Skip to content

Commit 07d0a65

Browse files
dmettemdmettem
committed
Added methods related to Context, Authentication, User, ForcedUser, and ACSRF
Added methods needed create and setup a context, and its related configuration such as authentication, users, forced user, session management. Also added methods to manage CSRF tokens.
1 parent f673bb7 commit 07d0a65

File tree

8 files changed

+1447
-80
lines changed

8 files changed

+1447
-80
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Created by .ignore support plugin (hsz.mobi)
2+
.idea/
3+
*.iml
4+
target/

‎src/main/java/net/continuumsecurity/proxy/Authentication.java

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
package net.continuumsecurity.proxy;
2+
3+
import net.continuumsecurity.proxy.model.User;
4+
import org.zaproxy.clientapi.core.ClientApiException;
5+
6+
import java.io.IOException;
7+
import java.io.UnsupportedEncodingException;
8+
import java.util.List;
9+
import java.util.Map;
10+
11+
public interface Authentication {
12+
/**
13+
* Returns the supported authentication methods by ZAP.
14+
* @return list of supported authentication methods.
15+
* @throws ClientApiException
16+
*/
17+
List<String> getSupportedAuthenticationMethods() throws ClientApiException;
18+
19+
/**
20+
* Returns logged in indicator pattern for the given context.
21+
* @param contextId Id of the context.
22+
* @return Logged in indicator for the given context.
23+
* @throws ClientApiException
24+
*/
25+
String getLoggedInIndicator(String contextId) throws ClientApiException;
26+
27+
/**
28+
* Returns logged out indicator pattern for the given context.
29+
* @param contextId Id of the context.
30+
* @return Logged out indicator for the given context.
31+
* @throws ClientApiException
32+
*/
33+
String getLoggedOutIndicator(String contextId) throws ClientApiException;
34+
35+
/**
36+
* Sets the logged in indicator to a given context.
37+
* @param contextId Id of a context.
38+
* @param loggedInIndicatorRegex Regex pattern for logged in indicator.
39+
* @throws ClientApiException
40+
*/
41+
void setLoggedInIndicator(String contextId, String loggedInIndicatorRegex) throws ClientApiException;
42+
43+
/**
44+
* Sets the logged out indicator to a given context.
45+
* @param contextId Id of a context.
46+
* @param loggedOutIndicatorRegex Regex pattern for logged out indicator.
47+
* @throws ClientApiException
48+
*/
49+
void setLoggedOutIndicator(String contextId, String loggedOutIndicatorRegex) throws ClientApiException;
50+
51+
/**
52+
* Returns authentication method for a given context.
53+
* @param contextId Id of a context.
54+
* @return Authentication method details for the given context id.
55+
* @throws ClientApiException
56+
*/
57+
Map<String, String> getAuthenticationMethodInfo(String contextId) throws ClientApiException;
58+
59+
/**
60+
* Returns the list of authentication config parameters.
61+
* Each config parameter is a map with keys "name" and "mandatory", holding the values name of the configuration parameter and whether it is mandatory/optional respectively.
62+
* @param authMethod Valid authentication method name.
63+
* @return List of configuration parameters for the given authentication method name.
64+
* @throws ClientApiException
65+
*/
66+
List<Map<String, String>> getAuthMethodConfigParameters(String authMethod) throws ClientApiException;
67+
68+
/**
69+
* Sets the authentication method for a given context with given configuration parameters.
70+
* @param contextId Id of a context.
71+
* @param authMethodName Valid authentication method name.
72+
* @param authMethodConfigParams Authentication method configuration parameters such as loginUrl, loginRequestData formBasedAuthentication method, and hostName, port, realm for httpBasedAuthentication method.
73+
* @throws ClientApiException
74+
*/
75+
void setAuthenticationMethod(String contextId, String authMethodName, String authMethodConfigParams) throws ClientApiException;
76+
77+
/**
78+
* Sets the formBasedAuthentication to given context id with the loginUrl and loginRequestData.
79+
* Example loginRequestData: "username={%username%}&password={%password%}"
80+
* @param contextId Id of the context.
81+
* @param loginUrl Login URL.
82+
* @param loginRequestData Login request data with form field names for username and password.
83+
* @throws ClientApiException
84+
* @throws UnsupportedEncodingException
85+
*/
86+
void setFormBasedAuthentication(String contextId, String loginUrl, String loginRequestData) throws ClientApiException, UnsupportedEncodingException;
87+
88+
/**
89+
* Sets the HTTP/NTLM authentication to given context id with hostname, realm and port.
90+
* @param contextId Id of the context.
91+
* @param hostname Hostname.
92+
* @param realm Realm.
93+
* @param portNumber Port number.
94+
* @throws ClientApiException
95+
*/
96+
void setHttpAuthentication(String contextId, String hostname, String realm, String portNumber) throws ClientApiException, UnsupportedEncodingException;
97+
98+
/**
99+
* Sets the HTTP/NTLM authentication to given context id with hostname, realm.
100+
* @param contextId Id of the context.
101+
* @param hostname Hostname.
102+
* @param realm Realm.
103+
* @throws ClientApiException
104+
*/
105+
void setHttpAuthentication(String contextId, String hostname, String realm) throws ClientApiException, UnsupportedEncodingException;
106+
107+
/**
108+
* Sets the manual authentication to the given context id.
109+
* @param contextId Id of the context.
110+
* @throws ClientApiException
111+
*/
112+
void setManualAuthentication(String contextId) throws ClientApiException;
113+
114+
/**
115+
* Sets the script based authentication to the given context id with the script name and config parameters.
116+
* @param contextId Id of the context.
117+
* @param scriptName Name of the script.
118+
* @param scriptConfigParams Script config parameters.
119+
* @throws ClientApiException
120+
*/
121+
void setScriptBasedAuthentication(String contextId, String scriptName, String scriptConfigParams) throws ClientApiException, UnsupportedEncodingException;
122+
123+
/**
124+
* Returns list of {@link User}s for a given context.
125+
* @param contextId Id of the context.
126+
* @return List of {@link User}s
127+
* @throws ClientApiException
128+
* @throws IOException
129+
*/
130+
List<User> getUsersList(String contextId) throws ClientApiException, IOException;
131+
132+
/**
133+
* Returns the {@link User} info for a given context id and user id.
134+
* @param contextId Id of a context.
135+
* @param userId Id of a user.
136+
* @return {@link User} info.
137+
* @throws ClientApiException
138+
* @throws IOException
139+
*/
140+
User getUserById(String contextId, String userId) throws ClientApiException, IOException;
141+
142+
/**
143+
* Returns list of config parameters of authentication credentials for a given context id.
144+
* Each item in the list is a map with keys "name" and "mandatory".
145+
* @param contextId Id of a context.
146+
* @return List of authentication credentials configuration parameters.
147+
* @throws ClientApiException
148+
*/
149+
List<Map<String, String>> getAuthenticationCredentialsConfigParams(String contextId) throws ClientApiException;
150+
151+
/**
152+
* Returns the authentication credentials as a map with key value pairs for a given context id and user id.
153+
* @param contextId Id of a context.
154+
* @param userId Id of a user.
155+
* @return Authentication credentials.
156+
* @throws ClientApiException
157+
*/
158+
Map<String, String> getAuthenticationCredentials(String contextId, String userId) throws ClientApiException;
159+
160+
/**
161+
* Creates a new {@link User} for a given context and returns the user id.
162+
* @param contextId Id of a context.
163+
* @param name Name of the user.
164+
* @return User id.
165+
* @throws ClientApiException
166+
*/
167+
String newUser(String contextId, String name) throws ClientApiException;
168+
169+
/**
170+
* Removes a {@link User} using the given context id and user id.
171+
* @param contextId Id of a {@link net.continuumsecurity.proxy.model.Context}
172+
* @param userId Id of a {@link User}
173+
* @throws ClientApiException
174+
*/
175+
void removeUser(String contextId, String userId) throws ClientApiException;
176+
177+
/**
178+
* Sets the authCredentialsConfigParams to the given context and user.
179+
* Bu default, authCredentialsConfigParams uses key value separator "=" and key value pair separator "&".
180+
* Make sure that values provided for authCredentialsConfigParams are URL encoded using "UTF-8".
181+
* @param contextId Id of the context.
182+
* @param userId Id of the user.
183+
* @param authCredentialsConfigParams Authentication credentials config parameters.
184+
* @throws ClientApiException
185+
*/
186+
void setAuthenticationCredentials(String contextId, String userId, String authCredentialsConfigParams) throws ClientApiException;
187+
188+
/**
189+
* Enables a {@link User} for a given {@link net.continuumsecurity.proxy.model.Context} id and user id.
190+
* @param contextId Id of a {@link net.continuumsecurity.proxy.model.Context}
191+
* @param userId Id of a {@link User}
192+
* @param enabled Boolean value to enable/disable the user.
193+
* @throws ClientApiException
194+
*/
195+
void setUserEnabled(String contextId, String userId, boolean enabled) throws ClientApiException;
196+
197+
/**
198+
* Sets a name to the user for the given context id and user id.
199+
* @param contextId Id of a {@link net.continuumsecurity.proxy.model.Context}
200+
* @param userId Id of a {@link User}
201+
* @param name User name.
202+
* @throws ClientApiException
203+
*/
204+
void setUserName(String contextId, String userId, String name) throws ClientApiException;
205+
206+
/**
207+
* Returns the forced user id for a given context.
208+
* @param contextId Id of a context.
209+
* @return Id of a forced {@link User}
210+
* @throws ClientApiException
211+
*/
212+
String getForcedUserId(String contextId) throws ClientApiException;
213+
214+
/**
215+
* Returns true if forced user mode is enabled. Otherwise returns false.
216+
* @return true if forced user mode is enabled.
217+
* @throws ClientApiException
218+
*/
219+
boolean isForcedUserModeEnabled() throws ClientApiException;
220+
221+
/**
222+
* Enables/disables the forced user mode.
223+
* @param forcedUserModeEnabled flag to enable/disable forced user mode.
224+
* @throws ClientApiException
225+
*/
226+
void setForcedUserModeEnabled(boolean forcedUserModeEnabled) throws ClientApiException;
227+
228+
/**
229+
* Sets a {@link User} id as forced user for the given {@link net.continuumsecurity.proxy.model.Context}
230+
* @param contextId Id of a context.
231+
* @param userId Id of a user.
232+
* @throws ClientApiException
233+
*/
234+
void setForcedUser(String contextId, String userId) throws ClientApiException;
235+
236+
/**
237+
* Returns list of supported session management methods.
238+
* @return List of supported session management methods.
239+
* @throws ClientApiException
240+
*/
241+
List<String> getSupportedSessionManagementMethods() throws ClientApiException;
242+
243+
/**
244+
* Returns session management method selected for the given context.
245+
* @param contextId Id of a context.
246+
* @return Session management method for a given context.
247+
* @throws ClientApiException
248+
*/
249+
String getSessionManagementMethod(String contextId) throws ClientApiException;
250+
251+
/**
252+
* Sets the given session management method and config params for a given context.
253+
* @param contextId Id of a context.
254+
* @param sessionManagementMethodName Session management method name.
255+
* @param methodConfigParams Session management method config parameters.
256+
* @throws ClientApiException
257+
*/
258+
void setSessionManagementMethod(String contextId, String sessionManagementMethodName, String methodConfigParams) throws ClientApiException;
259+
}

‎src/main/java/net/continuumsecurity/proxy/ScanningProxy.java

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
package net.continuumsecurity.proxy;
22

3+
import net.continuumsecurity.proxy.model.Context;
34
import org.zaproxy.clientapi.core.Alert;
5+
import org.zaproxy.clientapi.core.ClientApiException;
46

7+
import java.io.IOException;
58
import java.util.List;
9+
import java.util.regex.Pattern;
610

711
public interface ScanningProxy extends LoggingProxy {
812

@@ -57,4 +61,105 @@ public interface ScanningProxy extends LoggingProxy {
5761
* @throws ProxyException
5862
*/
5963
public void shutdown() throws ProxyException;
64+
65+
/**
66+
* Creates a new context with given context name and sets it in scope if @param inScope is true.
67+
*
68+
* @param contextName Name of the context.
69+
* @param inScope true to set context in scope.
70+
* @throws ClientApiException
71+
*/
72+
void createContext(String contextName, boolean inScope) throws ClientApiException;
73+
74+
/**
75+
* Adds include regex to the given context.
76+
*
77+
* @param contextName Name of the context.
78+
* @param regex Regex to include in context.
79+
* @throws ClientApiException
80+
*/
81+
void includeRegexInContext(String contextName, Pattern regex) throws ClientApiException;
82+
83+
/**
84+
* Adds include parent url to the given content.
85+
* @param contextName Name of the context.
86+
* @param parentUrl Parent URL to include in context.
87+
* @throws ClientApiException
88+
*/
89+
void includeUrlTreeInContext(String contextName, String parentUrl) throws ClientApiException;
90+
91+
/**
92+
* Add exclude regex to the given context.
93+
* @param contextName Name of the context.
94+
* @param regex Regex to exclude from context.
95+
* @throws ClientApiException
96+
*/
97+
void excludeRegexFromContext(String contextName, Pattern regex) throws ClientApiException;
98+
99+
/**
100+
* Add exclude regex to the given context.
101+
* @param contextName Name of the context.
102+
* @param parentUrl Parent URL to exclude from context.
103+
* @throws ClientApiException
104+
*/
105+
void excludeParentUrlFromContext(String contextName, String parentUrl) throws ClientApiException;
106+
107+
/**
108+
* Returns Context details for a given context name.
109+
* @param contextName Name of context.
110+
* @return Context details for the given context
111+
* @throws ClientApiException
112+
*/
113+
Context getContextInfo(String contextName) throws ClientApiException, IOException;
114+
115+
/**
116+
* Returns list of context names.
117+
* @return List of context names.
118+
*/
119+
List<String> getContexts() throws ClientApiException;
120+
121+
/**
122+
* Sets the given context in or out of scope.
123+
* @param contextName Name of the context.
124+
* @param inScope true - Sets the context in scope. false - Sets the context out of scope.
125+
* @throws ClientApiException
126+
*/
127+
void setContextInScope(String contextName, boolean inScope) throws ClientApiException;
128+
129+
/**
130+
* Returns the list of included regexs for the given context.
131+
* @param contextName Name of the context.
132+
* @return List of include regexs.
133+
* @throws ClientApiException
134+
*/
135+
List<String> getIncludedRegexs(String contextName) throws ClientApiException;
136+
137+
/**
138+
* Returns the list of excluded regexs for the given context.
139+
* @param contextName Name of the context.
140+
* @return List of exclude regexs.
141+
* @throws ClientApiException
142+
*/
143+
List<String> getExcludedRegexs(String contextName) throws ClientApiException;
144+
145+
/**
146+
* Returns the list of Anti CSRF token names.
147+
* @return List of Anti CSRF token names.
148+
* @throws ClientApiException
149+
*/
150+
List<String> getAntiCsrfTokenNames() throws ClientApiException;
151+
152+
/**
153+
* Adds an anti CSRF token with the given name, enabled by default.
154+
* @param tokenName Anti CSRF token name.
155+
* @throws ClientApiException
156+
*/
157+
void addAntiCsrfToken(String tokenName) throws ClientApiException;
158+
159+
/**
160+
* Removes the anti CSRF token with the given name.
161+
* @param tokenName Anti CSRF token name.
162+
* @throws ClientApiException
163+
*/
164+
void removeAntiCsrfToken(String tokenName) throws ClientApiException;
60165
}

0 commit comments

Comments
 (0)