ZAP docker returned org.hsqldb.HsqlException: Database lock acquisition failure: lockFile: org.hsqld

[Aida Ahmad]

Hi, 

I am running the zap-cli inside docker :

$ docker run -it -v $(pwd)/zap/contexts:/zapcontext -v $(pwd)/zap/sessions:/zapsession owasp/zap2docker-stable bash

and the following is the step of commands that I executed :  

1. $ zap-cli start --start-options '-config api.disablekey=true'

2. $ zap-cli session new

3. $ zap-cli session load /zapsession/project1/project1.session 

4. $ zap-cli context import /zapcontext/project1.context

5. $ zap-cli active-scan --recursive -c project1 -u RegUser https://project1.com

In the console, the following error is returned : 

[ERROR]Error running active scan: "URL Not Found in the Scan Tree". Make sure the URL is in the site tree by using the open-url or scanner commands before running an active scan.

And I checked the zap.log file, the following error is returned : 

org.hsqldb.HsqlException: Database lock acquisition failure: lockFile: org.hsqldb.persist.LockFile@d02cc887[file =/zapsession/project1.session.lck, exists=false, locked=false, valid=false, ] method: openRAF reason: java.io.FileNotFoundException: /zapsession/project1.session.lck (Permission denied)

Is anyone ever faced the same problem? Can you guys help me how to solve this ? 

Thank you. 

[psi...@gmail.com]

zap-cli is a 3rd party tool that is no longer maintained.

You'd be better off using scripts to directly control the ZAP API.

Can you explain what you're trying to do?

This script that already in the docker containers might do the job: https://github.com/zaproxy/zaproxy/wiki/ZAP-Full-Scan

Cheers,

Simon

[psi...@gmail.com]

Arg - my bad - someone just pointed out that zap-cli _is_ still maintained (I was thinking about zapr;)

But the packaged scripts might still be a good option for you :)

[kingthorin+owaspzap]

Why do you start a new session and then immediately try to load a saved session?

[Aida Ahmad]

Hi Simon, 

1. When I started the docker, I have to mount the context and the saved session into the container to run the ZAP scan as a registered user later. 

2. I am loading the session file as all the URLs that need to be scanned are in that session file. That is step #2. 

3. I am importing the context in step #3 as I stored the credentials in that context which will be used in the authentication script. 

4. The run was successful in my machine but the above error produced when I run it in Jenkins. 

Not sure what I am missing here. 

[Aida Ahmad]

Hi kingthorin+owaspzap, 

I was trying to make sure the ZAP is clean before loading the saved session. 

[venkata.su...@associates.scit.edu]

Hello, 

I know it is late but add 

RUN chmod +R 777 /your directory in your docker file

It is a permissions error