@@ -24,3 +24,39 @@ link to view the running process at CircleCI
24244 . Click the ` owasp_report.html ` link to view the report.
2525
2626![ image] ( images/report.png )
27+
28+ ### Configuring Report Output
29+
30+ We use separate files for configuring the ZAP scanner for the front and back end applications
31+ Backend: [ tdrs-backend/reports/zap.conf] ( ../../tdrs-backend/reports/zap.conf )
32+ Frontend: [ tdrs-frontend/reports/zap.conf] ( ../../tdrs-frontend/reports/zap.conf )
33+
34+ These files have a list of error codes and what to do with them. We have some of these set
35+ to IGNORE because they do not apply to our configuration but were returning false positives
36+ for test failures. For each of these, we should have a comment as to why the test is being
37+ ignored.
38+
39+ Can use Postman to mimic the test parameters before ignoring to verify
40+ The [ free version of Postman] ( https://www.postman.com/downloads/ ) , the app or web version, can be used for this.
41+ examples:
42+ ![ image] ( images/postman_example1.png )
43+ ![ image] ( images/postman_example2.png )
44+
45+ ### Invoking the OWASP Zap Scanner
46+
47+ We build out how we invoke the zap scanner using our [ zap-scanner] ( ../../scripts/zap-scanner.sh ) script.
48+
49+ As part of that, we pass some additional configuration that includes a list of urls to exclude from the
50+ scan.
51+ ` ZAP_CLI_OPTIONS ` contains this list.
52+ It is important to note, not to include the frontend or backend endpoint we want to test the scanner out
53+ on.
54+
55+ e.g. do not include something like this in the ` -config globalexcludeurl.url_list.url ` configuration options:
56+ ```
57+ -config globalexcludeurl.url_list.url\(3\).regex='^https?://.*\.hhs.gov\/.*$' \
58+ -config globalexcludeurl.url_list.url\(3\).description='Site - acf.hhs.gov' \
59+ -config globalexcludeurl.url_list.url\(3\).enabled=true \
60+ ```
61+
62+ It will not be able to find the endpoint for the tests and the output is confusing as to what is happening.
0 commit comments