Skip to content

Commit 0483978

Browse files
ricekotricekot
committed
ascanrulesAlpha: Add Suspicious Input Transformation Script
Signed-off-by: ricekot <[email protected]>
1 parent 22a1c7c commit 0483978

File tree

11 files changed

+881
-17
lines changed

11 files changed

+881
-17
lines changed

‎addOns/ascanrulesAlpha/CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ All notable changes to this add-on will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
55

66
## Unreleased
7-
7+
### Added
8+
- Suspicious Input Transformation Script Scan Rule.
89

910
## [51] - 2025-09-18
1011
### Changed

‎addOns/ascanrulesAlpha/ascanrulesAlpha.gradle.kts‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,20 @@ zapAddOn {
1414
}
1515
}
1616
}
17+
18+
extensions {
19+
register("org.zaproxy.zap.extension.ascanrulesAlpha.scripts.ExtensionAscanRulesAlphaScripts") {
20+
classnames {
21+
allowed.set(listOf("org.zaproxy.zap.extension.ascanrulesAlpha.scripts"))
22+
}
23+
dependencies {
24+
addOns {
25+
register("scripts")
26+
register("graaljs")
27+
}
28+
}
29+
}
30+
}
1731
}
1832
}
1933

@@ -25,4 +39,7 @@ dependencies {
2539
zapAddOn("commonlib")
2640

2741
testImplementation(project(":testutils"))
42+
testImplementation(project(":addOns:graaljs"))
43+
testImplementation(project(":addOns:scripts"))
44+
testImplementation(parent!!.childProjects.get("graaljs")!!.sourceSets.test.get().output)
2845
}

‎addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/scripts/ExtensionAscanRulesAlphaScripts.java‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
/*
2+
* Zed Attack Proxy (ZAP) and its related class files.
3+
*
4+
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
5+
*
6+
* Copyright 2025 The ZAP Development Team
7+
*
8+
* Licensed under the Apache License, Version 2.0 (the "License");
9+
* you may not use this file except in compliance with the License.
10+
* You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package org.zaproxy.zap.extension.ascanrulesAlpha.scripts;
21+
22+
import java.io.File;
23+
import java.nio.file.Paths;
24+
import java.util.List;
25+
import org.apache.logging.log4j.LogManager;
26+
import org.apache.logging.log4j.Logger;
27+
import org.parosproxy.paros.Constant;
28+
import org.parosproxy.paros.extension.Extension;
29+
import org.parosproxy.paros.extension.ExtensionAdaptor;
30+
import org.zaproxy.zap.extension.ascan.ExtensionActiveScan;
31+
import org.zaproxy.zap.extension.script.ExtensionScript;
32+
import org.zaproxy.zap.extension.script.ScriptEngineWrapper;
33+
import org.zaproxy.zap.extension.script.ScriptType;
34+
import org.zaproxy.zap.extension.script.ScriptWrapper;
35+
36+
public class ExtensionAscanRulesAlphaScripts extends ExtensionAdaptor {
37+
38+
private static final List<Class<? extends Extension>> DEPENDENCIES =
39+
List.of(ExtensionActiveScan.class, ExtensionScript.class);
40+
private static final Logger LOGGER =
41+
LogManager.getLogger(ExtensionAscanRulesAlphaScripts.class);
42+
private static final String SCRIPT_SUSPICIOUS_INPUT_TRANSFORMATION =
43+
"SuspiciousInputTransformation.js";
44+
45+
private ExtensionScript extScript;
46+
47+
@Override
48+
public String getName() {
49+
return ExtensionAscanRulesAlphaScripts.class.getSimpleName();
50+
}
51+
52+
@Override
53+
public String getUIName() {
54+
return Constant.messages.getString("ascanalpha.scripts.name");
55+
}
56+
57+
@Override
58+
public String getDescription() {
59+
return Constant.messages.getString("ascanalpha.scripts.desc");
60+
}
61+
62+
@Override
63+
public List<Class<? extends Extension>> getDependencies() {
64+
return DEPENDENCIES;
65+
}
66+
67+
@Override
68+
public void postInit() {
69+
extScript =
70+
org.parosproxy.paros.control.Control.getSingleton()
71+
.getExtensionLoader()
72+
.getExtension(ExtensionScript.class);
73+
addScripts();
74+
}
75+
76+
@Override
77+
public boolean canUnload() {
78+
return true;
79+
}
80+
81+
@Override
82+
public void unload() {
83+
removeScripts();
84+
}
85+
86+
private void addScripts() {
87+
addScript(
88+
SCRIPT_SUSPICIOUS_INPUT_TRANSFORMATION,
89+
Constant.messages.getString(
90+
"ascanalpha.scripts.suspiciousInputTransformation.desc"),
91+
extScript.getScriptType(ExtensionActiveScan.SCRIPT_TYPE_ACTIVE),
92+
false);
93+
}
94+
95+
private void addScript(String name, String description, ScriptType type, boolean isTemplate) {
96+
try {
97+
if (extScript.getScript(name) != null) {
98+
return;
99+
}
100+
ScriptEngineWrapper engine = extScript.getEngineWrapper("Graal.js");
101+
if (engine == null) {
102+
return;
103+
}
104+
105+
File file;
106+
if (isTemplate) {
107+
file =
108+
Paths.get(
109+
Constant.getZapHome(),
110+
ExtensionScript.TEMPLATES_DIR,
111+
type.getName(),
112+
name)
113+
.toFile();
114+
} else {
115+
file =
116+
Paths.get(
117+
Constant.getZapHome(),
118+
ExtensionScript.SCRIPTS_DIR,
119+
ExtensionScript.SCRIPTS_DIR,
120+
type.getName(),
121+
name)
122+
.toFile();
123+
}
124+
ScriptWrapper script = new ScriptWrapper(name, description, engine, type, true, file);
125+
extScript.loadScript(script);
126+
if (isTemplate) {
127+
extScript.addTemplate(script, false);
128+
} else {
129+
extScript.addScript(script, false);
130+
}
131+
} catch (Exception e) {
132+
LOGGER.warn(
133+
Constant.messages.getString(
134+
"ascanalpha.scripts.warn.couldNotAddScripts", e.getLocalizedMessage()));
135+
}
136+
}
137+
138+
private void removeScripts() {
139+
if (extScript == null) {
140+
return;
141+
}
142+
removeScript(SCRIPT_SUSPICIOUS_INPUT_TRANSFORMATION, false);
143+
}
144+
145+
private void removeScript(String name, boolean isTemplate) {
146+
ScriptWrapper script;
147+
if (isTemplate) {
148+
script = extScript.getTreeModel().getTemplate(name);
149+
} else {
150+
script = extScript.getScript(name);
151+
}
152+
153+
if (script == null) {
154+
return;
155+
}
156+
157+
if (isTemplate) {
158+
extScript.removeTemplate(script);
159+
} else {
160+
extScript.removeScript(script);
161+
}
162+
}
163+
}

‎addOns/ascanrulesAlpha/src/main/javahelp/org/zaproxy/zap/extension/ascanrulesAlpha/resources/help/contents/ascanalpha.html‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,5 +55,14 @@ <H2 id="id-40039">Web Cache Deception</H2>
5555
<br>
5656
Alert ID: <a href="https://www.zaproxy.org/docs/alerts/40039/">40039</a>.
5757

58+
<H2 id="id-100044">Suspicious Input Transformation</H2>
59+
This is an active script scan rule. It detects various types of suspicious input transformations that may indicate
60+
potential security vulnerabilities such as template injection, expression evaluation, quote consumption, and issues
61+
related to unicode normalization.
62+
<p>
63+
Latest code: <a href="https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrulesAlpha/src/main/zapHomeFiles/scripts/scripts/active/SuspiciousInputTransformation.js">SuspiciousInputTransformation.js</a>
64+
<br>
65+
Alert ID: <a href="https://www.zaproxy.org/docs/alerts/100044/">100044</a>.
66+
5867
</BODY>
5968
</HTML>

‎addOns/ascanrulesAlpha/src/main/resources/org/zaproxy/zap/extension/ascanrulesAlpha/resources/Messages.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@ ascanalpha.mongodb.soln = Do not trust client side input and escape all data on
3333

3434
ascanalpha.name = Active Scan Rules - alpha
3535

36+
ascanalpha.scripts.desc = Adds alpha status active scan rule scripts.
37+
ascanalpha.scripts.name = Active Scan Rule Scripts - alpha
38+
ascanalpha.scripts.suspiciousInputTransformation.desc = This script detects suspicious input transformations in web applications.
39+
ascanalpha.scripts.warn.couldNotAddScripts = Could not add alpha active scan rule scripts: {0}.
40+
3641
ascanalpha.webCacheDeception.desc = Web cache deception may be possible. It may be possible for unauthorised user to view sensitive data on this page.
3742
ascanalpha.webCacheDeception.name = Web Cache Deception
3843
ascanalpha.webCacheDeception.otherinfo = Cached Authorised Response and Unauthorised Response are similar.

0 commit comments

Comments
 (0)