Skip to content

Add a custom entry script for ZAP Automation Framework to ensure that scans are compelting even when they have warning #2627

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Ilyesbdlala merged 2 commits into from
Aug 30, 2024
Merged

Add a custom entry script for ZAP Automation Framework to ensure that scans are compelting even when they have warning #2627

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
048e11d
Add a custom entry point to ignore warning exit code
J12934 Aug 23, 2024
b13a897
Adjust expected manifest templated by helm
J12934 Aug 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions scanners/zap-automation-framework/templates/zap-entry-point.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# SPDX-FileCopyrightText: the secureCodeBox authors
#
# SPDX-License-Identifier: Apache-2.0

kind: ConfigMap
apiVersion: v1
metadata:
name: zap-automation-framework-entrypoint
data:
zap-entrypoint.bash: |

# ensures that zap still exits with a exit code of zero when the scan logged warnings: see https://www.zaproxy.org/docs/automate/automation-framework/
./zap.sh -cmd $@ || [ $? -ne 1 ]
4 changes: 2 additions & 2 deletions scanners/zap-automation-framework/templates/zap-scan-type.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,8 @@ spec:
image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
command:
- "zap.sh"
- "-cmd"
- "bash"
- "/zap/zap-entrypoint.bash"
resources:
{{- toYaml .Values.scanner.resources | nindent 16 }}
securityContext:
Expand Down
22 changes: 19 additions & 3 deletions scanners/zap-automation-framework/tests/__snapshot__/scanner_test.yaml.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,15 @@ matches the snapshot:
- https://{{$.hostOrIP}}:{{attributes.port}}
scanType: zap-automation-framework
3: |
apiVersion: v1
data:
zap-entrypoint.bash: |2
# ensures that zap still exits with a exit code of zero when the scan logged warnings: see https://www.zaproxy.org/docs/automate/automation-framework/
./zap.sh -cmd $@ || [ $? -ne 1 ]
kind: ConfigMap
metadata:
name: zap-automation-framework-entrypoint
4: |
apiVersion: execution.securecodebox.io/v1
kind: ParseDefinition
metadata:
Expand All @@ -63,7 +72,7 @@ matches the snapshot:
tolerations:
- foo: bar
ttlSecondsAfterFinished: null
4: |
5: |
apiVersion: execution.securecodebox.io/v1
kind: ScanType
metadata:
Expand All @@ -81,8 +90,8 @@ matches the snapshot:
foo: bar
containers:
- command:
- zap.sh
- -cmd
- bash
- /zap/zap-entrypoint.bash
env: []
envFrom: []
image: softwaresecurityproject/zap-stable:0.0.0
Expand All @@ -101,6 +110,10 @@ matches the snapshot:
volumeMounts:
- mountPath: /zap/wrk
name: zap-workdir
- mountPath: /zap/zap-entrypoint.bash
name: zap-automation-framework-entrypoint
readOnly: true
subPath: zap-entrypoint.bash
- image: bar
name: foo
restartPolicy: Never
Expand All @@ -110,3 +123,6 @@ matches the snapshot:
volumes:
- emptyDir: {}
name: zap-workdir
- configMap:
name: zap-automation-framework-entrypoint
name: zap-automation-framework-entrypoint
7 changes: 7 additions & 0 deletions scanners/zap-automation-framework/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,11 +75,18 @@ scanner:
extraVolumes:
- name: zap-workdir
emptyDir: {}
- name: zap-automation-framework-entrypoint
configMap:
name: zap-automation-framework-entrypoint

# scanner.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
extraVolumeMounts:
- mountPath: /zap/wrk
name: zap-workdir
- name: zap-automation-framework-entrypoint
mountPath: "/zap/zap-entrypoint.bash"
readOnly: true
subPath: zap-entrypoint.bash

# scanner.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
extraContainers: []
Expand Down