Add support for REST API scans to DAST
Problem to solve
REST APIs cannot be scanned by DAST.
Further details
At the moment, DAST can only scan web apps. The underlying tool, however, also supports scanning of REST/SOAP APIs https://zaproxy.blogspot.com/2017/06/scanning-apis-with-zap.html. It would be easy to support this functionality also in our DAST image, since the API scanning is invoked very similar to the baseline scan that we are currently doing https://gitlab.com/gitlab-org/security-products/dast/blob/master/analyze#L35
Proposal
Add support for API scanning to https://gitlab.com/gitlab-org/security-products/dast/
Implementation plan
-
Use zap-api-scan.py
similar tozap-baseline.py
andzap-full-scan.py
to achieve a ZAP API scan. Support new cli option-f
envDAST_API_FORMAT
:format should be openapi or soap
-
Support baseline and a full scan, using the normal DAST parameters. Baseline should be the default. -
Support new cli option -O
envDAST_API_HOST_OVERRIDE
:the hostname to override in the (remote) OpenAPI spec
. -
All options should be supported, except -J
and--hook
. -
Add tests to ensure OpenAPIv2 format is supported. -
Add tests to ensure OpenAPIv3 format is supported. -
Add tests to ensure a SOAP WSDL services are supportedhttps://github.com/zaproxy/zaproxy/issues/4866 -
Investigate options for authentication. -
Document how users can use this. -
Record a demo to show people how it works. -
JSON or YAML should be able to be used for OpenAPIv2 -
Verify that the specification defined locally or in a URL -
Investigate domain rewriting -
Add a test for the legacy API -
Verify other DAST features (e.g. exclude URL) work when using an API scan -
Add an environment variable to exclude rules (required for tests). Document this for users, and link to the rule IDs. -
Print out URLs that were scanned by the API scan, add them to scanned_resources
in the JSON output -
Verify Domain validation, document if it does not work. -
Document that excluded URLs do not work. -
Add DAST_REQUEST_HEADERS
to DAST -
Add an issue for supporting excluded URLs #211892 (closed) -
Add an issue for supporting Domain validation on Full Scans #211893 (closed) -
Add an issue for supporting Hostname override on imported specifications from file #211894 (closed)
Post-issue clean up
-
test/end-to-end/fixtures/open-api-v2
should be renamed totest/end-to-end/fixtures/rest-api
-
Rename SpideredMessages
toScannedResources
Estimate
This will likely take most of the iteration, largely because of the testing. Giving it a 5
.
Edited by Cameron Swords