dradis-burp 3.12.0 → 3.17.0

data/templates/issue.fields

@@ -1,7 +1,8 @@
-issue.name
 issue.background
-issue.remediation_background
 issue.detail
-issue.remediation_detail
+issue.name
 issue.references
+issue.remediation_background
+issue.remediation_detail
+issue.severity
 issue.vulnerability_classifications

data/templates/issue.template

@@ -2,6 +2,10 @@
 %issue.name%
 
 
+#[Severity]#
+%issue.severity%
+
+
 #[Background]#
 %issue.background%
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-burp
 version: !ruby/object:Gem::Version
-  version: 3.12.0
+  version: 3.17.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-01 00:00:00.000000000 Z
+date: 2020-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -42,16 +42,16 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -102,6 +102,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/issue_template.md"
+- ".github/pull_request_template.md"
 - ".gitignore"
 - ".rspec"
 - CHANGELOG.md
@@ -111,23 +113,31 @@ files:
 - README.md
 - Rakefile
 - dradis-burp.gemspec
+- lib/burp/html/issue.rb
 - lib/burp/issue.rb
+- lib/burp/xml/issue.rb
 - lib/dradis-burp.rb
 - lib/dradis/plugins/burp.rb
 - lib/dradis/plugins/burp/engine.rb
 - lib/dradis/plugins/burp/field_processor.rb
 - lib/dradis/plugins/burp/gem_version.rb
-- lib/dradis/plugins/burp/importer.rb
+- lib/dradis/plugins/burp/html/importer.rb
 - lib/dradis/plugins/burp/version.rb
+- lib/dradis/plugins/burp/xml/importer.rb
 - lib/tasks/thorfile.rb
 - spec/burp_upload_spec.rb
+- spec/fixtures/files/burp.html
 - spec/fixtures/files/burp.xml
+- spec/fixtures/files/burp_issue_severity.xml
 - spec/fixtures/files/invalid-utf-issue.xml
 - spec/fixtures/files/without-base64.xml
 - spec/spec_helper.rb
 - templates/evidence.fields
 - templates/evidence.sample
 - templates/evidence.template
+- templates/html_evidence.fields
+- templates/html_evidence.sample
+- templates/html_evidence.template
 - templates/issue.fields
 - templates/issue.sample
 - templates/issue.template
@@ -150,14 +160,15 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.12
+rubygems_version: 3.0.1
 signing_key: 
 specification_version: 4
 summary: Burp Scanner upload plugin for the Dradis Framework.
 test_files:
 - spec/burp_upload_spec.rb
+- spec/fixtures/files/burp.html
 - spec/fixtures/files/burp.xml
+- spec/fixtures/files/burp_issue_severity.xml
 - spec/fixtures/files/invalid-utf-issue.xml
 - spec/fixtures/files/without-base64.xml
 - spec/spec_helper.rb

data/lib/dradis/plugins/burp/importer.rb

@@ -1,138 +0,0 @@
-module Dradis::Plugins::Burp
-  class Importer < Dradis::Plugins::Upload::Importer
-
-    # The framework will call this function if the user selects this plugin from
-    # the dropdown list and uploads a file.
-    # @returns true if the operation was successful, false otherwise
-    def import(params = {})
-      file_content = File.read(params[:file])
-
-      if file_content =~ /base64="false"/
-        error =  "Burp input contains HTTP request / response data that hasn't been Base64-encoded.\n"
-        error << 'Please re-export your scanner results making sure the Base-64 encode option is selected.'
-
-        logger.fatal{ error }
-        content_service.create_note text: error
-        return false
-      end
-
-      logger.info { 'Parsing Burp Scanner output file...' }
-      doc = Nokogiri::XML(file_content)
-      logger.info { 'Done.' }
-
-      if doc.root.name != 'issues'
-        error = "Document doesn't seem to be in the Burp Scanner XML format."
-        logger.fatal { error }
-        content_service.create_note text: error
-        return false
-      end
-
-      # This will be filled in by the Processor while iterating over the issues
-      @hosts         = []
-      @affected_host = nil
-      @issue_text    = nil
-      @evidence_text = nil
-
-      doc.xpath('issues/issue').each do |xml_issue|
-        process_issue(xml_issue)
-      end
-
-      logger.info { 'Burp Scanner results successfully imported' }
-      true
-    end
-
-    private
-
-    # Creates the Nodes/properties
-    def process_issue(xml_issue)
-      host_label = xml_issue.at('host')['ip']
-      host_label = xml_issue.at('host').text if host_label.empty?
-      affected_host = content_service.create_node(label: host_label, type: :host)
-      logger.info { "\taffects: #{host_label}" }
-
-      unless @hosts.include?(affected_host.label)
-        @hosts << affected_host.label
-        url = xml_issue.at('host').text
-        affected_host.set_property(:hostname, url)
-        affected_host.save
-      end
-
-      # Burp extensions don't follow the "unique type for every Issue" logic
-      # so we have to deal with them separately
-      if xml_issue.at('type').text.to_str == '134217728'
-        process_extension_issues(affected_host, xml_issue)
-      else
-        process_burp_issues(affected_host, xml_issue)
-      end
-    end
-
-    # If the Issues come from the Burp app, use the type as the plugin_ic
-    def process_burp_issues(affected_host, xml_issue)
-      issue_name = xml_issue.at('name').text
-      issue_type = xml_issue.at('type').text.to_i
-
-      logger.info { "Adding #{issue_name} (#{issue_type})" }
-
-      create_issue(
-        affected_host: affected_host,
-        id: issue_type,
-        xml_issue: xml_issue
-      )
-    end
-
-    # If the Issues come from a Burp extension (type = 134217728), then
-    # use the name (spaces removed) as the plugin_id
-    def process_extension_issues(affected_host, xml_issue)
-      ext_name = xml_issue.at('name').text
-      ext_name = ext_name.gsub!(" ", "")
-
-      logger.info { "Adding #{ext_name}" }
-
-      create_issue(
-        affected_host: affected_host,
-        id: ext_name,
-        xml_issue: xml_issue
-      )
-    end
-
-    def create_issue(affected_host:, id:, xml_issue:)
-      issue_text =
-        template_service.process_template(
-          template: 'issue',
-          data: xml_issue
-        )
-
-      if issue_text.include?(::Burp::INVALID_UTF_REPLACE)
-        logger.info do
-          "\tdetected invalid UTF-8 bytes in your issue. " \
-          "Replacing them with '#{::Burp::INVALID_UTF_REPLACE}'."
-        end
-      end
-
-      issue = content_service.create_issue(text: issue_text, id: id)
-
-      logger.info do
-        "\tadding evidence for this instance to #{affected_host.label}."
-      end
-
-      evidence_text =
-        template_service.process_template(
-          template: 'evidence',
-          data: xml_issue
-        )
-
-      if evidence_text.include?(::Burp::INVALID_UTF_REPLACE)
-        logger.info do
-          "\tdetected invalid UTF-8 bytes in your evidence. " \
-          "Replacing them with '#{::Burp::INVALID_UTF_REPLACE}'."
-        end
-      end
-
-      content_service.create_evidence(
-        issue: issue,
-        node: affected_host,
-        content: evidence_text
-      )
-    end
-  end
-end