Accessing the environment variable defined in automation yaml from scripts

[4ourth]

Hi,

I am trying to access environment variables defined in the automation yaml file. 

It's working when I am referring them in the same yaml, but how access them in my custom scripts? Are the variables defined in automation vars: section accessible in scripts and how to do it?

I have tried 

# var System = Java.type("java.lang.System");
# print(System.getenv("PROJECT_NAME"))

but it's not working.

Just referring to it with ScriptVars.getGlobalVar("PROJECT_NAME") also not working.

Could you suggest any solution?

Thank you!

[psiinon]

Your first attempt should work:

var System = Java.type("java.lang.System");

print(System.getenv("PROJECT_NaME"));

Global script vars do not access the sytem env vars.

How are you setting the env vars when you run ZAP?

Cheers,

Simon

--
You received this message because you are subscribed to the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/97741cbf-b4ce-4597-b3d5-93d70711184bn%40googlegroups.com.

--

OWASP ZAP Project leader

[4ourth]

I am running ZAP in docker and using -e ZAP_PROJECT_NAME="MyNewProject" to set an environment variable. So now I am able to get it by var System = Java.type("java.lang.System") in my script.

But now it's not working in Automation yaml file.

vars:

PROJECT_NAME: ${ZAP_PROJECT_NAME}

REPORT_PATH: "/zap/wrk"

SCRIPT_PATH: "/zap/wrk"

It's generating as a report name something like zap-report_${ZAP_PROJECT_NAME}__2023-06-27.json

Looks like I can use environment variables in scripts, but not in Automation yaml. And in scripts, I do not have access to environment vars defined in automation yaml. Is it right?

[4ourth]

ok, so looks like I can use environment variables directly in automation yaml, without previously redeclaring them in 'vars' section.

But then there is a question. From help : "They can be hardcoded, refer to other variables or refer to system environment variables in the same way as above, e.g. ‘${envvar}’. "

------- Example from help -------

vars:                              
    myVarOne: CustomConfigVarOne
    myVarTwo: ${myVarOne}.VarTwo

------
but in my example, it's not working.

[psiinon]

Can you share a PoC AF plan?

You can use inline scripts to print out the variables (or not as the case may be)

https://www.zaproxy.org/docs/desktop/addons/script-console/automation/

A simple way to reproduce the problem is what we are looking for :)

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/43dd3943-ed6a-42ef-86cc-f2e58329f871n%40googlegroups.com.

[4ourth]

Thank you for your advice, Simon. Using inline scripts really useful. I am generating a report file to understand if the variable is working or not:))

Here is my AF plan:

---
env:
  contexts:
  - name: "${ZAP_PROJECT_NAME}-${ZAP_PROJECT_COUNTRY}-${ZAP_PROJECT_ENV}"
    urls:
    - "http://invoice.test.com"
    includePaths:
    - "http[s]?://invoice.test.com/.*"
    excludePaths: []
    authentication:
      parameters: {}
      verification:
        method: "response"
        pollFrequency: 60
        pollUnits: "requests"
    sessionManagement:
      method: "cookie"
      parameters: {}
    technology:
      exclude: []
    users:
    - credentials:
        password: "1234"
        username: "admin"
  parameters:
    failOnError: false
    failOnWarning: false
    progressToStdout: true
  vars:
    PROJECT_NAME: ${ZAP_PROJECT_NAME}
    PROJECT_COUNTRY: ${ZAP_PROJECT_COUNTRY}
    PROJECT_ENV: '${ZAP_PROJECT_ENV}'
    REPORT_PATH: "/zap/wrk"
    SCRIPT_PATH: "/zap/wrk"
jobs:
- parameters:
    action: "add"
    type: "standalone"
    engine: "ECMAScript : Oracle Nashorn"
    name: "send_scan_start_teams_notification.js"
    file: "${SCRIPT_PATH}/scripts/send_scan_start_teams_notification.js"
    target: ""
    inline: ""
  name: "script"
  type: "script"
- parameters:
    action: "run"
    type: "standalone"
    engine: ""
    name: "send_scan_start_teams_notification.js"
    target: ""
    inline: ""
  name: "script"
  type: "script"
- parameters:
    action: "add"
    type: "extender"
    engine: "ECMAScript : Oracle Nashorn"
    name: "send_alerts_found_teams_notification.js"
    file: "${SCRIPT_PATH}/scripts/send_alerts_found_teams_notification.js"
    target: ""
    inline: ""
  name: "script"
  type: "script"
- parameters:
    scanOnlyInScope: true
    enableTags: false
    disableAllRules: false
  rules: []
  name: "passiveScan-config"
  type: "passiveScan-config"
- parameters:
    context:
    maxDuration: 0
    maxDepth: 0
    maxChildren: 0
    acceptCookies: false
    handleODataParametersVisited: false
    handleParameters: "IGNORE_COMPLETELY"
    maxParseSizeBytes: 3000000
    parseComments: false
    parseGit: false
    parseRobotsTxt: false
    parseSitemapXml: false
    parseSVNEntries: false
    postForm: false
    processForm: false
    requestWaitTime: 0
    sendRefererHeader: false
    userAgent: ""
  tests:
  - onFail: "INFO"
    statistic: "automation.spider.urls.added"
    site: ""
    operator: ">="
    value: 100
    type: "stats"
    name: "At least 100 URLs found"
  name: "spider"
  type: "spider"
- parameters: {}
  name: "passiveScan-wait"
  type: "passiveScan-wait"
- parameters:
    template: "traditional-json"
    reportDir: "${REPORT_PATH}/reports"
    reportFile: "zap-report_${ZAP_PROJECT_NAME}-${ZAP_PROJECT_COUNTRY}-${ZAP_PROJECT_ENV}__{{yyyy-MM-dd}}"
    reportTitle: "${ZAP_PROJECT_NAME}-${ZAP_PROJECT_COUNTRY}-${ZAP_PROJECT_ENV} - ZAP Scanning Report"
    reportDescription: ""
    displayReport: false
  risks:
  - "low"
  - "medium"
  - "high"
  confidences:
  - "low"
  - "medium"
  - "high"
  - "confirmed"
  name: "report"
  type: "report"


When I am using PROJECT_NAME from the [vars] section in the [reportFile] file field, it puts exactly "${ZAP_PROJECT_NAME}" value, but not the value of the defined with -e parameter environment variable. Although, when I am using directly ${ZAP_PROJECT_NAME} environment variable it works.

[4ourth]

Actually, you gave me an idea! I can define variables in AF plan [vars] field, then using inline script set a global variable (with ScriptVars.setGlobalVar()) and then get and use it in other scripts by ScriptVars.getGlobalVar() function.
The idea is to define only AF plan for each environment and project and then run the same zap scan command and same scripts only replacing AF plan file, this way scripts will be able to get variables from AF plan and use them for example to send notifications about what project is scanning now.

[4ourth]

I have tried, but it's also not working as expected. Looks like the script can't access the variable declared in [vars] section

<-- SNIP -->

vars:

PROJECT_NAME: ${ZAP_PROJECT_NAME}

REPORT_PATH: "/zap/wrk"

SCRIPT_PATH: "/zap/wrk"

jobs:

- parameters:

action: "add"

type: "standalone"

engine: "ECMAScript : Graal.js"

name: "inline-print-scan-info"

inline: |

print("====================> This is a simple example")

print(${REPORT_PATH})

name: "script"

type: "script"

- parameters:

action: "run"

type: "standalone"

name: "inline-print-scan-info"

name: "script"

type: "script"

And result in console:

Job script started

Job: script Start action: run

org.graalvm.polyglot.PolyglotException: SyntaxError: inline-print-scan-info:2:7 Expected , but found {

print(${REPORT_PATH})

       ^

inline-print-scan-info:2:20 Expected ; but found )

print(${REPORT_PATH})

                    ^

[psiinon]

The ${VAR} format only works in yaml parameters, not in scripts.

If you want to use a param in a script the best option is to use an env var, eg:

---
env:
  contexts:
  - name: "Default Context"
    urls:
    - "https://example.com/"

jobs:
- parameters:
    action: "add"
    type: "standalone"
    engine: "ECMAScript : Graal.js"

    name: "print-env-vars.js"
    inline: "print(Java.type(\"java.lang.System\").getenv(\"PATH\"));"

  name: "script"
  type: "script"
- parameters:
    action: "run"
    type: "standalone"

    name: "print-env-vars.js"
  name: "script"
  type: "script"

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/eebd848d-a4a2-40bd-a237-a504f8d5bc5bn%40googlegroups.com.

[4ourth]

Thank you very much, Simon.

Yes, with the environment variables it's working well. As I understand, variables declared in AF plan are not available from scripts. 

[psiinon]

They are available, depending on the scripting language.

Unfortunatly Graal.js doesnt support them due to the way its class loaders work.

We're actively looking into solutuions to this, but for now using env vars in scripts is probably the easiest option.

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/a63411b2-edb3-4596-b1d4-03307250652en%40googlegroups.com.

[4ourth]

Thank you, Simon

Will wait for updates. I have already implemented it on the env var level:)