ascanrules: Path Traversal add details for dir match Alerts & reduce FPs #5824
Conversation
|
This does not seem to address the FP reported in the referenced issue. |
| .setAttack(attack) | ||
| .setEvidence(evidence) | ||
| .setAlertRef(getId() + "-" + check); | ||
| if (List.of(NIX_DIR_EVIDENCE, WIN_DIR_EVIDENCE).contains(evidence)) { |
There was a problem hiding this comment.
Extract constant or check both separately.
There was a problem hiding this comment.
You mean the list to a constant?
There was a problem hiding this comment.
Yes, it does not need to create it each time, especially since it's just two comparisons.
| @@ -691,6 +704,9 @@ public String match(String contents) { | |||
|
|
|||
| private static class DirNamesContentsMatcher implements ContentsMatcher { | |||
|
|
|||
| public static final List<String> NIX_MATCHES = | |||
There was a problem hiding this comment.
Could well convert to string here instead of each time when raising the alerts, also could drop the [].
| @@ -113,6 +113,7 @@ ascanrules.paddingoracle.soln = Update the affected server software, or modify t | |||
| ascanrules.parametertamper.desc = Parameter manipulation caused an error page or Java stack trace to be displayed. This indicated lack of exception handling and potential areas for further exploit. | |||
| ascanrules.parametertamper.name = Parameter Tampering | |||
| ascanrules.parametertamper.soln = Identify the cause of the error and fix it. Do not trust client side input and enforce a tight check in the server side. Besides, catch the exception properly. Use a generic 500 error page for internal server error. | |||
| ascanrules.pathtraversal.info = While the evidence field indicates {0}, the rule actually checked that the response contains matches for all of the following: {1}. | |||
There was a problem hiding this comment.
Could be moved to the following line.
|
No it simply provides further context. IMHO it will be rare for all 5 of the nix matches to happen. Do you want me to also exclude JS/CSS/Binary'ish because that's an option too which I could add to this PR. |
|
Not sure how rare is since JS chunks/libs tend to have lot of data, but we should not close the issue if it does not address it. That would be better to address the issue (though the evidence match done beforehand should have caught the reported case, if actually static content). |
|
Okay I'll make further changes. |
|
This rule doesn't seem to pre-check the response. I'll tackle that as well. |
kingthorin
force-pushed
the
pathtrav-details
branch
from
851c5c1 to
21096ab
Compare
|
Addressed review, further pre-checks as discussed still coming 😁 |
kingthorin
force-pushed
the
pathtrav-details
branch
2 times, most recently
from
6cdb014 to
a9c8485
Compare
kingthorin
changed the title
|
Now w/ pre-checks. |
addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/PathTraversalScanRule.java
Outdated
Show resolved
Hide resolved
kingthorin
force-pushed
the
pathtrav-details
branch
from
a9c8485 to
aa5816d
Compare
- CHANGELOG > Added change note. - Message.properties > Added key/value pair supporting the new Alert details. - PathTraversalScanRule > Updated to include Other Info on Alerts when applicable, and pre-check the original message response to reduce false positives. - PathTraversalScanRuleUnitTest > Updated to assert Other Info or lack thereof where applicable, also assure appropriate skipping due to pre-conditions. Signed-off-by: kingthorin <[email protected]>
kingthorin
force-pushed
the
pathtrav-details
branch
from
aa5816d to
a6d3a94
Compare
|
Great job, no security vulnerabilities found in this Pull Request |
|
I've rebased this to current. I believe all the previous feedback has been addressed. Please correct me if I'm wrong. |
Overview
Related Issues
Checklist
./gradlew spotlessApplyfor code formatting