {
369+
private static String getOtherInfo(TestType testType, String testValue) {
370370
return Constant.messages.getString(
371371
MESSAGE_PREFIX + "otherinfo." + testType.getNameKey(), testValue);
372372
}

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/DirectoryBrowsingScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ public String getReference() {
9595
return Constant.messages.getString(MESSAGE_PREFIX + "refs");
9696
}
9797

98-
private void checkIfDirectory(HttpMessage msg) throws URIException {
98+
private static void checkIfDirectory(HttpMessage msg) throws URIException {
9999

100100
URI uri = msg.getRequestHeader().getURI();
101101
uri.setQuery(null);

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -342,7 +342,7 @@ private static boolean isRedirectHost(String value, boolean escaped) throws URIE
342342
* @param msg the current message where reflected redirection should be check into
343343
* @return get back the redirection type if exists
344344
*/
345-
private int isRedirected(String payload, HttpMessage msg) {
345+
private static int isRedirected(String payload, HttpMessage msg) {
346346

347347
// (1) Check if redirection by "Location" header
348348
// http://en.wikipedia.org/wiki/HTTP_location
@@ -471,7 +471,7 @@ private static boolean isRedirectPresent(Pattern pattern, String value) {
471471
* @param type the redirection type
472472
* @return a string representing the reason of this redirection
473473
*/
474-
private String getRedirectionReason(int type) {
474+
private static String getRedirectionReason(int type) {
475475
switch (type) {
476476
case REDIRECT_LOCATION_HEADER:
477477
return Constant.messages.getString(MESSAGE_PREFIX + "reason.location.header");

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/FormatStringScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ public String getReference() {
105105
return Constant.messages.getString(MESSAGE_PREFIX + "refs");
106106
}
107107

108-
private String getError(char c) {
108+
private static String getError(char c) {
109109
return Constant.messages.getString(MESSAGE_PREFIX + "error" + c);
110110
}
111111

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/PaddingOracleScanRule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ private String getEmptyValueResponse(String paramName) throws IOException {
267267
* @param value the value that need to be checked
268268
* @return true if it seems to be encrypted
269269
*/
270-
private boolean isEncrypted(byte[] value) {
270+
private static boolean isEncrypted(byte[] value) {
271271

272272
// Make sure we have a reasonable sized string
273273
// (encrypted strings tend to be long, and short strings tend to break our numbers)

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/PathTraversalScanRule.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -608,7 +608,7 @@ private boolean sendAndCheckPayload(
608608
return false;
609609
}
610610

611-
private String getContentsToMatch(HttpMessage message) {
611+
private static String getContentsToMatch(HttpMessage message) {
612612
return message.getResponseHeader().isHtml()
613613
? StringEscapeUtils.unescapeHtml4(message.getResponseBody().toString())
614614
: message.getResponseHeader().toString() + message.getResponseBody().toString();
@@ -700,7 +700,7 @@ public String match(String contents) {
700700
return matchWinDirectories(contents);
701701
}
702702

703-
private String matchNixDirectories(String contents) {
703+
private static String matchNixDirectories(String contents) {
704704
Pattern procPattern =
705705
Pattern.compile("(?:^|\\W)proc(?:\\W|$)", Pattern.CASE_INSENSITIVE);
706706
Pattern etcPattern = Pattern.compile("(?:^|\\W)etc(?:\\W|$)", Pattern.CASE_INSENSITIVE);
@@ -727,7 +727,7 @@ private String matchNixDirectories(String contents) {
727727
return null;
728728
}
729729

730-
private String matchWinDirectories(String contents) {
730+
private static String matchWinDirectories(String contents) {
731731
if (contents.contains("Windows")
732732
&& Pattern.compile("Program\\sFiles").matcher(contents).find()) {
733733
return "Windows";

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SourceCodeDisclosureWebInfScanRule.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ private HttpMessage createHttpMessage(URI uri) throws HttpMalformedHeaderExcepti
277277
* @return
278278
* @throws URIException
279279
*/
280-
private URI getClassURI(URI hostURI, String classname) throws URIException {
280+
private static URI getClassURI(URI hostURI, String classname) throws URIException {
281281
return new URI(
282282
hostURI.getScheme()
283283
+ "://"
@@ -288,7 +288,7 @@ private URI getClassURI(URI hostURI, String classname) throws URIException {
288288
false);
289289
}
290290

291-
private URI getPropsFileURI(URI hostURI, String propsfilename) throws URIException {
291+
private static URI getPropsFileURI(URI hostURI, String propsfilename) throws URIException {
292292
return new URI(
293293
hostURI.getScheme()
294294
+ "://"

‎addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/Spring4ShellScanRule.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,11 @@ public String getDescription() {
7676
return Constant.messages.getString("ascanrules.spring4shell.desc");
7777
}
7878

79-
private boolean is400Response(HttpMessage msg) {
79+
private static boolean is400Response(HttpMessage msg) {
8080
return !msg.getResponseHeader().isEmpty() && msg.getResponseHeader().getStatusCode() == 400;
8181
}
8282

83-
private void setGetPayload(HttpMessage msg, String payload) throws URIException {
83+
private static void setGetPayload(HttpMessage msg, String payload) throws URIException {
8484
msg.getRequestHeader().setMethod("GET");
8585
URI uri = msg.getRequestHeader().getURI();
8686
String query = uri.getEscapedQuery();
@@ -92,7 +92,7 @@ private void setGetPayload(HttpMessage msg, String payload) throws URIException
9292
uri.setEscapedQuery(query);
9393
}
9494

95-
private void setPostPayload(HttpMessage msg, String payload) {
95+
private static void setPostPayload(HttpMessage msg, String payload) {
9696
msg.getRequestHeader().setMethod("POST");
9797
String body = msg.getRequestBody().toString();
9898
if (body.isEmpty()

‎addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,11 @@ private enum PayloadHandling {
8080
CONCAT_PATH
8181
};
8282

83-
private NanoServerHandler createHttpRedirectHandler(String path, String header) {
83+
private static NanoServerHandler createHttpRedirectHandler(String path, String header) {
8484
return createHttpRedirectHandler(path, header, PayloadHandling.NEITHER);
8585
}
8686

87-
private NanoServerHandler createHttpRedirectHandler(
87+
private static NanoServerHandler createHttpRedirectHandler(
8888
String path, String header, PayloadHandling payloadHandling) {
8989
return new NanoServerHandler(path) {
9090
@Override

‎addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/HiddenFilesScanRuleUnitTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ void checkNoPathsHaveLeadingSlash() {
110110
}
111111
}
112112

113-
private void assertNoLeadingSlash(String message, String path) {
113+
private static void assertNoLeadingSlash(String message, String path) {
114114
assertThat(message.replace(REPLACE_TOKEN, path), !path.startsWith("/"), is(true));
115115
}
116116

‎addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/XxeScanRuleUnitTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -314,7 +314,7 @@ void shouldAlertOnlyIfCertainTagValuesArePresent()
314314
assertThat(alert.getConfidence(), equalTo(Alert.CONFIDENCE_MEDIUM));
315315
}
316316

317-
private NanoServerHandler createNanoHandler(
317+
private static NanoServerHandler createNanoHandler(
318318
String path, NanoHTTPD.Response.IStatus status, String responseBody) {
319319
return new NanoServerHandler(path) {
320320
@Override

‎addOns/ascanrulesAlpha/CHANGELOG.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ All notable changes to this add-on will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
55

66
## Unreleased
7-
7+
### Changed
8+
- Maintenance changes.
89

910
## [48] - 2024-09-02
1011
### Changed

‎addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleFileActiveScanRule.java

+19-11
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@
4343
*
4444
* @author psiinon
4545
*/
46-
public class ExampleFileActiveScanRule extends AbstractAppParamPlugin {
46+
public class ExampleFileActiveScanRule extends AbstractAppParamPlugin
47+
implements CommonActiveScanRuleInfo {
4748

4849
/** Prefix for internationalized messages used by this rule */
4950
private static final String MESSAGE_PREFIX = "ascanalpha.examplefile.";
@@ -80,7 +81,7 @@ public String getDescription() {
8081
return Constant.messages.getString(MESSAGE_PREFIX + "desc");
8182
}
8283

83-
private String getOtherInfo() {
84+
private static String getOtherInfo() {
8485
return Constant.messages.getString(MESSAGE_PREFIX + "other");
8586
}
8687

@@ -155,14 +156,7 @@ public void scan(HttpMessage msg, String param, String value) {
155156
String evidence;
156157
if ((evidence = doesResponseContainString(msg.getResponseBody(), attack)) != null) {
157158
// Raise an alert
158-
newAlert()
159-
.setConfidence(Alert.CONFIDENCE_MEDIUM)
160-
.setParam(param)
161-
.setAttack(attack)
162-
.setOtherInfo(getOtherInfo())
163-
.setEvidence(evidence)
164-
.setMessage(testMsg)
165-
.raise();
159+
createAlert(param, attack, evidence).setMessage(testMsg).raise();
166160
return;
167161
}
168162
}
@@ -194,7 +188,16 @@ private String doesResponseContainString(HttpBody body, String str) {
194188
return null;
195189
}
196190

197-
private List<String> loadFile(String file) {
191+
private AlertBuilder createAlert(String param, String attack, String evidence) {
192+
return newAlert()
193+
.setConfidence(Alert.CONFIDENCE_MEDIUM)
194+
.setParam(param)
195+
.setAttack(attack)
196+
.setOtherInfo(getOtherInfo())
197+
.setEvidence(evidence);
198+
}
199+
200+
private static List<String> loadFile(String file) {
198201
/*
199202
* ZAP will have already extracted the file from the add-on and put it underneath the 'ZAP home' directory
200203
*/
@@ -244,4 +247,9 @@ public int getWascId() {
244247
// The WASC ID
245248
return 0;
246249
}
250+
251+
@Override
252+
public List<Alert> getExampleAlerts() {
253+
return List.of(createAlert("foo", "<SCRIPT>a=/XSS/", "<SCRIPT>a=/XSS/").build());
254+
}
247255
}

‎addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleSimpleActiveScanRule.java

+14-9
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
package org.zaproxy.zap.extension.ascanrulesAlpha;
2121

2222
import java.io.IOException;
23+
import java.util.List;
2324
import java.util.Random;
2425
import org.apache.logging.log4j.LogManager;
2526
import org.apache.logging.log4j.Logger;
@@ -39,7 +40,8 @@
3940
*
4041
* @author psiinon
4142
*/
42-
public class ExampleSimpleActiveScanRule extends AbstractAppParamPlugin {
43+
public class ExampleSimpleActiveScanRule extends AbstractAppParamPlugin
44+
implements CommonActiveScanRuleInfo {
4345

4446
// wasc_10 is Denial of Service - well, its just an example ;)
4547
private static final Vulnerability VULN = Vulnerabilities.getDefault().get("wasc_10");
@@ -59,8 +61,7 @@ public int getId() {
5961

6062
@Override
6163
public String getName() {
62-
// Strip off the "Example Active Scan Rule: " part if implementing a real one ;)
63-
return "Example Active Scan Rule: " + VULN.getName();
64+
return Constant.messages.getString("ascanalpha.examplesimple.name");
6465
}
6566

6667
@Override
@@ -118,12 +119,7 @@ public void scan(HttpMessage msg, String param, String value) {
118119
// For this example we're just going to raise the alert at random!
119120

120121
if (rnd.nextInt(10) == 0) {
121-
newAlert()
122-
.setConfidence(Alert.CONFIDENCE_MEDIUM)
123-
.setParam(param)
124-
.setAttack(value)
125-
.setMessage(testMsg)
126-
.raise();
122+
createAlert(param, attack).setMessage(testMsg).raise();
127123
return;
128124
}
129125

@@ -132,6 +128,10 @@ public void scan(HttpMessage msg, String param, String value) {
132128
}
133129
}
134130

131+
private AlertBuilder createAlert(String param, String attack) {
132+
return newAlert().setConfidence(Alert.CONFIDENCE_MEDIUM).setParam(param).setAttack(attack);
133+
}
134+
135135
@Override
136136
public int getRisk() {
137137
return Alert.RISK_HIGH;
@@ -148,4 +148,9 @@ public int getWascId() {
148148
// The WASC ID
149149
return 0;
150150
}
151+
152+
@Override
153+
public List<Alert> getExampleAlerts() {
154+
return List.of(createAlert("foo", "attack").build());
155+
}
151156
}

‎addOns/ascanrulesAlpha/src/main/javahelp/org/zaproxy/zap/extension/ascanrulesAlpha/resources/help/contents/ascanalpha.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,14 @@
99
<H1>Active Scan Rules - Alpha</H1>
1010
The following alpha status active scan rules are included in this add-on:
1111

12-
<H2>An example active scan rule which loads data from a file</H2>
12+
<H2 id="id-60101">An example active scan rule which loads data from a file</H2>
1313
This implements an example active scan rule that loads strings from a file that the user can edit.<br>
1414
For more details see:
1515
<a href="https://www.zaproxy.org/blog/2014-04-30-hacking-zap-4-active-scan-rules/">Hacking ZAP Part 4: Active Scan Rules</a>.
1616
<p>
1717
Latest code: <a href="https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleFileActiveScanRule.java">ExampleFileActiveScanRule.java</a>
1818

19-
<H2>Example Active Scan Rule: Denial of Service</H2>
19+
<H2 id="id-60100">Example Active Scan Rule: Denial of Service</H2>
2020
This implements a very simple example active scan rule.<br>
2121
For more details see:
2222
<a href="https://www.zaproxy.org/blog/2014-04-30-hacking-zap-4-active-scan-rules/">Hacking ZAP Part 4: Active Scan Rules</a>.

‎addOns/ascanrulesAlpha/src/main/resources/org/zaproxy/zap/extension/ascanrulesAlpha/resources/Messages.properties

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ ascanalpha.examplefile.other = This is for information that doesnt fit in any of
66
ascanalpha.examplefile.refs = https://www.zaproxy.org/blog/2014-04-30-hacking-zap-4-active-scan-rules/
77
ascanalpha.examplefile.soln = A general description of how to solve the problem.
88

9+
ascanalpha.examplesimple.name = Example Active Scan Rule: Denial of Service
10+
911
#ascanalpha.ldapinjection.alert.attack=[{0}] field [{1}] set to [{2}]
1012
ascanalpha.ldapinjection.alert.attack = parameter [{0}] set to [{1}]
1113
#ascanalpha.ldapinjection.alert.extrainfo=[{0}] field [{1}] on [{2}] [{3}] may be vulnerable to LDAP injection, using an attack with LDAP meta-characters [{4}], yielding known [{5}] error message [{6}], which was not present in the original response.

‎addOns/ascanrulesAlpha/src/test/java/org/zaproxy/zap/extension/ascanrulesAlpha/ExampleFileActiveScanRuleUnitTest.java

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*
2+
* Zed Attack Proxy (ZAP) and its related class files.
3+
*
4+
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
5+
*
6+
* Copyright 2024 The ZAP Development Team
7+
*
8+
* Licensed under the Apache License, Version 2.0 (the "License");
9+
* you may not use this file except in compliance with the License.
10+
* You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package org.zaproxy.zap.extension.ascanrulesAlpha;
21+
22+
import static org.hamcrest.MatcherAssert.assertThat;
23+
import static org.hamcrest.Matchers.equalTo;
24+
import static org.hamcrest.Matchers.hasSize;
25+
import static org.hamcrest.Matchers.is;
26+
27+
import java.util.List;
28+
import org.junit.jupiter.api.Test;
29+
import org.parosproxy.paros.core.scanner.Alert;
30+
31+
class ExampleFileActiveScanRuleUnitTest extends ActiveScannerTest<ExampleFileActiveScanRule> {
32+
33+
@Override
34+
protected ExampleFileActiveScanRule createScanner() {
35+
return new ExampleFileActiveScanRule();
36+
}
37+
38+
@Test
39+
void shouldHaveExpectedExample() {
40+
// Given / When
41+
List<Alert> alerts = rule.getExampleAlerts();
42+
// Then
43+
assertThat(alerts, hasSize(1));
44+
Alert alert = alerts.get(0);
45+
assertThat(alert.getParam(), is(equalTo("foo")));
46+
}
47+
48+
@Test
49+
@Override
50+
public void shouldHaveValidReferences() {
51+
super.shouldHaveValidReferences();
52+
}
53+
}

0 commit comments

Comments
 (0)