Skip to content

Commit ffe9599

Browse files
ricekotricekot
committed
openapi: Add Swagger Secret Detector Script
Signed-off-by: ricekot <[email protected]>
1 parent 5d27064 commit ffe9599

File tree

7 files changed

+860
-1
lines changed

7 files changed

+860
-1
lines changed

‎addOns/openapi/CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ All notable changes to this add-on will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
55

66
## Unreleased
7-
7+
### Added
8+
- Swagger Secret Detector Script Scan Rule.
89

910
## [47] - 2025-11-04
1011
### Changed

‎addOns/openapi/openapi.gradle.kts‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,19 @@ zapAddOn {
3737
}
3838
}
3939
}
40+
register("org.zaproxy.zap.extension.openapi.scripts.ExtensionOpenApiScripts") {
41+
classnames {
42+
allowed.set(listOf("org.zaproxy.zap.extension.openapi.scripts"))
43+
}
44+
dependencies {
45+
addOns {
46+
register("scripts") {
47+
version.set(">=45.15.0")
48+
}
49+
register("graaljs")
50+
}
51+
}
52+
}
4053
}
4154
dependencies {
4255
addOns {
@@ -86,6 +99,9 @@ dependencies {
8699
implementation(libs.log4j.slf4j2)
87100

88101
testImplementation(parent!!.childProjects.get("commonlib")!!.sourceSets.test.get().output)
102+
testImplementation(parent!!.childProjects.get("graaljs")!!.sourceSets.test.get().output)
89103
testImplementation(libs.log4j.core)
90104
testImplementation(project(":testutils"))
105+
testImplementation(project(":addOns:graaljs"))
106+
testImplementation(project(":addOns:scripts"))
91107
}

‎addOns/openapi/src/main/java/org/zaproxy/zap/extension/openapi/scripts/ExtensionOpenApiScripts.java‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
/*
2+
* Zed Attack Proxy (ZAP) and its related class files.
3+
*
4+
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
5+
*
6+
* Copyright 2025 The ZAP Development Team
7+
*
8+
* Licensed under the Apache License, Version 2.0 (the "License");
9+
* you may not use this file except in compliance with the License.
10+
* You may obtain a copy of the License at
11+
*
12+
* http://www.apache.org/licenses/LICENSE-2.0
13+
*
14+
* Unless required by applicable law or agreed to in writing, software
15+
* distributed under the License is distributed on an "AS IS" BASIS,
16+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
* See the License for the specific language governing permissions and
18+
* limitations under the License.
19+
*/
20+
package org.zaproxy.zap.extension.openapi.scripts;
21+
22+
import java.io.File;
23+
import java.nio.file.Paths;
24+
import java.util.List;
25+
import org.apache.logging.log4j.LogManager;
26+
import org.apache.logging.log4j.Logger;
27+
import org.parosproxy.paros.Constant;
28+
import org.parosproxy.paros.extension.Extension;
29+
import org.parosproxy.paros.extension.ExtensionAdaptor;
30+
import org.zaproxy.zap.extension.ascan.ExtensionActiveScan;
31+
import org.zaproxy.zap.extension.script.ExtensionScript;
32+
import org.zaproxy.zap.extension.script.ScriptEngineWrapper;
33+
import org.zaproxy.zap.extension.script.ScriptType;
34+
import org.zaproxy.zap.extension.script.ScriptWrapper;
35+
36+
public class ExtensionOpenApiScripts extends ExtensionAdaptor {
37+
38+
private static final List<Class<? extends Extension>> DEPENDENCIES =
39+
List.of(ExtensionActiveScan.class, ExtensionScript.class);
40+
private static final Logger LOGGER = LogManager.getLogger(ExtensionOpenApiScripts.class);
41+
private static final String SCRIPT_SWAGGER_SECRET_DETECTOR = "SwaggerSecretDetector.js";
42+
43+
private ExtensionScript extScript;
44+
45+
@Override
46+
public String getName() {
47+
return ExtensionOpenApiScripts.class.getSimpleName();
48+
}
49+
50+
@Override
51+
public String getUIName() {
52+
return Constant.messages.getString("openapi.scripts.name");
53+
}
54+
55+
@Override
56+
public String getDescription() {
57+
return Constant.messages.getString("openapi.scripts.desc");
58+
}
59+
60+
@Override
61+
public List<Class<? extends Extension>> getDependencies() {
62+
return DEPENDENCIES;
63+
}
64+
65+
@Override
66+
public void postInit() {
67+
extScript =
68+
org.parosproxy.paros.control.Control.getSingleton()
69+
.getExtensionLoader()
70+
.getExtension(ExtensionScript.class);
71+
addScripts();
72+
}
73+
74+
@Override
75+
public boolean canUnload() {
76+
return true;
77+
}
78+
79+
@Override
80+
public void unload() {
81+
removeScripts();
82+
}
83+
84+
private void addScripts() {
85+
addScript(
86+
SCRIPT_SWAGGER_SECRET_DETECTOR,
87+
Constant.messages.getString("openapi.scripts.swaggerSecretDetector.desc"),
88+
extScript.getScriptType(ExtensionActiveScan.SCRIPT_TYPE_ACTIVE),
89+
false);
90+
}
91+
92+
private void addScript(String name, String description, ScriptType type, boolean isTemplate) {
93+
try {
94+
if (extScript.getScript(name) != null) {
95+
return;
96+
}
97+
ScriptEngineWrapper engine = extScript.getEngineWrapper("Graal.js");
98+
if (engine == null) {
99+
return;
100+
}
101+
102+
File file;
103+
if (isTemplate) {
104+
file =
105+
Paths.get(
106+
Constant.getZapHome(),
107+
ExtensionScript.TEMPLATES_DIR,
108+
type.getName(),
109+
name)
110+
.toFile();
111+
} else {
112+
file =
113+
Paths.get(
114+
Constant.getZapHome(),
115+
ExtensionScript.SCRIPTS_DIR,
116+
ExtensionScript.SCRIPTS_DIR,
117+
type.getName(),
118+
name)
119+
.toFile();
120+
}
121+
ScriptWrapper script = new ScriptWrapper(name, description, engine, type, true, file);
122+
extScript.loadScript(script);
123+
if (isTemplate) {
124+
extScript.addTemplate(script, false);
125+
} else {
126+
extScript.addScript(script, false);
127+
}
128+
} catch (Exception e) {
129+
LOGGER.warn(
130+
Constant.messages.getString(
131+
"openapi.scripts.warn.couldNotAddScripts", e.getLocalizedMessage()));
132+
}
133+
}
134+
135+
private void removeScripts() {
136+
if (extScript == null) {
137+
return;
138+
}
139+
removeScript(SCRIPT_SWAGGER_SECRET_DETECTOR, false);
140+
}
141+
142+
private void removeScript(String name, boolean isTemplate) {
143+
ScriptWrapper script;
144+
if (isTemplate) {
145+
script = extScript.getTreeModel().getTemplate(name);
146+
} else {
147+
script = extScript.getScript(name);
148+
}
149+
150+
if (script == null) {
151+
return;
152+
}
153+
154+
if (isTemplate) {
155+
extScript.removeTemplate(script);
156+
} else {
157+
extScript.removeScript(script);
158+
}
159+
}
160+
}

‎addOns/openapi/src/main/javahelp/org/zaproxy/zap/extension/openapi/resources/help/contents/openapi.html‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,5 +113,17 @@ <H2>Statistics</H2>
113113
<li>openapi.urls.added : The total number of URLs added when importing OpenAPI definitions</li>
114114
</ul>
115115

116+
<H2>Scripts</H2>
117+
The following scripts are included with the add-on:
118+
119+
<H3 id="id-100043">Swagger Secret & Vulnerability Detector</H3>
120+
This is an active script scan rule. It attempts to find exposed OpenAPI documentation that leaks sensitive secrets such
121+
as API keys, OAuth client secrets, access tokens, or that runs vulnerable versions of Swagger UI.
122+
<p>
123+
Latest code: <a href="https://github.com/zaproxy/zap-extensions/blob/main/addOns/openapi/src/main/zapHomeFiles/scripts/scripts/active/SwaggerSecretDetector.js">SwaggerSecretDetector.js</a>
124+
<br>
125+
Alert ID: <a href="https://www.zaproxy.org/docs/alerts/100043/">100043</a>.
126+
127+
116128
</BODY>
117129
</HTML>

‎addOns/openapi/src/main/resources/org/zaproxy/zap/extension/openapi/resources/Messages.properties‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ openapi.parse.warn = Parsed OpenAPI definition with warnings - \nsee Output tab
5959

6060
openapi.progress.importpane.currentimport = Importing: {0}
6161

62+
openapi.scripts.desc = Adds scripts relevant to OpenAPI specifications.
63+
openapi.scripts.name = OpenAPI Scripts
64+
openapi.scripts.swaggerSecretDetector.desc = This script attempts to find exposed OpenAPI documentation endpoints that may contain sensitive information.
65+
openapi.scripts.warn.couldNotAddScripts = Could not add OpenAPI scripts: {0}.
66+
6267
openapi.spider.desc = OpenAPI Spider Integration
6368
openapi.spider.name = OpenAPI Spider
6469

0 commit comments

Comments
 (0)