🐛 fix gitlab dast to parse request response pair #12050 (#12057)

Author: manuel-sommer

dojo/tools/gitlab_dast/parser.py

@@ -83,7 +83,11 @@ def get_item(self, vuln, test, scanner):
             static_finding=False,
             dynamic_finding=True,
         )
-
+        # request response
+        request, response = self.prepare_request_response(vuln.get("evidence"))
+        if request is not None:
+            finding.unsaved_req_resp = []
+            finding.unsaved_req_resp.append({"req": str(request), "resp": str(response)})
         # date
         if "discovered_at" in vuln:
             finding.date = datetime.strptime(
@@ -125,3 +129,20 @@ def get_item(self, vuln, test, scanner):
             finding.mitigation = vuln["solution"]
 
         return finding
+
+    def prepare_request_response(self, evidence):
+        if evidence == []:
+            return None, None
+        request = evidence.get("request")
+        request_headers = request.get("headers", [])
+        reqHeaders = ""
+        for header in request_headers:
+            reqHeaders += "                name: " + header["name"] + " | value: " + header["value"] + "\n"
+        returnrequest = "Request Headers:\n" + str(reqHeaders) + "\nRequest Method: " + str(request.get("method")) + "\nRequest URL: " + str(request.get("url"))
+        response = evidence.get("response")
+        response_headers = response.get("headers", [])
+        respHeaders = ""
+        for header in response_headers:
+            respHeaders += "                name: " + header["name"] + " | value: " + header["value"] + "\n"
+        returnresponse = "Response Headers:\n" + str(respHeaders) + "\nResponse Phrase: " + str(response.get("reason_phrase")) + "\nResponse Status Code: " + str(response.get("status_code"))
+        return returnrequest, returnresponse

unittests/scans/gitlab_dast/issue_12050.json

@@ -0,0 +1,112 @@
+{
+    "__comment__": "This is a cut of from the test_api_scan.json",
+    "vulnerabilities": [
+      {
+        "category": "dast",
+        "confidence": "High",
+        "cve": "10062",
+        "description": "The response contains Personally Identifiable Information, such as CC number, SSN and similar sensitive data.",
+        "discovered_at": "2021-04-23T15:46:40.615",
+        "evidence": {
+          "request": {
+            "headers": [
+              {
+                "name": "Accept",
+                "value": "*/*"
+              },
+              {
+                "name": "Authorization",
+                "value": "********"
+              },
+              {
+                "name": "Cache-Control",
+                "value": "no-cache"
+              },
+              {
+                "name": "Content-Length",
+                "value": "0"
+              },
+              {
+                "name": "Host",
+                "value": "api-server"
+              },
+              {
+                "name": "Pragma",
+                "value": "no-cache"
+              },
+              {
+                "name": "User-Agent",
+                "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0"
+              }
+            ],
+            "method": "GET",
+            "url": "http://api-server/v1/trees"
+          },
+          "response": {
+            "headers": [
+              {
+                "name": "Accept",
+                "value": "*/*"
+              },
+              {
+                "name": "Authorization",
+                "value": "********"
+              },
+              {
+                "name": "Cache-Control",
+                "value": "no-cache"
+              },
+              {
+                "name": "Content-Length",
+                "value": "0"
+              },
+              {
+                "name": "Host",
+                "value": "api-server"
+              },
+              {
+                "name": "Pragma",
+                "value": "no-cache"
+              },
+              {
+                "name": "User-Agent",
+                "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0"
+              }
+            ],
+            "reason_phrase": "OK",
+            "status_code": 200
+          },
+          "summary": "378282246310005; Credit Card Type detected: American Express Bank Identification Number: 378282 Brand: AMERICAN EXPRESS Category: SMALL CORPORATE Issuer: AMERICAN EXPRESS COMPANY"
+        },
+        "id": "5ec00bbc-2e53-44cb-83e9-3d35365277e3",
+        "identifiers": [
+          {
+            "name": "PII Disclosure",
+            "type": "ZAProxy_PluginId",
+            "url": "https://github.com/zaproxy/zaproxy/blob/w2019-01-14/docs/scanners.md",
+            "value": "10062"
+          },
+          {
+            "name": "CWE-359",
+            "type": "CWE",
+            "url": "https://cwe.mitre.org/data/definitions/359.html",
+            "value": "359"
+          }
+        ],
+        "links": [],
+        "location": {
+          "hostname": "http://api-server",
+          "method": "GET",
+          "param": "",
+          "path": "/v1/trees"
+        },
+        "message": "PII Disclosure",
+        "scanner": {
+          "id": "zaproxy",
+          "name": "ZAProxy"
+        },
+        "severity": "High",
+        "solution": ""
+      }
+    ]
+  }

unittests/tools/test_gitlab_dast_parser.py

@@ -141,3 +141,19 @@ def test_parse_file_with_multiple_vuln_has_multiple_findings_v15(self):
             self.assertEqual(endpoint.port, 80)
             self.assertEqual(endpoint.path, "v1/tree/10")
             self.assertIn("Ensure that your web server,", finding.mitigation)
+
+    def test_parse_file_issue_12050(self):
+        with open(get_unit_tests_scans_path("gitlab_dast") / "issue_12050.json", encoding="utf-8") as testfile:
+            parser = GitlabDastParser()
+            findings = parser.get_findings(testfile, Test())
+            self.assertEqual(1, len(findings))
+            # check req/resp
+            finding = findings[0]
+            self.assertEqual(1, len(finding.unsaved_req_resp))
+            req_resp = finding.unsaved_req_resp[0]
+            self.assertIn("req", req_resp)
+            self.assertIsNotNone(req_resp["req"])
+            self.assertIsInstance(req_resp["req"], str)
+            self.assertIn("resp", req_resp)
+            self.assertIsNotNone(req_resp["resp"])
+            self.assertIsInstance(req_resp["resp"], str)