ascanrulesBeta: Add Example Alerts to InsecureHttpMethodScanRule #6789
Conversation
|
All contributors have signed the CLA ✍️ ✅ |
|
I have read the CLA Document and I hereby sign the CLA |
|
Great job! No new security vulnerabilities introduced in this pull requestUse @Checkmarx to reach out to us for assistance. Just send a PR comment with Examples: |
|
This should cover all the different alerts the rule might raise. Including adding alertRefs (see issue zaproxy/zaproxy#7100 for more on that). |
Added example alert functionality Removed unnecessary import Adheres to google-java style Unnecessary exception Applied spotlessApply Signed-off-by: Brandosp <[email protected]> Added more examples and added Alert refs Signed-off-by: Brandosp <[email protected]>
| private AlertBuilder buildAlert( | ||
| String vulnName, | ||
| String vulnDesc, | ||
| String extraInfo, | ||
| String evidence, | ||
| HttpMessage msg, | ||
| VulnType currentVT) { | ||
| return newAlert() | ||
| .setConfidence(Alert.CONFIDENCE_MEDIUM) | ||
| .setName( | ||
| Constant.messages.getString( | ||
| "ascanbeta.insecurehttpmethod.detailed.name", vulnName)) | ||
| .setDescription(vulnDesc) | ||
| .setOtherInfo(extraInfo) | ||
| .setSolution(Constant.messages.getString("ascanbeta.insecurehttpmethod.soln")) | ||
| .setEvidence(evidence) | ||
| .setMessage(msg) | ||
| .setCweId(getCweId()) | ||
| .setWascId(getWascId()) | ||
| .setAlertRef(getId() + "-" + currentVT.getRef()); | ||
| } |
There was a problem hiding this comment.
The builder should be usable by the existing code. Ex: Where alerts are currently raised it should be able to call the builder method(s) (there can be multiple if necessary) then just raise, like: buildAlert(....).raise();
| name = "DELETE Method Enabled"; | ||
| description = "The server allows the DELETE HTTP method which can be unsafe."; | ||
| extraInfo = "DELETE requests could remove resources if exploited."; | ||
| evidence = "DELETE"; |
There was a problem hiding this comment.
These values should be the actual values used in the alerts, though you may need to provide the details or specifics like "DELETE". You could also include these int he enum members as that likely simplifies things. It also ensure that they're translated etc.
3 participants
Overview
Added example alerts for InsecureHttpMethodScanRule.
Related Issues
6119
Checklist
for more details, please refer to the developer rules and guidelines