secureCodeBox · rfelber · May 23, 2021 · Apr 10, 2021 · Apr 10, 2021 · Apr 10, 2021
diff --git a/.editorconfig b/.editorconfig
@@ -18,8 +18,11 @@ indent_size = 2
 [*.go]
 indent_style = tab
 
+# 4 space indentation
 [*.py]
+indent_style = space
 indent_size = 4
 
+# Tab indentation (no size specified)
 [Makefile]
 indent_style = tab
diff --git a/.eslintignore b/.eslintignore
@@ -7,4 +7,5 @@
 hooks/declarative-subsequent-scans/hook.js
 hooks/declarative-subsequent-scans/scan-helpers.js
 hooks/declarative-subsequent-scans/kubernetes-label-selector.js
-**/build/reports/*
+scanners/zap-advanced/scanner/scripts/*
+**/build/reports/*
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        unit: ["git_repo_scanner"]
+        unit: ["git-repo-scanner", "zap-advanced"]
     steps:
       - name: Checkout
         uses: actions/checkout/@v2
@@ -58,13 +58,13 @@ jobs:
       - name: "Install dependencies"
         run: |
           python -m pip install --upgrade pip setuptools wheel
-          pip install -r scanners/git-repo-scanner/scanner/requirements.txt
+          pip install -r scanners/${{ matrix.unit }}/scanner/requirements.txt
 
       - name: "Execute Tests"
-        working-directory: scanners/git-repo-scanner/scanner/
+        working-directory: scanners/${{ matrix.unit }}/scanner/
         run: |
           pip install pytest
-          pytest
+          pytest --ignore-glob='*_local.py' --ignore=tests/docker
 
   # ---- Unit-Test | JavaScript ----
 
@@ -364,6 +364,7 @@ jobs:
           - kubeaudit
           - ncrack
           - nmap
+          - zap-advanced
     steps:
       - name: Checkout
         uses: actions/checkout@v2
@@ -652,13 +653,17 @@ jobs:
       - name: "Install Demo Apps"
         run: |
           # Install dummy-ssh app
-          helm -n demo-apps install dummy-ssh ./demo-apps/dummy-ssh/ --wait
+          helm -n demo-apps install dummy-ssh ./demo-apps/dummy-ssh/ --set="fullnameOverride=dummy-ssh" --wait
           # Install unsafe-https app
-          helm -n demo-apps install unsafe-https ./demo-apps/unsafe-https/ --wait
+          helm -n demo-apps install unsafe-https ./demo-apps/unsafe-https/ --set="fullnameOverride=unsafe-https" --wait
           # Install bodgeit app
-          helm -n demo-apps install bodgeit ./demo-apps/bodgeit/ --wait
+          helm -n demo-apps install bodgeit ./demo-apps/bodgeit/ --set="fullnameOverride=bodgeit" --wait
+          # Install bodgeit app
+          helm -n demo-apps install petstore ./demo-apps/swagger-petstore/ --set="fullnameOverride=petstore" --wait
           # Install old-wordpress app
-          helm -n demo-apps install old-wordpress ./demo-apps/old-wordpress/ --wait
+          helm -n demo-apps install old-wordpress ./demo-apps/old-wordpress/ --set="fullnameOverride=old-wordpress" --wait
+          # Install juiceshop app
+          helm -n demo-apps install juiceshop ./demo-apps/juice-shop/ --set="fullnameOverride=juiceshop" --wait
           # Install plain nginx server
           kubectl create deployment --image nginx:alpine nginx --namespace demo-apps
           kubectl expose deployment nginx --port 80 --namespace demo-apps
@@ -673,7 +678,7 @@ jobs:
             --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
           cd tests/integration/
           npx jest --ci --color scanner/amass.test.js
-      
+
       # ---- gitleaks Integration Tests ----
 
       - name: "gitleaks Integration Tests"
@@ -806,10 +811,9 @@ jobs:
           cd tests/integration/
           npx jest --ci --color scanner/wpscan.test.js
 
-
       # ---- Zap Integration Tests ----
 
-      - name: "zap Integration Tests"
+      - name: "ZAP Integration Tests"
         run: |
           kubectl -n integration-tests delete scans --all
           helm -n integration-tests install zap ./scanners/zap/  \
@@ -818,6 +822,22 @@ jobs:
           cd tests/integration/
           npx jest --ci --color scanner/zap.test.js
 
+      # ---- Zap Extended Integration Tests ----
+
+      - name: "ZAP Extended Integration Tests"
+        # disable zap extended test temporarily as they slow down the pipeline too much
+        if: ${{ false }}
+        run: |
+          kubectl -n integration-tests delete scans --all
+          helm -n integration-tests install zap-advanced ./scanners/zap-advanced/  \
+            --set="parseJob.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-zap" \
+            --set="parseJob.image.tag=sha-$(git rev-parse --short HEAD)" \
+            --set="scannerJob.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-zap-advanced" \
+            --set="scannerJob.image.tag=sha-$(git rev-parse --short HEAD)"
+          kubectl apply -f ./scanners/zap-advanced/examples/integration-tests/scantype-configMap.yaml -n integration-tests
+          cd tests/integration/
+          npx jest --ci --color scanner/zap-advanced.test.js
+
       # ---- Cascading Scans ncrack Integration Test ----
 
       - name: "cascading Scans ncrack Integration Tests"
@@ -896,14 +916,16 @@ jobs:
       - name: Inspect Post Failure
         if: failure()
         run: |
-          echo "HelmCharts in all namespaces"
+          echo "List all 'HelmCharts' in all namespaces"
           helm list --all-namespaces
-          echo "Scans in all namespaces"
+          echo "List all 'Scans' in all namespaces"
           kubectl -n integration-tests get scan -o wide --all-namespaces
-          echo "Jobs in all namespaces"
+          echo "List all 'Jobs' in all namespaces"
           kubectl -n integration-tests get jobs -o wide --all-namespaces
-          echo "Pods in all namespaces"
+          echo "List all 'Pods' in all namespaces"
           kubectl -n integration-tests get pods -o wide --all-namespaces
+          echo "List all 'Services' in all namespaces"
+          kubectl -n integration-tests get services -o wide --all-namespaces
 
       - name: "Inspect Operator"
         if: failure()

diff --git a/.gitignore b/.gitignore
@@ -4,9 +4,12 @@
 
 .DS_Store
 **/node_modules
-coverage/
+**/coverage/
+**/__pycache__
+**/.pytest_cache
+**/.asciinema
 .vagrant
-**.log
+**/*.log
 **/*.monopic
 .s3_credentials
 **/__pycache__

diff --git a/bin/add-license-header.sh b/bin/add-license-header.sh
@@ -21,6 +21,8 @@
 
 set -eu
 
+echo "Adding Header to all files..."
+
 FILES=""
 
 if [[ -p /dev/stdin ]]; then
@@ -30,9 +32,10 @@ else
 fi
 
 for file in $FILES; do
+    echo "Adding HEADER to file: $file"
     reuse addheader \
       --copyright "iteratec GmbH" \
-      --year 2020 \
+      --year 2021 \
       --license "Apache-2.0" \
       --skip-unrecognised \
       "$file"

diff --git a/docs/user-guide/README.md b/docs/user-guide/README.md
@@ -53,15 +53,15 @@ kubectl get CascadingRules
 Output should show these CascadingRules:
 
 ```bash
-NAME             STARTS         INVASIVENESS   INTENSIVENESS
-https-tls-scan   sslyze         non-invasive   light
-imaps-tls-scan   sslyze         non-invasive   light
-nikto-http       nikto          non-invasive   medium
-nmap-smb         nmap           non-invasive   light
-pop3s-tls-scan   sslyze         non-invasive   light
-smtps-tls-scan   sslyze         non-invasive   light
-ssh-scan         ssh-scan       non-invasive   light
-zap-http         zap-baseline   non-invasive   medium
+NAME             STARTS              INVASIVENESS   INTENSIVENESS
+https-tls-scan   sslyze              non-invasive   light
+imaps-tls-scan   sslyze              non-invasive   light
+nikto-http       nikto               non-invasive   medium
+nmap-smb         nmap                non-invasive   light
+pop3s-tls-scan   sslyze              non-invasive   light
+smtps-tls-scan   sslyze              non-invasive   light
+ssh-scan         ssh-scan            non-invasive   light
+zap-http         zap-baseline-scan   non-invasive   medium
 ```
 
 ### Start Scans
@@ -132,13 +132,13 @@ This selection can be replicated in kubectl using:
 
 ```bash
 kubectl get CascadingRules -l "securecodebox.io/intensive in (light,medium)"
-NAME             STARTS         INVASIVENESS   INTENSIVENESS
-https-tls-scan   sslyze         non-invasive   light
-imaps-tls-scan   sslyze         non-invasive   light
-nikto-http       nikto          non-invasive   medium
-nmap-smb         nmap           non-invasive   light
-pop3s-tls-scan   sslyze         non-invasive   light
-smtps-tls-scan   sslyze         non-invasive   light
-ssh-scan         ssh-scan       non-invasive   light
-zap-http         zap-baseline   non-invasive   medium
+NAME             STARTS              INVASIVENESS   INTENSIVENESS
+https-tls-scan   sslyze              non-invasive   light
+imaps-tls-scan   sslyze              non-invasive   light
+nikto-http       nikto               non-invasive   medium
+nmap-smb         nmap                non-invasive   light
+pop3s-tls-scan   sslyze              non-invasive   light
+smtps-tls-scan   sslyze              non-invasive   light
+ssh-scan         ssh-scan            non-invasive   light
+zap-http         zap-baseline-scan   non-invasive   medium
 ```
diff --git a/hooks/declarative-subsequent-scans/README.md b/hooks/declarative-subsequent-scans/README.md
@@ -31,15 +31,15 @@ There is a configuration option `cascadingRules.enabled` for each scanner to pre
 ```bash
 # Check your CascadingRules
 kubectl get CascadingRules
-NAME             STARTS         INVASIVENESS   INTENSIVENESS
-https-tls-scan   sslyze         non-invasive   light
-imaps-tls-scan   sslyze         non-invasive   light
-nikto-http       nikto          non-invasive   medium
-nmap-smb         nmap           non-invasive   light
-pop3s-tls-scan   sslyze         non-invasive   light
-smtps-tls-scan   sslyze         non-invasive   light
-ssh-scan         ssh-scan       non-invasive   light
-zap-http         zap-baseline   non-invasive   medium
+NAME             STARTS              INVASIVENESS   INTENSIVENESS
+https-tls-scan   sslyze              non-invasive   light
+imaps-tls-scan   sslyze              non-invasive   light
+nikto-http       nikto               non-invasive   medium
+nmap-smb         nmap                non-invasive   light
+pop3s-tls-scan   sslyze              non-invasive   light
+smtps-tls-scan   sslyze              non-invasive   light
+ssh-scan         ssh-scan            non-invasive   light
+zap-http         zap-baseline-scan   non-invasive   medium
 ```
 
 ## Starting a cascading Scan
@@ -105,15 +105,15 @@ This selection can be replicated in kubectl using:
 
 ```bash
 kubectl get CascadingRules -l "securecodebox.io/intensive in (light,medium)"
-NAME             STARTS         INVASIVENESS   INTENSIVENESS
-https-tls-scan   sslyze         non-invasive   light
-imaps-tls-scan   sslyze         non-invasive   light
-nikto-http       nikto          non-invasive   medium
-nmap-smb         nmap           non-invasive   light
-pop3s-tls-scan   sslyze         non-invasive   light
-smtps-tls-scan   sslyze         non-invasive   light
-ssh-scan         ssh-scan       non-invasive   light
-zap-http         zap-baseline   non-invasive   medium
+NAME             STARTS              INVASIVENESS   INTENSIVENESS
+https-tls-scan   sslyze              non-invasive   light
+imaps-tls-scan   sslyze              non-invasive   light
+nikto-http       nikto               non-invasive   medium
+nmap-smb         nmap                non-invasive   light
+pop3s-tls-scan   sslyze              non-invasive   light
+smtps-tls-scan   sslyze              non-invasive   light
+ssh-scan         ssh-scan            non-invasive   light
+zap-http         zap-baseline-scan   non-invasive   medium
 ```
 
 ## Chart Configuration

diff --git a/hooks/declarative-subsequent-scans/README.md.gotmpl b/hooks/declarative-subsequent-scans/README.md.gotmpl
@@ -35,15 +35,15 @@ There is a configuration option `cascadingRules.enabled` for each scanner to pre
 ```bash
 # Check your CascadingRules
 kubectl get CascadingRules
-NAME             STARTS         INVASIVENESS   INTENSIVENESS
-https-tls-scan   sslyze         non-invasive   light
-imaps-tls-scan   sslyze         non-invasive   light
-nikto-http       nikto          non-invasive   medium
-nmap-smb         nmap           non-invasive   light
-pop3s-tls-scan   sslyze         non-invasive   light
-smtps-tls-scan   sslyze         non-invasive   light
-ssh-scan         ssh-scan       non-invasive   light
-zap-http         zap-baseline   non-invasive   medium
+NAME             STARTS              INVASIVENESS   INTENSIVENESS
+https-tls-scan   sslyze              non-invasive   light
+imaps-tls-scan   sslyze              non-invasive   light
+nikto-http       nikto               non-invasive   medium
+nmap-smb         nmap                non-invasive   light
+pop3s-tls-scan   sslyze              non-invasive   light
+smtps-tls-scan   sslyze              non-invasive   light
+ssh-scan         ssh-scan            non-invasive   light
+zap-http         zap-baseline-scan   non-invasive   medium
 ```
 
 ## Starting a cascading Scan
@@ -109,15 +109,15 @@ This selection can be replicated in kubectl using:
 
 ```bash
 kubectl get CascadingRules -l "securecodebox.io/intensive in (light,medium)"
-NAME             STARTS         INVASIVENESS   INTENSIVENESS
-https-tls-scan   sslyze         non-invasive   light
-imaps-tls-scan   sslyze         non-invasive   light
-nikto-http       nikto          non-invasive   medium
-nmap-smb         nmap           non-invasive   light
-pop3s-tls-scan   sslyze         non-invasive   light
-smtps-tls-scan   sslyze         non-invasive   light
-ssh-scan         ssh-scan       non-invasive   light
-zap-http         zap-baseline   non-invasive   medium
+NAME             STARTS              INVASIVENESS   INTENSIVENESS
+https-tls-scan   sslyze              non-invasive   light
+imaps-tls-scan   sslyze              non-invasive   light
+nikto-http       nikto               non-invasive   medium
+nmap-smb         nmap                non-invasive   light
+pop3s-tls-scan   sslyze              non-invasive   light
+smtps-tls-scan   sslyze              non-invasive   light
+ssh-scan         ssh-scan            non-invasive   light
+zap-http         zap-baseline-scan   non-invasive   medium
 ```
 
 ## Chart Configuration

diff --git a/hooks/declarative-subsequent-scans/hook.test.js b/hooks/declarative-subsequent-scans/hook.test.js
@@ -56,7 +56,7 @@ beforeEach(() => {
   ];
 });
 
-test("should create subsequent scans for open HTTPS ports (NMAP findings)", () => {
+test("Should create subsequent scans for open HTTPS ports (NMAP findings)", () => {
   const findings = [
     {
       name: "Port 443 is open",
@@ -114,7 +114,7 @@ test("Should create no subsequent scans if there are no rules", () => {
   expect(cascadedScans).toMatchInlineSnapshot(`Array []`);
 });
 
-test("should not try to do magic to the scan name if its something random", () => {
+test("Should not try to do magic to the scan name if its something random", () => {
   parentScan.metadata.name = "foobar.com";
 
   const findings = [
@@ -154,7 +154,7 @@ test("should not try to do magic to the scan name if its something random", () =
   `);
 });
 
-test("should not start scan when the cascadingrule for it is already in the chain", () => {
+test("Should not start a new scan when the corresponding cascadingRule is already in the chain", () => {
   parentScan.metadata.annotations["cascading.securecodebox.io/chain"] =
     sslyzeCascadingRules[0].metadata.name;
 
@@ -180,7 +180,7 @@ test("should not start scan when the cascadingrule for it is already in the chai
   expect(cascadedScans).toMatchInlineSnapshot(`Array []`);
 });
 
-test("should not crash when the annotations are not set", () => {
+test("Should not crash when the annotations are not set", () => {
   parentScan.metadata.annotations = undefined;
 
   const findings = [
@@ -219,7 +219,7 @@ test("should not crash when the annotations are not set", () => {
   `);
 });
 
-test("should add env fields from cascading rule to created scan", () => {
+test("Should copy ENV fields from cascadingRule to created scan", () => {
   sslyzeCascadingRules[0].spec.scanSpec.env = [
     {
       name: "FOOBAR",
@@ -273,7 +273,7 @@ test("should add env fields from cascading rule to created scan", () => {
   `);
 });
 
-test("should allow wildcards in cascading rules", () => {
+test("Should allow wildcards in cascadingRules", () => {
   sslyzeCascadingRules = [
     {
       apiVersion: "cascading.securecodebox.io/v1",

diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md
@@ -134,5 +134,6 @@ helm upgrade --install dd secureCodeBox/persistence-defectdojo \
 | defectdojo.authentication.usernameKey | string | `"username"` | Name of the username key in the `userSecret` secret. Use this if you already have a secret with different key / value pairs |
 | defectdojo.syncFindingsBack | bool | `true` | Syncs back (two way sync) all imported findings from DefectDojo to SCB Findings Store, set to false to only import the findings to DefectDojo (one way sync). |
 | defectdojo.url | string | `"http://defectdojo-django.default.svc"` | Url to the DefectDojo Instance |
+| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
 | image.repository | string | `"docker.io/securecodebox/persistence-defectdojo"` | Hook image repository |
 | image.tag | string | `nil` | Container image tag |