Skip to content

Commit 9088260

Browse files
svkirillovsvkirillov
authored
Add hide args in report option (#261)
* Fix Makefile * Add new flag * Fix report pkg * Fix report validator * Update new arg name
1 parent 338000b commit 9088260

File tree

9 files changed

+42
-29
lines changed

9 files changed

+42
-29
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
GOTESTWAF_VERSION := $(shell git describe)
1+
GOTESTWAF_VERSION := $(shell git describe --tags)
22

33
gotestwaf:
44
DOCKER_BUILDKIT=1 docker build --force-rm -t gotestwaf .

‎README.md

+11-10
Original file line numberDiff line numberDiff line change
@@ -363,41 +363,42 @@ Usage: ./gotestwaf [OPTIONS] --url <URL>
363363
Options:
364364
--addDebugHeader Add header with a hash of the test information in each request
365365
--addHeader string An HTTP header to add to requests
366-
--blockConnReset If true, connection resets will be considered as block
366+
--blockConnReset If present, connection resets will be considered as block
367367
--blockRegex string Regex to detect a blocking page with the same HTTP response status code as a not blocked request
368368
--blockStatusCodes ints HTTP status code that WAF uses while blocking requests (default [403])
369369
--configPath string Path to the config file (default "config.yaml")
370370
--email string E-mail to which the report will be sent
371-
--followCookies If true, use cookies sent by the server. May work only with --maxIdleConns=1 (gohttp only)
371+
--followCookies If present, use cookies sent by the server. May work only with --maxIdleConns=1 (gohttp only)
372372
--graphqlURL string GraphQL URL to check
373373
--grpcPort uint16 gRPC port to check
374-
--httpClient string Which HTTP client use to send requests: chrome, gohttp (default "gohttp")
374+
--hideArgsInReport If present, GoTestWAF CLI arguments will not be displayed in the report
375+
--httpClient string Which HTTP client use to send requests: gohttp, chrome (default "gohttp")
375376
--idleConnTimeout int The maximum amount of time a keep-alive connection will live (gohttp only) (default 2)
376-
--ignoreUnresolved If true, unresolved test cases will be considered as bypassed (affect score and results)
377-
--includePayloads If true, payloads will be included in HTML/PDF report
377+
--ignoreUnresolved If present, unresolved test cases will be considered as bypassed (affect score and results)
378+
--includePayloads If present, payloads will be included in HTML/PDF report
378379
--logFormat string Set logging format: text, json (default "text")
379380
--logLevel string Logging level: panic, fatal, error, warn, info, debug, trace (default "info")
380381
--maxIdleConns int The maximum number of keep-alive connections (gohttp only) (default 2)
381382
--maxRedirects int The maximum number of handling redirects (gohttp only) (default 50)
382383
--noEmailReport Save report locally
383-
--nonBlockedAsPassed If true, count requests that weren't blocked as passed. If false, requests that don't satisfy to PassStatusCodes/PassRegExp as blocked
384+
--nonBlockedAsPassed If present, count requests that weren't blocked as passed. If false, requests that don't satisfy to PassStatusCodes/PassRegExp as blocked
384385
--openapiFile string Path to openAPI file
385386
--passRegex string Regex to a detect normal (not blocked) web page with the same HTTP status code as a blocked request
386387
--passStatusCodes ints HTTP response status code that WAF uses while passing requests (default [200,404])
387388
--proxy string Proxy URL to use
388-
--quiet If true, disable verbose logging
389+
--quiet If present, disable verbose logging
389390
--randomDelay int Random delay in ms in addition to the delay between requests (default 400)
390391
--renewSession Renew cookies before each test. Should be used with --followCookies flag (gohttp only)
391-
--reportFormat string Export report to one of the following formats: none, pdf, html, json (default "pdf")
392+
--reportFormat strings Export report in the following formats: json, html, pdf, none (default [pdf])
392393
--reportName string Report file name. Supports `time' package template format (default "waf-evaluation-report-2006-January-02-15-04-05")
393394
--reportPath string A directory to store reports (default "reports")
394395
--sendDelay int Delay in ms between requests (default 400)
395-
--skipWAFBlockCheck If true, WAF detection tests will be skipped
396+
--skipWAFBlockCheck If present, WAF detection tests will be skipped
396397
--skipWAFIdentification Skip WAF identification
397398
--testCase string If set then only this test case will be run
398399
--testCasesPath string Path to a folder with test cases (default "testcases")
399400
--testSet string If set then only this test set's cases will be run
400-
--tlsVerify If true, the received TLS certificate will be verified
401+
--tlsVerify If present, the received TLS certificate will be verified
401402
--url string URL to check
402403
--version Show GoTestWAF version and exit
403404
--wafName string Name of the WAF product (default "generic")

‎cmd/gotestwaf/flags.go

+9-8
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ func parseFlags() (args []string, err error) {
9393

9494
// General parameters
9595
flag.StringVar(&configPath, "configPath", defaultConfigPath, "Path to the config file")
96-
flag.BoolVar(&quiet, "quiet", false, "If true, disable verbose logging")
96+
flag.BoolVar(&quiet, "quiet", false, "If present, disable verbose logging")
9797
logLvl := flag.String("logLevel", "info", "Logging level: panic, fatal, error, warn, info, debug, trace")
9898
flag.StringVar(&logFormat, "logFormat", textLogFormat, "Set logging format: "+strings.Join(logFormats, ", "))
9999
showVersion := flag.Bool("version", false, "Show GoTestWAF version and exit")
@@ -111,7 +111,7 @@ func parseFlags() (args []string, err error) {
111111

112112
// HTTP client settings
113113
httpClient := flag.String("httpClient", gohttpClient, "Which HTTP client use to send requests: "+strings.Join(httpClients, ", "))
114-
flag.Bool("tlsVerify", false, "If true, the received TLS certificate will be verified")
114+
flag.Bool("tlsVerify", false, "If present, the received TLS certificate will be verified")
115115
flag.String("proxy", "", "Proxy URL to use")
116116
flag.String("addHeader", "", "An HTTP header to add to requests")
117117
flag.Bool("addDebugHeader", false, "Add header with a hash of the test information in each request")
@@ -120,7 +120,7 @@ func parseFlags() (args []string, err error) {
120120
flag.Int("maxIdleConns", 2, "The maximum number of keep-alive connections (gohttp only)")
121121
flag.Int("maxRedirects", 50, "The maximum number of handling redirects (gohttp only)")
122122
flag.Int("idleConnTimeout", 2, "The maximum amount of time a keep-alive connection will live (gohttp only)")
123-
flag.Bool("followCookies", false, "If true, use cookies sent by the server. May work only with --maxIdleConns=1 (gohttp only)")
123+
flag.Bool("followCookies", false, "If present, use cookies sent by the server. May work only with --maxIdleConns=1 (gohttp only)")
124124
flag.Bool("renewSession", false, "Renew cookies before each test. Should be used with --followCookies flag (gohttp only)")
125125

126126
// Performance settings
@@ -129,7 +129,7 @@ func parseFlags() (args []string, err error) {
129129
flag.Int("randomDelay", 400, "Random delay in ms in addition to the delay between requests")
130130

131131
// Analysis settings
132-
flag.Bool("skipWAFBlockCheck", false, "If true, WAF detection tests will be skipped")
132+
flag.Bool("skipWAFBlockCheck", false, "If present, WAF detection tests will be skipped")
133133
flag.Bool("skipWAFIdentification", false, "Skip WAF identification")
134134
flag.IntSlice("blockStatusCodes", []int{403}, "HTTP status code that WAF uses while blocking requests")
135135
flag.IntSlice("passStatusCodes", []int{200, 404}, "HTTP response status code that WAF uses while passing requests")
@@ -138,18 +138,19 @@ func parseFlags() (args []string, err error) {
138138
passRegex := flag.String("passRegex", "",
139139
"Regex to a detect normal (not blocked) web page with the same HTTP status code as a blocked request")
140140
flag.Bool("nonBlockedAsPassed", false,
141-
"If true, count requests that weren't blocked as passed. If false, requests that don't satisfy to PassStatusCodes/PassRegExp as blocked")
142-
flag.Bool("ignoreUnresolved", false, "If true, unresolved test cases will be considered as bypassed (affect score and results)")
143-
flag.Bool("blockConnReset", false, "If true, connection resets will be considered as block")
141+
"If present, count requests that weren't blocked as passed. If false, requests that don't satisfy to PassStatusCodes/PassRegExp as blocked")
142+
flag.Bool("ignoreUnresolved", false, "If present, unresolved test cases will be considered as bypassed (affect score and results)")
143+
flag.Bool("blockConnReset", false, "If present, connection resets will be considered as block")
144144

145145
// Report settings
146146
flag.String("wafName", wafName, "Name of the WAF product")
147-
flag.Bool("includePayloads", false, "If true, payloads will be included in HTML/PDF report")
147+
flag.Bool("includePayloads", false, "If present, payloads will be included in HTML/PDF report")
148148
flag.String("reportPath", reportPath, "A directory to store reports")
149149
reportName := flag.String("reportName", defaultReportName, "Report file name. Supports `time' package template format")
150150
reportFormat := flag.StringSlice("reportFormat", []string{report.PdfFormat}, "Export report in the following formats: "+strings.Join(report.ReportFormats, ", "))
151151
noEmailReport := flag.Bool("noEmailReport", false, "Save report locally")
152152
email := flag.String("email", "", "E-mail to which the report will be sent")
153+
flag.Bool("hideArgsInReport", false, "If present, GoTestWAF CLI arguments will not be displayed in the report")
153154

154155
flag.Parse()
155156

‎cmd/gotestwaf/main.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,10 @@ func main() {
6161
logger.WithError(err).Error("couldn't load config")
6262
os.Exit(1)
6363
}
64-
cfg.Args = args
64+
65+
if !cfg.HideArgsInReport {
66+
cfg.Args = args
67+
}
6568

6669
if err := run(ctx, cfg, logger); err != nil {
6770
logger.WithError(err).Error("caught error in main function")

‎internal/config/config.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,14 @@ type Config struct {
4747
BlockConnReset bool `mapstructure:"blockConnReset"`
4848

4949
// Report settings
50-
WAFName string `mapstructure:"wafName"`
51-
IncludePayloads bool `mapstructure:"includePayloads"`
52-
ReportPath string `mapstructure:"reportPath"`
53-
ReportName string `mapstructure:"reportName"`
54-
ReportFormat []string `mapstructure:"reportFormat"`
55-
NoEmailReport bool `mapstructure:"noEmailReport"`
56-
Email string `mapstructure:"email"`
50+
WAFName string `mapstructure:"wafName"`
51+
IncludePayloads bool `mapstructure:"includePayloads"`
52+
ReportPath string `mapstructure:"reportPath"`
53+
ReportName string `mapstructure:"reportName"`
54+
ReportFormat []string `mapstructure:"reportFormat"`
55+
NoEmailReport bool `mapstructure:"noEmailReport"`
56+
Email string `mapstructure:"email"`
57+
HideArgsInReport bool `mapstructure:"hideArgsInReport"`
5758

5859
// config.yaml
5960
HTTPHeaders map[string]string `mapstructure:"headers"`

‎pkg/report/html.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ type HtmlReport struct {
2626
GtwVersion string `json:"gtw_version" validate:"required,gtw_version"`
2727
TestCasesFP string `json:"test_cases_fp" validate:"required,fp"`
2828
OpenApiFile string `json:"open_api_file" validate:"omitempty,printascii,max=512"`
29-
Args []string `json:"args" validate:"required,max=50,dive,args,max=200"`
29+
Args []string `json:"args" validate:"omitempty,max=50,dive,args,max=200"`
3030

3131
ApiSecChartData struct {
3232
Indicators []string `json:"indicators" validate:"omitempty,max=100,dive,indicator"`

‎pkg/report/report_template.html

+2
Original file line numberDiff line numberDiff line change
@@ -399,10 +399,12 @@ <h4 class="grade__title">Overall grade:</h4>
399399
<span class="row__content">{{.OpenApiFile}}</span>
400400
<br>
401401
{{end}}
402+
{{$length := len $.Args}}{{if ne $length 0}}
402403
<span class="row__name">Used arguments</span>
403404
:
404405
<span class="row__args mono">{{StringsJoin .Args " "}}</span>
405406
<br>
407+
{{end}}
406408
</div>
407409
</div>
408410
<!--<div class="desc__text">

‎pkg/report/validator.go

+5
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ func validateIndicator(fl validator.FieldLevel) bool {
7373

7474
func validateArgs(fl validator.FieldLevel) bool {
7575
args := fl.Field().String()
76+
77+
if len(args) == 0 {
78+
return true
79+
}
80+
7681
result := argsRegex.MatchString(args)
7782

7883
return result

‎pkg/report/validator_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ func TestCustomValidators(t *testing.T) {
131131
{tag: "indicator", field: "ApiSecChartData.Indicators", setter: setIndicator, value: "some indicator (100.0%)", isBad: false},
132132

133133
// args, bad
134-
{tag: "args", field: "Args", setter: setArgs, value: "", isBad: true},
134+
{tag: "args", field: "Args", setter: setArgs, value: "", isBad: false},
135135
{tag: "args", field: "Args", setter: setArgs, value: "lkajdf", isBad: true},
136136
{tag: "args", field: "Args", setter: setArgs, value: "-a", isBad: true},
137137
{tag: "args", field: "Args", setter: setArgs, value: "-lkajdf", isBad: true},

0 commit comments

Comments
 (0)