ZAP Automation Framework in AzurePipelines

[Sergio Rueda]

Hi everyone,

I'm trying to replace the apiURL variable of the Yaml file to a variable defined in my pipeline but always identify as null how can I modify this?

because I have multiple api so I don't want to create multiple yaml files to scan multiples apiurls

[Simon Bennetts]

The variable need to be set as environmental variable.

Cheers,

Simon

[Sergio Rueda]

do you have an example? I'm trying to set but I don't know how to call it in the yaml file.

[Simon Bennetts]

Something like this?

https://learn.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch#environment-variables

[Sergio Rueda]

yes I understand it

but I'm using in a task like this:

docker run  --rm -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap.sh -cmd -autorun /zap/wrk/"$($Env:SYSTEM_DEFAULTWORKINGDIRECTORY)/testsec/drop/zap.yml"

I need to call the variable to the zap.yml but never the automation framework read it.

so what could I do or use?

Regards,

[Simon Bennetts]

So in this case you want to use the SYSTEM_DEFAULTWORKINGDIRECTORY env var as per your command?

In this case ZAP (and the AF) will not even get to see it - it will have been handled (or not, as the case may be) before ZAP gets invoked.

I think the problem you are seeing it just related to the commandline and not ZAP.

You can test it by trying commands like:

• docker run  --rm -t owasp/zap2docker-stable echo "$($Env:SYSTEM_DEFAULTWORKINGDIRECTORY)"

If you work out the right incantation to get the standard "echo" command to print out the right value then you can use the same format in your ZAP invocation.

Cheers,

Simon

[Sergio Rueda]

Thanks Simon,

I erase it and the command is executing perfectly

docker run  --rm -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap.sh -cmd -autorun /zap/wrk/testsec/drop/zap.yml

but the mainly question is how to pass the variable  of apiurl store on AzureDevOps to the yaml file that is in another repo different from ADO.

I set to a S.O environment variable but wasn't reading it for the automation framework or how to pass it to the docker image in order that docker could read it

[Sergio Rueda]

Hi everyone,

I solved it, using a env variable of docker.

[Simon Bennetts]

thanks for letting us know!