feat(webapp): add web application attack injector (#314) - #324
feat(webapp): add web application attack injector (#314)#324SamuelHassine wants to merge 6 commits into
Conversation
Wraps OWASP ZAP baseline and SQLMap for active web application testing, surfacing findings for WAF detection and vulnerability validation. Wires the injector into the CircleCI build, publish and test matrices.
There was a problem hiding this comment.
Pull request overview
This PR introduces a new webapp injector module to the Python monorepo, intended to run OWASP ZAP baseline and SQLMap via subprocess and surface their outputs as finding-compatible vulnerability results. It also updates CircleCI to include the new injector in the existing build/test/publish matrices.
Changes:
- Add the
webappinjector package (contracts, config loader, executor wrapper, entrypoint) plus unit tests for report parsing/contract generation. - Add containerization and local run assets for the
webappinjector (Dockerfile, compose, env/config samples, manifest metadata). - Update CircleCI matrices to run
test,build_docker_images, andpublish_imagesforwebapp.
Reviewed changes
Copilot reviewed 17 out of 20 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| webapp/webapp_injector/openaev_webapp.py | Injector entrypoint: config bootstrapping, contract dispatch, callback reporting |
| webapp/webapp_injector/img/README.md | Documents required icon asset standard and placement |
| webapp/webapp_injector/helpers/webapp_executor.py | Subprocess wrapper + parsing helpers for ZAP baseline and SQLMap |
| webapp/webapp_injector/helpers/init.py | Package marker for helpers |
| webapp/webapp_injector/contracts_webapp.py | Defines ZAP/SQLMap contracts and finding-compatible vulnerability output |
| webapp/webapp_injector/configuration/injector_config_override.py | Injector override config fields (id/name/icon path) |
| webapp/webapp_injector/configuration/config_loader.py | Builds the daemon configuration (including contracts) |
| webapp/webapp_injector/configuration/init.py | Package marker for configuration |
| webapp/webapp_injector/init.py | Package marker + version constant |
| webapp/test/test_webapp.py | Unit tests for contract building and parser behavior |
| webapp/test/init.py | Test package marker |
| webapp/README.md | Injector-level documentation (contracts, dev workflow, icon notes) |
| webapp/pyproject.toml | Packaging/deps configuration for the new injector |
| webapp/manifest-metadata.json | Integration catalog metadata for the injector image |
| webapp/Dockerfile | Builds the injector image and installs SQLMap wrapper |
| webapp/docker-compose.yml | Local compose definition for running the injector |
| webapp/config.yml.sample | Sample YAML config for the injector |
| webapp/.env.sample | Sample environment variables for container deployment |
| webapp/.dockerignore | Docker build context ignore rules |
| .circleci/config.yml | Adds webapp to CircleCI test/build/publish matrices |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #324 +/- ##
==========================================
+ Coverage 69.27% 70.47% +1.20%
==========================================
Files 81 87 +6
Lines 3505 3682 +177
==========================================
+ Hits 2428 2595 +167
- Misses 1077 1087 +10
📢 Thoughts on this report? Let us know! 🚀 New features to boost your workflow:
|
Adds coverage for __init__, process_message dispatch, start and the ZAP/SQLMap executor paths to satisfy the codecov patch gate.
…314) - Add a 512x512 opaque placeholder icon so the container can start; the unconditional icon open would otherwise raise FileNotFoundError. The artwork is still to be finalized per the icon standard (#305). - Treat a non-zero sqlmap exit as an error result (with a trimmed stderr excerpt) instead of reporting SUCCESS with zero findings. - Use a POSIX "[ -n ... ]" test for PYOAEV_GIT_BRANCH_OVERRIDE; the previous "[[ ... ]]" is unsupported by Alpine's /bin/sh (ash) and never matched. - Cover the sqlmap non-zero-exit path with a unit test.
Review and fix summaryDid an independent senior-reviewer pass over the full changed files (not just the diff), applied fixes, and drove CI to green. Fixes pushed in 2391634 (signed):
Verification:
Note: I could not add a formal Approve review because the review token belongs to the PR author, and GitHub blocks self-approval. A second maintainer approval is still required to satisfy |
…#314) - Redact userinfo credentials and query strings from target URLs before logging the subprocess command, so secrets never reach injector logs. - Treat an empty/partial/non-JSON ZAP report as an ERROR result instead of reporting SUCCESS with zero alerts, which masked a scan/report failure. - Drop the unused client-python clone and the now-unneeded git package from the Dockerfile builder stage. - Pin the sqlmap clone to release tag 1.10.7 (via SQLMAP_VERSION build arg) for reproducible, supply-chain-safe builds. - Add unit tests for URL redaction and invalid/valid ZAP report handling.
Second review-and-fix passDid another independent senior-reviewer read of the full changed files and addressed all four newly landed review comments. Fixes pushed in 414cb54 (signed):
Added unit tests for URL redaction (credential/query redaction + pass-through) and ZAP report handling (invalid-report error path + valid-report success path). Verification:
Note: I could not add a formal Approve review because the review token belongs to the PR author and GitHub blocks self-approval. A second maintainer approval is still required to satisfy |
…314) Restore the client-python clone in the builder stage. poetry install resolves the dev extra "pyoaev @ ../../client-python", which from the install dir points at /client-python, so the checkout must exist or the Docker build fails during dependency resolution ("Path /client-python for pyoaev does not exist"). This matches the sibling injectors (nmap, shodan, http-query) and fixes the failing build_docker_images-webapp CircleCI job. Redact the target URL in every ZAP and SQLMap result message via the existing _redact_url() helper. execution_message is surfaced in the platform UI, so a URL carrying basic-auth credentials or sensitive query parameters must not leak through timeout, failure, invalid-report or success messages. Add unit tests asserting credentials and query values never appear in those messages.
Review and fix summaryRan an independent senior-reviewer pass over the full changed files (not just the diff), diagnosed and fixed the failing CI check, and drove CI back to green. Positive review (equivalent to Approve)I could not submit a formal Approve because the review token belongs to the PR author and GitHub blocks self-approval, so recording it here: LGTM. The injector is well-structured - bounded-timeout subprocess execution with CI fix (was: build_docker_images-webapp FAILURE)The CircleCI Findings fixed
Pushed in 4a00c85 (signed). Verification
Remaining (non-CI)
|
| if result.returncode != 0: | ||
| excerpt = self._trim_stderr(result.stderr) | ||
| message = f"SQLMap failed for {safe_url} (exit {result.returncode})" | ||
| if excerpt: | ||
| message = f"{message}: {excerpt}" | ||
| return WebappResult(False, message) |
Summary
Adds the
webappinjector, which wraps OWASP ZAP (baseline scan) and SQLMap for active web-application testing and surfaces discovered issues as vulnerability findings. Two contracts are exposed - "Web App - OWASP ZAP baseline scan" and "Web App - SQLMap injection test" - both keyed on a mandatory Target URL and both carrying DETECTION (WAF/monitoring) and VULNERABILITY expectations. Also wires the injector into the CircleCIbuild_docker_images,publish_imagesandtestmatrices.Implementation notes
stdinclosed, and output captured; the ZAP JSON report and the SQLMap stdout are parsed into de-duplicated finding lists.***@host, any query string becomes<redacted>), and the same_redact_url()helper is applied to every ZAP and SQLMapexecution_message(timeout, failure, no-report, invalid-report and success), so credentials and sensitive query parameters never reach the injector logs or the platform UI.zap-baseline.pyreturns non-zero merely on WARN/FAIL alerts); instead it requires a valid JSON report - a missing, empty, partial, or non-JSON report is reported as an ERROR so a scan/report failure is never recorded as a false success.[ -n "${PYOAEV_GIT_BRANCH_OVERRIDE}" ]test so the client-python override works under Alpine'sashshell. The builder stage clonesclient-pythonat/client-pythonbecausepoetry installresolves the dev extrapyoaev @ ../../client-python(which from the install dir points at/client-python); this matches the sibling injectors. The sqlmap clone is pinned to a release tag (SQLMAP_VERSION, default1.10.7) for reproducible, supply-chain-safe builds.icon-webapp.pngis committed so the container starts; the final artwork will follow the icon standard (Connector icons should be square with a solid background (netexec, teams, ...) #305).Test plan
isort --profile black --check .cleanblack --check .cleanflake8 --ignore=E,W webappclean andruff check .cleanpython -m unittestgreen (21 tests: dispatch, missing/unknown contract, executor success + failure paths, ZAP valid/invalid/missing report, SQLMap non-zero exit, URL redaction in logs and in ZAP/SQLMap messages, report parsers)build_docker_images-*(includingbuild_docker_images-webapp), codecov patch + projectReview
Three review passes addressed. First pass: missing icon asset, SQLMap success-on-failure, non-POSIX Dockerfile test. Second pass: URL credential/query redaction in logs, invalid ZAP report treated as error, sqlmap clone pinned to a tag. Third pass: redact the target URL in all ZAP/SQLMap
execution_messagevalues, and restore the builder-stageclient-pythonclone that a prior cleanup had removed (its absence brokebuild_docker_images-webappbecausepoetry installneeds/client-python). All threads resolved.Closes #314