ZAP Automation Framework - Fail on Severity for High

[Nar Di (Nar)]

Hi 

I'm currently using the Zap Automation Framework using the zap.sh command autorun and then referring to a yaml config file to run the scan, along with it is the context where we declare what are the target scope included and excluded, pass a request header and body and do passive scan, spider and active scan.

However we just got a directive that we must fail the git job when there is a High Severity on the scan report

  

I just like to ask, if is there a way to do this on our current setup. Below is my script

 

zap.sh -cmd -autorun /zap/wrk/testconfig.yaml

Thank in advance

[Nar Di (Nar)]

I'm using html as a report format btw :)

[Nar Di (Nar)]

Hi 

Hope someone could share some recommendations :)

TIA

[thc...@gmail.com]

Hi.

You would have to raise an error or warn to affect the exit code:
https://www.zaproxy.org/docs/desktop/addons/automation-framework/

You can do that with Alert Job Test, if you are targeting specific alerts.
https://www.zaproxy.org/docs/desktop/addons/automation-framework/test-alert/

Otherwise you would have to use other means to do that (e.g. standalone
a script that checks the alerts raised).

Best regards.

[Nar Di (Nar)]

Thanks thc202, however the requirement is to fail the build if there is a High vulnerability identified and if non let it succeed the build

Currently doing script that will check the report file generated to see if there are Highs

[psiinon]

Feel free to share the script here - other people may well find it useful :)

Cheers,

Simon

--
You received this message because you are subscribed to the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/bdf0c314-6522-481e-9396-4eb552dc4a24n%40googlegroups.com.

--

OWASP ZAP Project leader

[Nar Di (Nar)]

we'll share 

basically the script just grep and sed the report file if the table that has high contains 0 or more than, if more than 0 then fail the build

My conditional statement on the git does not accept if the report contains HIGH, which is exit 1 for with HIGH and exit 0 for no High

Not sure what if the exit code is being validate by the CI or because its conflicting with the exit code output from owasp zap cmd