Configuring a plugin as ZAP API

[Sivakumar Prakhash]

Hi,

This mail continues the topic which I was discussing in "How to use zapClientAPI.callApi() in zaproxy to call a ZAP extension". I'm sending this in a new topic since I'm not able to post replies in that old thread( getting deleted)

Question

I think I'm missing any configurations in the Jira plugin in [1], I tried to list the APIs available using http://localhost:8500/UI, I couldn't find my API there. what are the changes I need to do in order to list the plugin as an API in ZAP ?

Appreciate your help.

[1] https://github.com/Prakhash/JiraIssuePlugin

Thanks

[thc...@gmail.com]

Hi.

(The messages were being added to the moderation queue...)

The first thing is to check that the add-on is being loaded, it should
be shown in the Manage Add-ons dialogue.

ZAP's add-on name scheme is the following:
<name>-<status>-<version>.zap

So the add-on filename should look like:
wso2jiraplugin-alpha-1.zap

for ZAP to load it.

Once it is loaded we should check that the extension is being correctly
initialised (e.g. no exceptions in the console output or zap.log and
that the extension is shown in Options > Extensions).

(The class variable JiraIssueCreatorExtension.ICON should be removed
since there's no icon with that name.)

Once it's being loaded the API should be shown in the ZAP API UI.

Best regards.

On 19/09/16 09:01, Sivakumar Prakhash wrote:
> Hi,
>
> This mail continues the topic which I was discussing in "How to use
> zapClientAPI.callApi() in zaproxy to call a ZAP extension". I'm sending
> this in a new topic since I'm not able to post replies in that old
> thread( getting deleted)
>

> *Question*

> I think I'm missing any configurations in the Jira plugin in [1], I
> tried to list the APIs available using http://localhost:8500/UI, I
> couldn't find my API there. what are the changes I need to do in order
> to list the plugin as an API in ZAP ?
>
> Appreciate your help.
>
> [1] https://github.com/Prakhash/JiraIssuePlugin
>
> Thanks
>

> --
> You received this message because you are subscribed to the Google
> Groups "OWASP ZAP Developer Group" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to zaproxy-devel...@googlegroups.com
> <mailto:zaproxy-devel...@googlegroups.com>.
> To view this discussion on the web, visit
> https://groups.google.com/d/msgid/zaproxy-develop/e604013b-45e4-4b23-9579-fd8c9c3c4929%40googlegroups.com
> <https://groups.google.com/d/msgid/zaproxy-develop/e604013b-45e4-4b23-9579-fd8c9c3c4929%40googlegroups.com?utm_medium=email&utm_source=footer>.
> For more options, visit https://groups.google.com/d/optout.

[Sivakumar Prakhash]

Hi thc202,

Can you please point me out the plugin that I need to use when packaging the plugin with .zap extension

Thanks

> <mailto:zaproxy-develop+unsub...@googlegroups.com>.

[kingthorin+owaspzap]

You need to edit build.xml and add an ant task to deploy your plugin, look at the others for an example.

To run the ant task (assuming you're using Eclipse for development) open build.xml, find the deploy task you've added for your addon, right click the heading and select "Run As" "Ant Task"

[Sivakumar Prakhash]

Hi Kingthorin,

I have developed a maven based project :) please find my project in [1]. 

[1] https://github.com/Prakhash/JiraIssuePlugin

[kingthorin+owaspzap]

Thanks for the info, unfortunately all I can tell you is how current builds are done.

Perhaps looking at the existing ant build details [1][2] you can use the info to get your Maven build working as needed....<shrug>

[1] https://github.com/kingthorin/zap-extensions/blob/alpha/build/build.xml

[2] https://github.com/kingthorin/zap-extensions/blob/master/build/build.xml

[Sivakumar Prakhash]

Thanks for the information, anyhow we cannot use this in maven based project :(

is there is a similar way that I can follow in maven based projects?

Thanks

[thc...@gmail.com]

The generated artifact just needs to follow the previous naming scheme,
ZAP add-ons are just JARs with "zap" extension.

There's not much more to done other than renaming it.

(We don't have/provide any Maven plugin that helps with that.)

Best regards.

> --
> You received this message because you are subscribed to the Google
> Groups "OWASP ZAP Developer Group" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to zaproxy-devel...@googlegroups.com

> <mailto:zaproxy-devel...@googlegroups.com>.

> To view this discussion on the web, visit

> https://groups.google.com/d/msgid/zaproxy-develop/a27e38b2-21e1-40d2-96bf-b2f10d6f287d%40googlegroups.com
> <https://groups.google.com/d/msgid/zaproxy-develop/a27e38b2-21e1-40d2-96bf-b2f10d6f287d%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Sivakumar Prakhash]

Hi,

I'm getting the following exception when I try to install the add-on. I have created the package structure corrctly. What might be the possible issue for this ?

2016-09-20 15:29:47,987 [AWT-EventQueue-0] ERROR AddOnLoaderUtils - Declared "extension" was not found: org.zaproxy.zap.extension.zapwso2jiraplugin.JiraIssueCreatorExtension

java.lang.ClassNotFoundException

at org.zaproxy.zap.control.AddOnClassLoader.findClass(Unknown Source)

at java.lang.ClassLoader.loadClass(ClassLoader.java:424)

at java.lang.ClassLoader.loadClass(ClassLoader.java:357)

at org.zaproxy.zap.control.AddOnLoaderUtils.loadAndInstantiateClassImpl(Unknown Source)

at org.zaproxy.zap.control.AddOnLoaderUtils.loadAndInstantiateClass(Unknown Source)

at org.zaproxy.zap.control.AddOnLoader.loadAddOnExtension(Unknown Source)

at org.zaproxy.zap.control.AddOnLoader.loadAddOnExtensions(Unknown Source)

at org.zaproxy.zap.control.AddOnLoader.getExtensions(Unknown Source)

at org.zaproxy.zap.control.ExtensionFactory.loadAddOnExtensions(Unknown Source)

at org.zaproxy.zap.control.AddOnInstaller.installAddOnExtensions(Unknown Source)

at org.zaproxy.zap.control.AddOnInstaller.install(Unknown Source)

at org.zaproxy.zap.control.AddOnLoader.addAddOnImpl(Unknown Source)

at org.zaproxy.zap.control.AddOnLoader.addAddon(Unknown Source)

at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate.install(Unknown Source)

at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate.installLocalAddOn(Unknown Source)

at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate.installLocalAddOn(Unknown Source)

at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate.access$100(Unknown Source)

at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate$2.actionPerformed(Unknown Source)

at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:2022)

at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2348)

at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:402)

at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:259)

at javax.swing.AbstractButton.doClick(AbstractButton.java:376)

at javax.swing.plaf.basic.BasicMenuItemUI.doClick(BasicMenuItemUI.java:833)

at javax.swing.plaf.basic.BasicMenuItemUI$Handler.mouseReleased(BasicMenuItemUI.java:877)

at java.awt.Component.processMouseEvent(Component.java:6535)

at javax.swing.JComponent.processMouseEvent(JComponent.java:3324)

at java.awt.Component.processEvent(Component.java:6300)

at java.awt.Container.processEvent(Container.java:2236)

at java.awt.Component.dispatchEventImpl(Component.java:4891)

at java.awt.Container.dispatchEventImpl(Container.java:2294)

at java.awt.Component.dispatchEvent(Component.java:4713)

at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4888)

at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4525)

at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4466)

at java.awt.Container.dispatchEventImpl(Container.java:2280)

at java.awt.Window.dispatchEventImpl(Window.java:2750)

at java.awt.Component.dispatchEvent(Component.java:4713)

at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:758)

at java.awt.EventQueue.access$500(EventQueue.java:97)

at java.awt.EventQueue$3.run(EventQueue.java:709)

at java.awt.EventQueue$3.run(EventQueue.java:703)

at java.security.AccessController.doPrivileged(Native Method)

at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76)

at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86)

at java.awt.EventQueue$4.run(EventQueue.java:731)

at java.awt.EventQueue$4.run(EventQueue.java:729)

at java.security.AccessController.doPrivileged(Native Method)

at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:76)

at java.awt.EventQueue.dispatchEvent(EventQueue.java:728)

at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:201)

at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:116)

at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:105)

at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)

at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:93)

at java.awt.EventDispatchThread.run(EventDispatchThread.java:82)

[kingthorin+owaspzap]

Missing ZapAddOn.xml

[Sivakumar Prakhash]

ZapAddOn.xml is there in the project. [1] is this wrong ?

[1] https://github.com/Prakhash/JiraIssuePlugin/blob/master/src/main/resources/ZapAddOn.xml 

On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:

[psiinon]

Is it in the .zap file at the top level?

Cheers,

Simon

[psiinon]

And is the JiraIssueCreatorExtension class included in the jar?
Attaching your jar to this thread might make it easier for us to diagnose this problem...

[kingthorin+owaspzap]

Have a look at the structure of the existing addons, you seem to have things in the wrong locations.

Resources should be in the addon package directory. ZapAddOn.xml should be in the same location (not inside resources).

[Sivakumar Prakhash]

Hi Simon/Kingthorin,

Here I have attached the .zap file. Please review the file and point me out my mistakes

Thanks

On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:

[thc...@gmail.com]

Hi.

Which version of ZAP are you using to load the add-on?

The add-on file looks good and it loads fine in ZAP 2.5.0 (it shows up
in the Manage Add-ons dialogue).
The extension is not loaded but that might be caused by the missing
dependencies:
> 6665 [ZAP-BootstrapGUI] DEBUG org.zaproxy.zap.control.AddOnLoaderUtils -
> java.lang.reflect.InvocationTargetException
> at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
> at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
> at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
> at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
> at org.zaproxy.zap.control.AddOnLoaderUtils.loadAndInstantiateClassImpl(AddOnLoaderUtils.java:112)
> at org.zaproxy.zap.control.AddOnLoaderUtils.loadAndInstantiateClass(AddOnLoaderUtils.java:68)
> at org.zaproxy.zap.control.AddOnLoader.loadAddOnExtension(AddOnLoader.java:730)
> at org.zaproxy.zap.control.AddOnLoader.loadAddOnExtensions(AddOnLoader.java:720)
> at org.zaproxy.zap.control.AddOnLoader.getExtensions(AddOnLoader.java:686)
> at org.zaproxy.zap.control.AddOnLoader.getExtensions(AddOnLoader.java:658)
> at org.zaproxy.zap.control.ExtensionFactory.loadAllExtension(ExtensionFactory.java:93)
> at org.parosproxy.paros.control.Control.addExtension(Control.java:150)
> at org.parosproxy.paros.control.AbstractControl.loadExtension(AbstractControl.java:53)
> at org.parosproxy.paros.control.Control.init(Control.java:118)
> at org.parosproxy.paros.control.Control.initSingletonWithView(Control.java:293)
> at org.zaproxy.zap.GuiBootstrap.initControlAndPostViewInit(GuiBootstrap.java:235)
> at org.zaproxy.zap.GuiBootstrap.access$1(GuiBootstrap.java:234)
> at org.zaproxy.zap.GuiBootstrap$2.run(GuiBootstrap.java:179)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.lang.NoClassDefFoundError: org/apache/http/entity/mime/content/ContentBody
> at org.zaproxy.zap.extension.zapwso2jiraplugin.JiraIssueCreatorExtension.<init>(JiraIssueCreatorExtension.java:44)
> ... 19 more
> Caused by: java.lang.ClassNotFoundException
> at org.zaproxy.zap.control.AddOnClassLoader.findClass(AddOnClassLoader.java:213)

> at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
> at java.lang.ClassLoader.loadClass(ClassLoader.java:357)

> ... 20 more


I'd suggest trying with the artifact that contains the dependencies to
see if that's really the problem (it seems to be per previous stack trace).

Best regards.

On 21/09/16 14:22, Sivakumar Prakhash wrote:
> Hi Simon/Kingthorin,
>
> Here I have attached the .zap file. Please review the file and point me
> out my mistakes
>
> Thanks
>
> On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:
>
> Hi,
>
> This mail continues the topic which I was discussing in "How to use
> zapClientAPI.callApi() in zaproxy to call a ZAP extension". I'm
> sending this in a new topic since I'm not able to post replies in
> that old thread( getting deleted)
>

> *Question*

> I think I'm missing any configurations in the Jira plugin in [1], I
> tried to list the APIs available using http://localhost:8500/UI, I
> couldn't find my API there. what are the changes I need to do in
> order to list the plugin as an API in ZAP ?
>
> Appreciate your help.
>
> [1] https://github.com/Prakhash/JiraIssuePlugin

> <https://github.com/Prakhash/JiraIssuePlugin>
>
> Thanks

>
> --
> You received this message because you are subscribed to the Google
> Groups "OWASP ZAP Developer Group" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to zaproxy-devel...@googlegroups.com
> <mailto:zaproxy-devel...@googlegroups.com>.
> To view this discussion on the web, visit

> https://groups.google.com/d/msgid/zaproxy-develop/7ebf94e3-9597-4448-817d-b246ebfbbc49%40googlegroups.com
> <https://groups.google.com/d/msgid/zaproxy-develop/7ebf94e3-9597-4448-817d-b246ebfbbc49%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Sivakumar Prakhash]

Hi,

Yes, I'm using 2.5.0 version. I have added the artifact httpmime, still no luck. How to check the debug log here ? When I check the logs in zap.log file there were nothing reported

Thanks

On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:

[psiinon]

Theres a log4j.properties file in the ZAP working directory (https://github.com/zaproxy/zaproxy/wiki/FAQconfig)
By default it will look like this: https://github.com/zaproxy/zaproxy/blob/develop/src/xml/log4j.properties

You can change it to whatever you need, but I usually just change lines 16 and 17 to:

log4j.logger.org.parosproxy.paros=DEBUG
log4j.logger.org.zaproxy.zap=DEBUG

Restart ZAP and you'll get all of the debug messages :)

Cheers,

Simon

[Sivakumar Prakhash]

Hi Thc202,

I have added the artifacts, still, no luck :( How the plugin get displayed under http://localhost:8500/UI when we install that ?

I have attached the latest .zap file here

Thanks

On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:

[Sivakumar Prakhash]

I checked by trying remote debugging. It seems like, the add-on is loaded through ExtensionFactory during the starting time :(

Thanks

On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:

[thc...@gmail.com]

OK, that's expected, if there are no issues with the extension it should
be being loaded (the issues should be logged though).

Is the latest code available in your repo? Which steps are you doing
after building the artifacts? I'd like to give it a try.

Best regards.

On 23/09/16 05:43, Sivakumar Prakhash wrote:
> I checked by trying remote debugging. It seems like, the add-on is
> loaded through ExtensionFactory during the starting time :(
>
> Thanks
>
> On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:
>
> Hi,
>
> This mail continues the topic which I was discussing in "How to use
> zapClientAPI.callApi() in zaproxy to call a ZAP extension". I'm
> sending this in a new topic since I'm not able to post replies in
> that old thread( getting deleted)
>

> *Question*

> I think I'm missing any configurations in the Jira plugin in [1], I
> tried to list the APIs available using http://localhost:8500/UI, I
> couldn't find my API there. what are the changes I need to do in
> order to list the plugin as an API in ZAP ?
>
> Appreciate your help.
>
> [1] https://github.com/Prakhash/JiraIssuePlugin

> <https://github.com/Prakhash/JiraIssuePlugin>
>
> Thanks
>
> --
> You received this message because you are subscribed to the Google
> Groups "OWASP ZAP Developer Group" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to zaproxy-devel...@googlegroups.com
> <mailto:zaproxy-devel...@googlegroups.com>.
> To view this discussion on the web, visit

> https://groups.google.com/d/msgid/zaproxy-develop/23aef788-579c-4540-ab59-9c21d1d3af12%40googlegroups.com
> <https://groups.google.com/d/msgid/zaproxy-develop/23aef788-579c-4540-ab59-9c21d1d3af12%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Sivakumar Prakhash]

Hi all,

Thanks to all of you for the great help. I have done with it. Few functionalities are too specific in my add-on. I will make it as generic and share the code, then others too will be able to use this plugin.

It's great to be a part such a wonderful community :)

Thanks

On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:

[thc...@gmail.com]

Hi.

Great, thanks for letting us know!

The JIRA functionality could be incorporated into the bug tracker add-on.

Best regards.

On 26/09/16 08:44, Sivakumar Prakhash wrote:
> Hi all,
>
> Thanks to all of you for the great help. I have done with it. Few
> functionalities are too specific in my add-on. I will make it as generic
> and share the code, then others too will be able to use this plugin.
>
> It's great to be a part such a wonderful community :)
>
> Thanks
>
> On Monday, 19 September 2016 13:31:28 UTC+5:30, Sivakumar Prakhash wrote:
>
> Hi,
>
> This mail continues the topic which I was discussing in "How to use
> zapClientAPI.callApi() in zaproxy to call a ZAP extension". I'm
> sending this in a new topic since I'm not able to post replies in
> that old thread( getting deleted)
>

> *Question*

> I think I'm missing any configurations in the Jira plugin in [1], I
> tried to list the APIs available using http://localhost:8500/UI, I
> couldn't find my API there. what are the changes I need to do in
> order to list the plugin as an API in ZAP ?
>
> Appreciate your help.
>
> [1] https://github.com/Prakhash/JiraIssuePlugin

> <https://github.com/Prakhash/JiraIssuePlugin>
>
> Thanks
>
> --
> You received this message because you are subscribed to the Google
> Groups "OWASP ZAP Developer Group" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to zaproxy-devel...@googlegroups.com
> <mailto:zaproxy-devel...@googlegroups.com>.
> To view this discussion on the web, visit

> https://groups.google.com/d/msgid/zaproxy-develop/e17dda78-ca44-4493-ba51-17f58d5d7c87%40googlegroups.com
> <https://groups.google.com/d/msgid/zaproxy-develop/e17dda78-ca44-4493-ba51-17f58d5d7c87%40googlegroups.com?utm_medium=email&utm_source=footer>.