29 lines
1.1 KiB
Groovy
29 lines
1.1 KiB
Groovy
|
// Chalti hui app par hamla karke dekhta hai (dynamic testing).
|
||
|
|
// SAST code padhta hai, Trivy packages dekhta hai - ye dono wo nahi pakadte
|
||
|
|
// jo sirf running app me dikhta hai: missing security headers, khuli
|
||
|
|
// directory listing, cookie flags, etc.
|
||
|
|
def call() {
|
||
|
|
sh '''
|
||
|
|
set +e
|
||
|
|
CID=$(docker run -d --name "dast-$BUILD_NUMBER" "$FULL_IMAGE")
|
||
|
|
trap "docker rm -f $CID >/dev/null 2>&1" EXIT
|
||
|
|
sleep 6
|
||
|
|
|
||
|
|
mkdir -p zap-report && chmod 777 zap-report
|
||
|
|
|
||
|
|
# ZAP app ke hi network namespace me chalta hai - to 127.0.0.1 par
|
||
|
|
# app seedha mil jaata hai, koi extra network banane ki zarurat nahi.
|
||
|
|
docker run --rm \
|
||
|
|
--network "container:$CID" \
|
||
|
|
-v "$PWD/zap-report":/zap/wrk:rw \
|
||
|
|
"$IMG_ZAP" zap-baseline.py \
|
||
|
|
-t "http://127.0.0.1:${APP_PORT}" \
|
||
|
|
-r zap-report.html -J zap-report.json \
|
||
|
|
-I -m 2
|
||
|
|
RC=$?
|
||
|
|
echo " zap exit: $RC (0=clean, 1=FAIL mila, 2=warning only)"
|
||
|
|
exit $RC
|
||
|
|
'''
|
||
|
|
archiveArtifacts artifacts: 'zap-report/zap-report.*', allowEmptyArchive: true
|
||
|
|
}
|