Zest Script Automation

[Declan McLeman]

Hi Simon and your diligent team,

One last question from me — in the automation plan, I’ve integrated a Zest script that contains a request which fails due to an incorrect assertion. However, the automation plan still marks the script as successful.

Is there a way to configure the automation plan to capture or reflect all failed responses within the Zest script?

Regards,

Declan

[James L]

Hi  Declan, 

I'm not a part of the zap team but am a community member/daily user of zap.. This might be useful if  I am understanding your question correctly. https://www.zaproxy.org/docs/desktop/addons/automation-framework/#exit-codes and https://www.zaproxy.org/docs/desktop/addons/automation-framework/job-exitstatus/

Hope this helps...

-James

[declan....@gmail.com]

Hi,

 

Thanks for sending those along. However, the documents seem to indicate that they are not currently integrated with scripts.

 

Regards,

Declan

--
ZAP by Checkmarx: https://www.zaproxy.org/
---
You received this message because you are subscribed to a topic in the Google Groups "ZAP User Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-users/UjlriTpeyKE/unsubscribe.
To unsubscribe from this group and all its topics, send an email to zaproxy-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/zaproxy-users/27cf43cb-132c-4a7f-8871-a0bd686d84c1n%40googlegroups.com.

[Simon Bennetts]

Hi Declan,

Working out whether authentication has actually worked can be tricky as there are so many things that could potentially go wrong.

We're reliant on people like yourselves pointing out potential problems :)

In this case is it a Zest authentication script?

It is client or server side?

The more details you can share the better.

Cheers,

Simon

[declan....@gmail.com]

Hi Simon,

 

Sorry, there seems to be a bit of a misunderstanding. We are using the zest scripts to confirm if the authentication is properly adhered to on the portal by calling all the endpoints on it. Some of these endpoints require dynamic values (object ids that are not known prior to starting the process) and we have found that zest scripts can be used to call these endpoints. However, the assertion fails that are correctly occurring are not being passed back to the automation plan, and it passes the zest script as being done. Is there a way for the automation plan to record all the incidents of assertion fails so that multiple zest scripts can be piped together for an effective CI/CD integration?

 

Regards,

Declan

To view this discussion visit https://groups.google.com/d/msgid/zaproxy-users/298bb601-79ef-49d7-957e-bca7e0dc2ac5n%40googlegroups.com.

[Simon Bennetts]

Hi Declan,

More info please :D

What sort of scripts are you using?

Are they standalone ones or??

Presumably you are running these via the script job?

A simple cut down example plan and script would definitely help.

Cheers,

Simon

[declan....@gmail.com]

Hi Simon,

 

Yes, they are standalone scripts with a collection of requests that have status assertions on them.

Currently they need to be run manually in order to determine the result of the test, but ideally these tests should be run via the script job so that multiple can be run.

To view this discussion visit https://groups.google.com/d/msgid/zaproxy-users/ab5fbab2-7419-47c6-a63c-c9e675d5f941n%40googlegroups.com.

[Simon Bennetts]

Hi Declan,

Makes sense.

I've raised this issue for it https://github.com/zaproxy/zaproxy/issues/9140

If you follow it then you will get updated whn its worked on.

Also feel free to add more comments :)

Cheers,

Simon