Owasp-Zap Securiy Testing Using azure pipeline?

regarding the Zap security 0
Viewed 34

This is the reference doc I have followed to set up the Azure pipeline https://medium.com/adessoturkey/owasp-zap-security-tests-in-azure-devops-fe891f5402a4

below i am sharing screenshort of the pipeline failed:

enter image description here

Could you please help here to resolve the issue I have exactly followed the medium article to implement the task....

Those who aware on this could you please share your taughts.

This is the pipeline script i am using.

trigger: none

stages:

  • stage: 'buildstage' jobs:

    • job: buildjob pool: vmImage: ubuntu-latest steps:

      - checkout: self

      - checkout: owasap-zap

      • bash: "docker run -d -p 80:80 nginx:1.14.2" displayName: "App Container"

      • bash: | chmod -R 777 ./ docker run --rm -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable zap-full-scan.py -t http://$(ip -f inet -o addr show docker0 | awk '{print $4}' | cut -d '/' -f 1):80 -x xml_report.xml true displayName: "Owasp Container Scan"

      - displayName: "PowerShell Script"

      • powershell: | $XslPath = "owasp-zap/xml_to_nunit.xslt" $XmlInputPath = "xml_report.xml" $XmlOutputPath = "converted_report.xml" $XslTransform = New-Object System.Xml.Xsl.XslCompiledTransform $XslTransform.Load($XslPath) $XslTransform.Transform($XmlInputPath, $XmlOutputPath) displayName: "PowerShell Script"

      • task: PublishTestResults@2 displayName: "Publish Test Results" inputs: testResultsFiles: converted_report.xml testResultsFormat: NUnit # task: PublishTestResults@2

      stage: buildstage

zap azure-devops azure
1 Answers

According to the YAML file, you want to checkout multiple repositories in your pipeline, but it seems you haven't define a repository resource like mentioned in the document you shared.

resources:
  repositories:
    - repository: <repo_name>
      type: git
      name: <project_name>/<repo_name>
      ref: refs/heads/master

And according to the screenshot you shared, you only checkout out one repo. Which cause the location of file xml_to_nunit.xslt is different from owasp-zap/xml_to_nunit.xslt. If you only checkout one repo, the location of xml_to_nunit.xslt should be current directory, thus, just define $XslPath in the PowerShell script as "xml_to_nunit.xslt".

Edit

If the repository that contain "xml_to_nunit.xslt" file is in the same organization as the repository run for your pipeline, you need to checkout the repository by using Inline syntax checkout like below or define repository resource.

- checkout: git://MyProject/MyRepo # Azure Repos Git repository in the same organization

You could also add one more command ls before the PowerShell script to list the files in current directory. Aim to figure out where is "xml_to_nunit.xslt".

enter image description here

Suki Ji-MSFT0
Related