zap-extensions
zap-extensions copied to clipboard
zaproxy
ascanrules : GetForPostScanRule use ComparableResponse
Overview
Changed GetForPost scan rule to use ComparableResponse. Part of zaproxy/zaproxy#7116
Related Issues
https://github.com/zaproxy/zaproxy/issues/7116
Checklist
- [ ] Update help
- [x] Update changelog
- [x] Run
./gradlew spotlessApplyfor code formatting - [ ] Write tests
- [ ] Check code coverage
- [x] Sign-off commits
- [x] Squash commits
- [x] Use a descriptive title
For more details, please refer to the developer rules and guidelines.
This doesn't resolve 7116, there are still other tasks (for other rules).
This doesn't resolve 7116, there are still other tasks (for other rules).
updated to Part of
Really sorry, I have been a little busy with university. Is it fine if i do the changes within a week?
I tried to add the test but got stuck with adding the form parameters. Initializing the message in the test case
HttpMessage msg = this.getHttpMessage("POST" , "application/x-www-form-urlencoded", testPath , "<html>Something<html>");
TreeSet<HtmlParameter> treeSet = new TreeSet<>();
treeSet.add(new HtmlParameter(HtmlParameter.Type.form , "key" , "value"));
msg.setFormParams(treeSet);
this.rule.init(msg , this.parent);
//When
this.rule.scan();
//Then
assertTrue(true);
And in the GetForPostScanRule
@Override
public void scan() {
// Check if the user stopped things. One request per URL so check before
// sending the request
if (isStop()) {
LOGGER.debug("Scan rule {} Stopping.", getName());
return;
}
HttpMessage baseMsg = getBaseMsg();
System.out.println(baseMsg.getRequestBody());
System.out.println(baseMsg.getRequestHeader());
TreeSet<HtmlParameter> postParams = baseMsg.getFormParams();
System.out.println("Is params empty= " + postParams.isEmpty());
System.out.println("Is post req = " + baseMsg.getRequestHeader().getMethod().equalsIgnoreCase(HttpRequestHeader.POST));
if (!baseMsg.getRequestHeader().getMethod().equalsIgnoreCase(HttpRequestHeader.POST)
|| postParams.isEmpty()) {
return; // Not a POST or no form params, no reason to continue
}
output is
key=value //the request body
//the header
POST http://localhost:45323/shouldRaiseAlertIfGetAndPostResponsesAreSame/ HTTP/1.1
Host: localhost:45323
User-Agent: ZAP
Pragma: no-cache
//the boolean checks
Is params empty= true
Is post req = true
please tell me what I am doing wrong with initializing the http message in the test case. Thankyou
@kingthorin @thc202 please help me with this https://github.com/zaproxy/zap-extensions/pull/5305#issuecomment-1988698291
The content-type being passed to getHttpMessage is for the response not the request, you need to set it into the request after creating the message.