Skip to content

Commit 29b8e89

Browse files
committed
Update APIs of add-ons and core
Update core APIs for 2.17.0. Add the API of the following add-on: - Client Side Integration version 0.20.0; - Postman Support version 0.7.0. Update the APIs of the following add-ons: - Automation Framework version 0.58.0; - OpenAPI Support version 48; - Passive Scanner version 0.6.0; - Selenium version 15.43.0; - Spider version 0.18.0. Signed-off-by: thc202 <thc202@gmail.com>
1 parent 6813063 commit 29b8e89

File tree

13 files changed

+295
-21
lines changed

13 files changed

+295
-21
lines changed

CHANGELOG.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
55

66
## [Unreleased]
7+
### Added
8+
- Add the API of the following add-on:
9+
- Postman Support version 0.7.0.
10+
11+
### Changed
12+
- Update core APIs for 2.17.
13+
- Update the APIs of the following add-ons:
14+
- Automation Framework version 0.58.0;
15+
- OpenAPI Support version 48;
16+
- Passive Scanner version 0.6.0;
17+
- Selenium version 15.43.0;
18+
- Spider version 0.18.0.
719

820
## [0.4.0] - 2025-01-20
921
### Changed

src/zapv2/__init__.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@
3636
from .automation import automation
3737
from .autoupdate import autoupdate
3838
from .brk import brk
39+
from .client import client
40+
from .clientSpider import clientSpider
3941
from .context import context
4042
from .core import core
4143
from .custompayloads import custompayloads
@@ -49,6 +51,7 @@
4951
from .openapi import openapi
5052
from .params import params
5153
from .pnh import pnh
54+
from .postman import postman
5255
from .pscan import pscan
5356
from .replacer import replacer
5457
from .reports import reports
@@ -103,6 +106,8 @@ def __init__(self, proxies=None, apikey=None, validate_status_code=False):
103106
self.automation = automation(self)
104107
self.autoupdate = autoupdate(self)
105108
self.brk = brk(self)
109+
self.client = client(self)
110+
self.clientSpider = clientSpider(self)
106111
self.context = context(self)
107112
self.core = core(self)
108113
self.custompayloads = custompayloads(self)
@@ -116,6 +121,7 @@ def __init__(self, proxies=None, apikey=None, validate_status_code=False):
116121
self.openapi = openapi(self)
117122
self.params = params(self)
118123
self.pnh = pnh(self)
124+
self.postman = postman(self)
119125
self.pscan = pscan(self)
120126
self.replacer = replacer(self)
121127
self.reports = reports(self)

src/zapv2/alert.py

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ def alert(self, id):
3333
"""
3434
return six.next(six.itervalues(self.zap._request(self.zap.base + 'alert/view/alert/', {'id': id})))
3535

36-
def alerts(self, baseurl=None, start=None, count=None, riskid=None, contextname=None):
36+
def alerts(self, baseurl=None, start=None, count=None, riskid=None, contextname=None, falsepositive=None):
3737
"""
3838
Gets the alerts raised by ZAP, optionally filtering by URL or riskId, and paginating with 'start' position and 'count' of alerts
3939
"""
@@ -48,6 +48,8 @@ def alerts(self, baseurl=None, start=None, count=None, riskid=None, contextname=
4848
params['riskId'] = riskid
4949
if contextname is not None:
5050
params['contextName'] = contextname
51+
if falsepositive is not None:
52+
params['falsePositive'] = falsepositive
5153
return six.next(six.itervalues(self.zap._request(self.zap.base + 'alert/view/alerts/', params)))
5254

5355
def alerts_summary(self, baseurl=None):

src/zapv2/alertFilter.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ def global_alert_filter_list(self):
4444

4545
def add_alert_filter(self, contextid, ruleid, newlevel, url=None, urlisregex=None, parameter=None, enabled=None, parameterisregex=None, attack=None, attackisregex=None, evidence=None, evidenceisregex=None, methods=None, apikey=''):
4646
"""
47-
Adds a new alert filter for the context with the given ID.
47+
Adds a new alert filter for the context with the given ID.
4848
This component is optional and therefore the API will only work if it is installed
4949
"""
5050
params = {'contextId': contextid, 'ruleId': ruleid, 'newLevel': newlevel}
@@ -100,7 +100,7 @@ def remove_alert_filter(self, contextid, ruleid, newlevel, url=None, urlisregex=
100100

101101
def add_global_alert_filter(self, ruleid, newlevel, url=None, urlisregex=None, parameter=None, enabled=None, parameterisregex=None, attack=None, attackisregex=None, evidence=None, evidenceisregex=None, methods=None, apikey=''):
102102
"""
103-
Adds a new global alert filter.
103+
Adds a new global alert filter.
104104
This component is optional and therefore the API will only work if it is installed
105105
"""
106106
params = {'ruleId': ruleid, 'newLevel': newlevel}

src/zapv2/ascan.py

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,13 +247,27 @@ def option_encode_cookie_values(self):
247247
"""
248248
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/view/optionEncodeCookieValues/')))
249249

250+
@property
251+
def option_exclude_anti_csrf_tokens(self):
252+
"""
253+
Tells whether or not the active scanner should exclude anti-csrf tokens from the scan.
254+
"""
255+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/view/optionExcludeAntiCsrfTokens/')))
256+
250257
@property
251258
def option_inject_plugin_id_in_header(self):
252259
"""
253260
Tells whether or not the active scanner should inject the HTTP request header X-ZAP-Scan-ID, with the ID of the scan rule that's sending the requests.
254261
"""
255262
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/view/optionInjectPluginIdInHeader/')))
256263

264+
@property
265+
def option_persist_temporary_messages(self):
266+
"""
267+
Tells whether or not the temporary HTTP messages sent while active scanning should be persisted.
268+
"""
269+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/view/optionPersistTemporaryMessages/')))
270+
257271
@property
258272
def option_prompt_in_attack_mode(self):
259273
"""
@@ -585,6 +599,12 @@ def set_option_encode_cookie_values(self, boolean, apikey=''):
585599
"""
586600
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/action/setOptionEncodeCookieValues/', {'Boolean': boolean})))
587601

602+
def set_option_exclude_anti_csrf_tokens(self, boolean, apikey=''):
603+
"""
604+
Sets whether or not the active scanner should exclude anti-csrf tokens from the scan.
605+
"""
606+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/action/setOptionExcludeAntiCsrfTokens/', {'Boolean': boolean})))
607+
588608
def set_option_handle_anti_csrf_tokens(self, boolean, apikey=''):
589609
"""
590610
@@ -639,6 +659,12 @@ def set_option_max_scans_in_ui(self, integer, apikey=''):
639659
"""
640660
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/action/setOptionMaxScansInUI/', {'Integer': integer})))
641661

662+
def set_option_persist_temporary_messages(self, boolean, apikey=''):
663+
"""
664+
Sets whether or not the temporary HTTP messages sent while active scanning should be persisted.
665+
"""
666+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'ascan/action/setOptionPersistTemporaryMessages/', {'Boolean': boolean})))
667+
642668
def set_option_prompt_in_attack_mode(self, boolean, apikey=''):
643669
"""
644670

src/zapv2/automation.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,28 @@ def __init__(self, zap):
2929

3030
def plan_progress(self, planid):
3131
"""
32+
Returns the progress details for the specified planId
3233
This component is optional and therefore the API will only work if it is installed
3334
"""
3435
return (self.zap._request(self.zap.base + 'automation/view/planProgress/', {'planId': planid}))
3536

3637
def run_plan(self, filepath, apikey=''):
3738
"""
39+
Loads and asynchronously runs the plan in the specified file, returning a planId
3840
This component is optional and therefore the API will only work if it is installed
3941
"""
4042
return six.next(six.itervalues(self.zap._request(self.zap.base + 'automation/action/runPlan/', {'filePath': filepath})))
4143

44+
def stop_plan(self, planid, apikey=''):
45+
"""
46+
Stops the running plan identified by the planId
47+
This component is optional and therefore the API will only work if it is installed
48+
"""
49+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'automation/action/stopPlan/', {'planId': planid})))
50+
4251
def end_delay_job(self, apikey=''):
4352
"""
53+
Ends the currently running delay job, if any
4454
This component is optional and therefore the API will only work if it is installed
4555
"""
4656
return six.next(six.itervalues(self.zap._request(self.zap.base + 'automation/action/endDelayJob/', {})))

src/zapv2/client.py

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Zed Attack Proxy (ZAP) and its related class files.
2+
#
3+
# ZAP is an HTTP/HTTPS proxy for assessing web application security.
4+
#
5+
# Copyright 2025 the ZAP development team
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
"""
19+
This file was automatically generated.
20+
"""
21+
22+
import six
23+
24+
25+
class client(object):
26+
27+
def __init__(self, zap):
28+
self.zap = zap
29+
30+
def report_object(self, objectjson, apikey=''):
31+
"""
32+
This component is optional and therefore the API will only work if it is installed
33+
"""
34+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'client/action/reportObject/', {'objectJson': objectjson})))
35+
36+
def report_event(self, eventjson, apikey=''):
37+
"""
38+
This component is optional and therefore the API will only work if it is installed
39+
"""
40+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'client/action/reportEvent/', {'eventJson': eventjson})))
41+
42+
def report_zest_statement(self, statementjson, apikey=''):
43+
"""
44+
This component is optional and therefore the API will only work if it is installed
45+
"""
46+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'client/action/reportZestStatement/', {'statementJson': statementjson})))
47+
48+
def report_zest_script(self, scriptjson, apikey=''):
49+
"""
50+
This component is optional and therefore the API will only work if it is installed
51+
"""
52+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'client/action/reportZestScript/', {'scriptJson': scriptjson})))
53+
54+
def export_client_map(self, pathyaml, apikey=''):
55+
"""
56+
Exports the Client Map to a file.
57+
This component is optional and therefore the API will only work if it is installed
58+
"""
59+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'client/action/exportClientMap/', {'pathYaml': pathyaml})))

src/zapv2/clientSpider.py

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Zed Attack Proxy (ZAP) and its related class files.
2+
#
3+
# ZAP is an HTTP/HTTPS proxy for assessing web application security.
4+
#
5+
# Copyright 2025 the ZAP development team
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
"""
19+
This file was automatically generated.
20+
"""
21+
22+
import six
23+
24+
25+
class clientSpider(object):
26+
27+
def __init__(self, zap):
28+
self.zap = zap
29+
30+
def status(self, scanid):
31+
"""
32+
Gets the status of a client spider scan.
33+
This component is optional and therefore the API will only work if it is installed
34+
"""
35+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'clientSpider/view/status/', {'scanId': scanid})))
36+
37+
def scan(self, browser=None, url=None, contextname=None, username=None, subtreeonly=None, maxcrawldepth=None, pageloadtime=None, numberofbrowsers=None, scopecheck=None, apikey=''):
38+
"""
39+
Starts a client spider scan.
40+
This component is optional and therefore the API will only work if it is installed
41+
"""
42+
params = {}
43+
if browser is not None:
44+
params['browser'] = browser
45+
if url is not None:
46+
params['url'] = url
47+
if contextname is not None:
48+
params['contextName'] = contextname
49+
if username is not None:
50+
params['userName'] = username
51+
if subtreeonly is not None:
52+
params['subtreeOnly'] = subtreeonly
53+
if maxcrawldepth is not None:
54+
params['maxCrawlDepth'] = maxcrawldepth
55+
if pageloadtime is not None:
56+
params['pageLoadTime'] = pageloadtime
57+
if numberofbrowsers is not None:
58+
params['numberOfBrowsers'] = numberofbrowsers
59+
if scopecheck is not None:
60+
params['scopeCheck'] = scopecheck
61+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'clientSpider/action/scan/', params)))
62+
63+
def stop(self, scanid, apikey=''):
64+
"""
65+
Stops a client spider scan.
66+
This component is optional and therefore the API will only work if it is installed
67+
"""
68+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'clientSpider/action/stop/', {'scanId': scanid})))

src/zapv2/openapi.py

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ class openapi(object):
2727
def __init__(self, zap):
2828
self.zap = zap
2929

30-
def import_file(self, file, target=None, contextid=None, apikey=''):
30+
def import_file(self, file, target=None, contextid=None, userid=None, apikey=''):
3131
"""
3232
Imports an OpenAPI definition from a local file.
3333
This component is optional and therefore the API will only work if it is installed
@@ -37,9 +37,11 @@ def import_file(self, file, target=None, contextid=None, apikey=''):
3737
params['target'] = target
3838
if contextid is not None:
3939
params['contextId'] = contextid
40+
if userid is not None:
41+
params['userId'] = userid
4042
return six.next(six.itervalues(self.zap._request(self.zap.base + 'openapi/action/importFile/', params)))
4143

42-
def import_url(self, url, hostoverride=None, contextid=None, apikey=''):
44+
def import_url(self, url, hostoverride=None, contextid=None, userid=None, apikey=''):
4345
"""
4446
Imports an OpenAPI definition from a URL.
4547
This component is optional and therefore the API will only work if it is installed
@@ -49,4 +51,6 @@ def import_url(self, url, hostoverride=None, contextid=None, apikey=''):
4951
params['hostOverride'] = hostoverride
5052
if contextid is not None:
5153
params['contextId'] = contextid
54+
if userid is not None:
55+
params['userId'] = userid
5256
return six.next(six.itervalues(self.zap._request(self.zap.base + 'openapi/action/importUrl/', params)))

src/zapv2/postman.py

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Zed Attack Proxy (ZAP) and its related class files.
2+
#
3+
# ZAP is an HTTP/HTTPS proxy for assessing web application security.
4+
#
5+
# Copyright 2025 the ZAP development team
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License");
8+
# you may not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
"""
19+
This file was automatically generated.
20+
"""
21+
22+
import six
23+
24+
25+
class postman(object):
26+
27+
def __init__(self, zap):
28+
self.zap = zap
29+
30+
def import_file(self, file, apikey=''):
31+
"""
32+
Imports a Postman collection from a file.
33+
This component is optional and therefore the API will only work if it is installed
34+
"""
35+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'postman/action/importFile/', {'file': file})))
36+
37+
def import_url(self, url, apikey=''):
38+
"""
39+
Imports a Postman collection from a URL.
40+
This component is optional and therefore the API will only work if it is installed
41+
"""
42+
return six.next(six.itervalues(self.zap._request(self.zap.base + 'postman/action/importUrl/', {'url': url})))

0 commit comments

Comments
 (0)