Skip to content

Commit d3ca003

Browse files
thc202thc202
authored
Merge pull request #6883 from psiinon/authhelper-testdomains
authhelper: add support for domains to tester
2 parents ca7057c + 8ac2ab5 commit d3ca003

File tree

5 files changed

+62
-2
lines changed

5 files changed

+62
-2
lines changed

‎addOns/authhelper/CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ All notable changes to this add-on will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
55

66
## Unreleased
7-
7+
### Added
8+
- Domains to auth tester.
89

910
## [0.30.0] - 2025-11-04
1011
### Added

‎addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthTestDialog.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import java.util.Locale;
3434
import java.util.Map;
3535
import java.util.Optional;
36+
import java.util.regex.Pattern;
3637
import javax.swing.BorderFactory;
3738
import javax.swing.Icon;
3839
import javax.swing.ImageIcon;
@@ -113,6 +114,7 @@ public class AuthTestDialog extends StandardFieldsDialog {
113114
private static final String RECORD_DIAGNOSTICS_LABEL =
114115
"authhelper.auth.test.dialog.label.recdiag";
115116
private static final String DIAGNOSTICS_LABEL = "authhelper.auth.test.dialog.label.diag";
117+
private static final String DOMAINS_LABEL = "authhelper.auth.test.dialog.label.domains";
116118
private static final String COPY_LABEL = "authhelper.auth.test.dialog.label.copy";
117119

118120
private static final String FOUND_STR =
@@ -163,6 +165,7 @@ public AuthTestDialog(ExtensionAuthhelper ext, Frame owner) {
163165
DisplayUtils.getScaledDimension(600, 550),
164166
new String[] {
165167
"authhelper.auth.test.dialog.tab.test",
168+
"authhelper.auth.test.dialog.tab.domains",
166169
"authhelper.auth.test.dialog.tab.steps",
167170
"authhelper.auth.test.dialog.tab.diag"
168171
});
@@ -251,6 +254,10 @@ public AuthTestDialog(ExtensionAuthhelper ext, Frame owner) {
251254
this.addPadding(0);
252255

253256
int tab = 1;
257+
258+
addMultilineField(tab, DOMAINS_LABEL, params.getDomains());
259+
260+
tab++;
254261
stepsPanel = new StepsPanel(this, true);
255262
stepsPanel.setSteps(params.getSteps());
256263
setCustomTabPanel(tab, stepsPanel.getPanel());
@@ -468,6 +475,14 @@ private void authenticate() {
468475
context.addIncludeInContextRegex(
469476
SessionStructure.getHostName(new URI(loginUrl, false)) + ".*");
470477

478+
for (String dom : getDomains()) {
479+
if (dom.endsWith(".*")) {
480+
// Just in case the user has added this anyway
481+
dom = dom.substring(0, dom.length() - 2);
482+
}
483+
context.addIncludeInContextRegex(Pattern.quote(dom) + ".*");
484+
}
485+
471486
JComboBox<?> browserCombo = (JComboBox<?>) this.getField(BROWSER_LABEL);
472487
String browserId = ((BrowserUI) browserCombo.getSelectedItem()).getBrowser().getId();
473488

@@ -692,6 +707,12 @@ public void counterInc(String site, String key) {
692707
}
693708
}
694709

710+
private List<String> getDomains() {
711+
return List.of(this.getStringValue(DOMAINS_LABEL).split("\r?\n")).stream()
712+
.filter(StringUtils::isNotBlank)
713+
.toList();
714+
}
715+
695716
private static void setTotp(
696717
List<AuthenticationStep> steps, UsernamePasswordAuthenticationCredentials credentials) {
697718
if (!TotpSupport.isTotpInCore()) {
@@ -755,6 +776,7 @@ public JButton[] getExtraButtons() {
755776
Constant.messages.getString(
756777
"authhelper.auth.test.dialog.default-context"));
757778
setFieldValue(LOGIN_URL_LABEL, "");
779+
setFieldValue(DOMAINS_LABEL, "");
758780
setFieldValue(USERNAME_LABEL, "");
759781
setFieldValue(PASSWORD_LABEL, "");
760782
setFieldValue(LOGIN_WAIT_LABEL, AuthhelperParam.DEFAULT_WAIT);
@@ -786,6 +808,7 @@ public void save() {
786808
private void saveDetails() {
787809
AuthhelperParam params = this.ext.getParam();
788810
params.setLoginUrl(this.getStringValue(LOGIN_URL_LABEL));
811+
params.setDomains(this.getStringValue(DOMAINS_LABEL));
789812
params.setUsername(this.getStringValue(USERNAME_LABEL));
790813
JComboBox<?> browserCombo = (JComboBox<?>) this.getField(BROWSER_LABEL);
791814
params.setBrowser(((BrowserUI) browserCombo.getSelectedItem()).getBrowser().getId());
@@ -815,6 +838,17 @@ public String validateFields() {
815838
return Constant.messages.getString("authhelper.auth.test.dialog.error.nopassword");
816839
}
817840
}
841+
for (String dom : this.getDomains()) {
842+
String domLc = dom.toLowerCase(Locale.ROOT);
843+
if (!domLc.startsWith("http://") && !domLc.startsWith("https://")) {
844+
return Constant.messages.getString("authhelper.auth.test.dialog.error.baddom", dom);
845+
}
846+
try {
847+
new URI(dom, false);
848+
} catch (Exception e) {
849+
return Constant.messages.getString("authhelper.auth.test.dialog.error.baddom", dom);
850+
}
851+
}
818852
return null;
819853
}
820854

‎addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthhelperParam.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ public class AuthhelperParam extends AbstractParam {
3232
private static final String AUTO_KEY = "authhelper";
3333

3434
private static final String LOGIN_URL_KEY = AUTO_KEY + ".loginurl";
35+
private static final String DOMAINS_KEY = AUTO_KEY + ".domains";
3536
private static final String USERNAME_KEY = AUTO_KEY + ".username";
3637
private static final String BROWSER_KEY = AUTO_KEY + ".browser";
3738
private static final String WAIT_KEY = AUTO_KEY + ".wait";
@@ -44,6 +45,7 @@ public class AuthhelperParam extends AbstractParam {
4445
private String loginUrl;
4546
private String username;
4647
private String browser;
48+
private String domains;
4749
private int wait = DEFAULT_WAIT;
4850
private int stepDelay;
4951
private boolean recordDiagnostics;
@@ -56,6 +58,7 @@ public AuthhelperParam() {}
5658
@Override
5759
protected void parse() {
5860
this.loginUrl = this.getString(LOGIN_URL_KEY, "");
61+
this.domains = this.getString(DOMAINS_KEY, "");
5962
this.username = this.getString(USERNAME_KEY, null);
6063
this.browser = this.getString(BROWSER_KEY, DEFAULT_BROWSER.getId());
6164
this.wait = getInteger(WAIT_KEY, DEFAULT_WAIT);
@@ -85,6 +88,15 @@ public void setLoginUrl(String loginUrl) {
8588
getConfig().setProperty(LOGIN_URL_KEY, loginUrl);
8689
}
8790

91+
public String getDomains() {
92+
return domains;
93+
}
94+
95+
public void setDomains(String domains) {
96+
this.domains = domains;
97+
getConfig().setProperty(DOMAINS_KEY, domains);
98+
}
99+
88100
public String getBrowser() {
89101
return browser;
90102
}

‎addOns/authhelper/src/main/javahelp/org/zaproxy/addon/authhelper/resources/help/contents/auth-tester.html‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,21 @@ <H3>Record Diagnostics</H3>
6868
<H3>Reset Button</H3>
6969
The reset button allows you to reset all the fields on the Test tab, and disable all Steps in the Steps tab (steps are only disabled not removed as recreating them might be tedious).
7070

71-
<H2>Results Panel</H2>
71+
<H3>Results Panel</H3>
7272

7373
The results panel show the progress and what has been identified. All elements need to be identified in order for
7474
ZAP to be able to automatically handle authentication for this site.
7575

76+
<H2>Domains Tab</H2>
77+
78+
The domains tab allows you to supply any domains that should be included in the context.
79+
<p>
80+
The domains should be one per line, and in the format: 'https://www.example.com/'.
81+
<p>
82+
If the Session Handling or Verification URL fail then check to see if your app is accessing any other domains.
83+
<p>
84+
ZAP will not consider requests to any domains that are outside of the Login URL domain or the domains listed here.
85+
7686
<H2>Diagnostics Tab</H2>
7787

7888
The Diagnostics tab will contain a summary of the requests and responses sent and received as part of the

‎addOns/authhelper/src/main/resources/org/zaproxy/addon/authhelper/resources/Messages.properties‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ authhelper.auth.test.dialog.button.reset = Reset
9393
authhelper.auth.test.dialog.button.save = Test
9494

9595
authhelper.auth.test.dialog.default-context = Authentication Test
96+
authhelper.auth.test.dialog.error.baddom = Invalid domain: {0} - it must be a valid URL and start with "http://" or "https://"
9697
authhelper.auth.test.dialog.error.badurl = The Login URL must start with "http://" or "https://"
9798
authhelper.auth.test.dialog.error.nocontext = You must specify a Context
9899
authhelper.auth.test.dialog.error.nopassword = You must specify a Password
@@ -103,6 +104,7 @@ authhelper.auth.test.dialog.label.browser = Browser:
103104
authhelper.auth.test.dialog.label.context = Context:
104105
authhelper.auth.test.dialog.label.copy =
105106
authhelper.auth.test.dialog.label.diag = Diagnostics:
107+
authhelper.auth.test.dialog.label.domains = Domains:
106108
authhelper.auth.test.dialog.label.loginurl = Login URL:
107109
authhelper.auth.test.dialog.label.method = Auth Method
108110
authhelper.auth.test.dialog.label.method.browser = Browser Based
@@ -124,6 +126,7 @@ authhelper.auth.test.dialog.status.launching = Launching Browser
124126
authhelper.auth.test.dialog.status.notstarted = Not Started
125127
authhelper.auth.test.dialog.status.passed = Passed
126128
authhelper.auth.test.dialog.tab.diag = Diagnostics
129+
authhelper.auth.test.dialog.tab.domains = Domains
127130
authhelper.auth.test.dialog.tab.steps = Steps
128131
authhelper.auth.test.dialog.tab.test = Test
129132

0 commit comments

Comments
 (0)