chainloop-dev
feat: add support for ZAP material type
We could look into supporting accepting the default zip file and look inside the json for @programname to identify the material type.
It must support both simple and full scans (not sure if there is a difference in format). And we should consider making this two material types, i.e ZAP_DAST_FULL and ZAP_DAST_SIMPLE if we see fit.
Example of full scan zap_scan.zip
just researched a little bit if there is a good way of differentiating between scan times and there doesn't seem to be one. Some output from our friend
In the JSON report generated by OWASP ZAP, there isn't a specific field labeled directly as "Full Scan" or "Simple Scan." However, you can infer the type of scan based on several fields in the report that reflect the depth, scope, and configuration of the scan.
Here are a few key elements you can check in the JSON report to help determine whether the scan was a Full Scan or a Simple Scan:
- "sites" Field Full Scan: If the "sites" field contains multiple entries (representing different URLs, endpoints, and pages within the application), this suggests that ZAP crawled extensively across the entire site. Simple Scan: If this field only contains one or a few entries (typically the homepage or a small number of resources), this is indicative of a Simple Scan.
are we uploading the whole zip file or just the json? We should do the former.
are we uploading the whole zip file or just the json? We should do the former.
Only the json file.
And we should consider making this two material types, i.e ZAP_DAST_FULL and ZAP_DAST_SIMPLE if we see fit.
did you look at if there is a difference between the two scans?
Only the json file.
we should do the zip
There is no difference between the full and baseline scan more than the number of objects analyzed, for the rest, it's identical.
Also, by default the tool does not export to .zip instead, it lets you specified the name of the files that by default are the ones matching the implementation, in this case, report_json.json. My take is that zip file was taken from the GitHub action: https://github.com/zaproxy/action-full-scan