Rate limits in baseline scan GitHub action

[Alexander García Fernández]

Hi all!!

I'm trying to configure the baseline scan GitHub action, but I don't see any option to rate limit the requests.

The web application that I'm trying to scan, have some rate limits configured. When I've done some tests with ZAP Desktop application, I've seen the web application start to reject requests due to the rate limits. I've used the Network -> Reate Limit option to solve this problem and scan the entire web application.

But now, I want to do the same with the baseline scan GitHub action, but I don't see any option to configure reate limits. Am I missing something? Is there an option to configure the rate limits?

Thank you,

Best regards

[Alexander García Fernández]

No one has implemented rate limits on github action for baseline scan?

[Simon Bennetts]

You should be able to set this via a config option: https://www.zaproxy.org/faq/how-do-you-find-out-what-key-to-use-to-set-a-config-value-on-the-command-line/

Cheers,

Simon

[Alexander García Fernández]

Thanks Simon for the help. 

It seems that baseline scan action don't accepts -configfile option. I am getting the following error:

The command that I'm using is the following:

cmd_options: '-n infrastructure/security/zap/context-file.context -configfile infrastructure/security/zap/configfile'

It is like that is not using my configfile.

Any thoughts?

Thank you,

Best regards

[Simon Bennetts]

Its difficult to tell without knowing the full options you are specifying to ZAP.

The baseline scan expects a /zap/wrk/ directory to be mounted if you supply command line args, and will look in there first for those files.

Can you mount a directory with your config files to /zap/wrk ?

If so then just specify the filenames rather than adding any paths.

Cheers,

Simon

[Alexander García Fernández]

Hi,

I solved the problem sending the parameters in the cmd_options in the workflow, without config file:

cmd_options:

'-j -U "username" -n infrastructure/security/zap/context.context -z "-config ratelimit.rules.rule.description=example.com \

-config ratelimit.rules.rule.enabled=true \

-config ratelimit.rules.rule.matchStr=example.com \

-config ratelimit.rules.rule.regex=false \

-config ratelimit.rules.rule.reqsPerSec=3 \

-config ratelimit.rules.rule.groupBy=HOST \

-config scanner.hostPerScan=1 \

-config scanner.threadPerHost=1 \

-config scanner.delayInMs=0 \

-config scanner.maxResults=1000"'

Thanks for your help

Regards