dradis-qualys 4.7.0 → 4.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf628f2a523aec7a933cd7054b4cf74f763f96f51e67620d06d8ea8d965f069f
-  data.tar.gz: 459abec5d7e898fed9ecf820fbb6a0519539e69aae8ac90576a77498b8675563
+  metadata.gz: 9ef14a4a46502ad8ac98818f7b04d8cbe31f44c15c4773ff522dd7ee902493b5
+  data.tar.gz: 8474cc15162e1a000fd8479ad3e17c4afa68652792815e24eea6fa309c799b49
 SHA512:
-  metadata.gz: 9956b70e05fcd56547e0fcc2302962b360cade0ffffaae38b7a477cece99169464a420180bb6fd57fee556b69b7c2dbdc02417967cb5f5fcdf1b02861f26dae4
-  data.tar.gz: '05929e66ce50981b2e87138d50484c8b1e692c35087b7dfe68567c4f2a060f54329c836f165dda261aec97e5ab51547964533e4f46d1dc942762cfdcef7f101b'
+  metadata.gz: fb173d9b80fa0f7a3f272d79e54a3d1f250bebca49eaacfd3909144cf470bbcdd50055b6b19346664aacc080d9cf6289c8942361504654af065e1ed4296dd16d
+  data.tar.gz: 0bc1694d295160eacf438c82c541301868b90ebf9c0a70e3f4da5beefb4d7fd09a4cc966fedd60732505e4a0880d8bbe8621c09f41151c430ca3366fe121e5a0

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+v4.9.0 (June 2023)
+  - Adds Request/Response Evidence fields for Web Application Scans (WAS)
+
+v4.8.0 (April 2023)
+  - No changes
+
 v4.7.0 (February 2023)
   - No changes
 

data/lib/dradis/plugins/qualys/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 4
-        MINOR = 7
+        MINOR = 9
         TINY = 0
         PRE = nil
 

data/lib/qualys/was/vulnerability.rb

@@ -18,7 +18,10 @@ module Qualys::WAS
     def supported_tags
       [
         # simple tags
-        :access_paths,  :ajax,  :authentication,  :ignored,  :potential,  :url
+        :access_paths, :ajax, :authentication, :ignored, :potential, :url,
+
+        # nested tags
+        :response_contents, :response_evidence, :request_headers, :request_method, :request_url
       ]
     end
 
@@ -45,24 +48,51 @@ module Qualys::WAS
         return
       end
 
-      method_name = method.to_s
+      # Any fields where a simple .camelcase() won't work we need to translate,
+      # this includes acronyms (e.g. :cwe would become 'Cwe') and simple nested
+      # tags.
+      translations_table = {
+        access_paths:       'ACCESS_PATH/URL',
+        request_headers:    'PAYLOADS/PAYLOAD/REQUEST/HEADERS',
+        request_method:     'PAYLOADS/PAYLOAD/REQUEST/METHOD',
+        request_url:        'PAYLOADS/PAYLOAD/REQUEST/URL',
+        response_contents:  'PAYLOADS/PAYLOAD/RESPONSE/CONTENTS',
+        response_evidence:  'PAYLOADS/PAYLOAD/RESPONSE/EVIDENCE'
+      }
+
+      method_name = translations_table.fetch(method, method.to_s.upcase)
 
       # Then we try simple children tags: TITLE, LAST_UPDATE, CVSS_BASE...
-      tag = @xml.at_xpath("./#{method_name.upcase}")
+      tag = @xml.at_xpath("./#{method_name}")
       if tag && !tag.text.blank?
-        if tags_with_html_content.include?(method)
-          return Qualys::cleanup_html(tag.text)
+        if tags_with_base64.include?(method)
+          return decode_base64(tag)
         else
           return tag.text
         end
       else
         'n/a'
       end
+
     end
 
     private
-    def tags_with_html_content
-      []
+
+    def tags_with_base64
+      [:response_contents, :response_evidence]
+    end
+
+    def decode_base64(tag)
+      return 'n/a' unless tag
+
+      if tag['base64'] == 'true'
+        # The force_encoding is necessary as there is non-UTF content in the strings like \xE2
+        Base64.decode64(tag.text).force_encoding('UTF-8')
+      else
+        tag.text
+      end
     end
+    
+
   end
 end

data/templates/was-evidence.fields

@@ -3,4 +3,9 @@ was-evidence.ajax
 was-evidence.authentication
 was-evidence.ignored
 was-evidence.potential
+was-evidence.request_headers
+was-evidence.request_method
+was-evidence.request_url
+was-evidence.response_contents
+was-evidence.response_evidence
 was-evidence.url

data/templates/was-evidence.template

@@ -1,11 +1,16 @@
 #[Location]#
 %was-evidence.url%
 
-#[AccessPaths]#
-%was-evidence.access_paths%
-
-#[Flags]#
-Ajax: %was-evidence.ajax%
-Authentication: %was-evidence.authentication%
-Ignored: %was-evidence.ignored%
-Potential: %was-evidence.potential%
+#[Output]#
+*Request*
+
+Method: %was-evidence.request_method%
+URL: %was-evidence.request_url%
+
+bc.. %was-evidence.request_headers%
+
+p. *Response*
+
+Evidence: %was-evidence.response_evidence%
+
+bc.. %was-evidence.response_contents%

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-qualys
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.9.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-02-20 00:00:00.000000000 Z
+date: 2023-05-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins