dradis-qualys 4.8.0 → 4.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c006e6129455d33b8be355829580d2876278bd1dfea553eb2169da2e0985584
-  data.tar.gz: e5c051e87eb8578756c1756e799e4defe636c756402bc9160c4d12fcf83898a9
+  metadata.gz: d098ef2f9fc3fd21e8d09b9d2aa3790c17bfc4b18c86e9969c2c49b677d9bdcc
+  data.tar.gz: 682b88bd9778657a19aa741a9c257fce62130b5c0a72e21b5b5c24c454de7329
 SHA512:
-  metadata.gz: f125ccd55201bf61013c62ba38459e0ea033d2848639952315a10b0ece8c9e7e7761eec8ff21e2b34bdbb47b9c77f9fc82ab985f8ca27cac5b522bb6dae56898
-  data.tar.gz: 10dad1507f861b9b9d7d31b1945068e83699de0b0d0f41563525c2103ae1a6a1b5f53fa0864009bcff174ff2136367fd6219e7d7f44524c00b3ceb15971b796d
+  metadata.gz: 11a7e81f2da1d25ebbb870b8b5b6f0940d2a8f5240c267f9dcac2e3a7ba24ce1a2b55c49b019ed4b6d20c5baa40724ccf49189405d35571b80484ac66f047956
+  data.tar.gz: c0d9c50c8179cb2a16cfb3e7529cbe5badf21552d890f31af9e5fb35f3a476ff38e0cd6764420b705efbf320f4f9bc317f6c74ea0c2a2a0f1466e6504171b572

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+v4.10.0 (September 2023)
+  - Update gemspec links
+
+v4.9.0 (June 2023)
+  - Adds Request/Response Evidence fields for Web Application Scans (WAS)
+
 v4.8.0 (April 2023)
   - No changes
 

data/dradis-qualys.gemspec

@@ -13,8 +13,7 @@ Gem::Specification.new do |spec|
   spec.license     = 'GPL-2'
 
   spec.authors     = ['Daniel Martin']
-  spec.email       = ['etd@nomejortu.com']
-  spec.homepage    = 'http://dradisframework.org'
+  spec.homepage    = 'https://dradis.com/integrations/qualys.html'
 
   spec.files       = `git ls-files`.split($\)
   spec.executables = spec.files.grep(%r{^bin/}).map{ |f| File.basename(f) }

data/lib/dradis/plugins/qualys/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 4
-        MINOR = 8
+        MINOR = 10
         TINY = 0
         PRE = nil
 

data/lib/qualys/was/vulnerability.rb

@@ -18,7 +18,10 @@ module Qualys::WAS
     def supported_tags
       [
         # simple tags
-        :access_paths,  :ajax,  :authentication,  :ignored,  :potential,  :url
+        :access_paths, :ajax, :authentication, :ignored, :potential, :url,
+
+        # nested tags
+        :response_contents, :response_evidence, :request_headers, :request_method, :request_url
       ]
     end
 
@@ -45,24 +48,51 @@ module Qualys::WAS
         return
       end
 
-      method_name = method.to_s
+      # Any fields where a simple .camelcase() won't work we need to translate,
+      # this includes acronyms (e.g. :cwe would become 'Cwe') and simple nested
+      # tags.
+      translations_table = {
+        access_paths:       'ACCESS_PATH/URL',
+        request_headers:    'PAYLOADS/PAYLOAD/REQUEST/HEADERS',
+        request_method:     'PAYLOADS/PAYLOAD/REQUEST/METHOD',
+        request_url:        'PAYLOADS/PAYLOAD/REQUEST/URL',
+        response_contents:  'PAYLOADS/PAYLOAD/RESPONSE/CONTENTS',
+        response_evidence:  'PAYLOADS/PAYLOAD/RESPONSE/EVIDENCE'
+      }
+
+      method_name = translations_table.fetch(method, method.to_s.upcase)
 
       # Then we try simple children tags: TITLE, LAST_UPDATE, CVSS_BASE...
-      tag = @xml.at_xpath("./#{method_name.upcase}")
+      tag = @xml.at_xpath("./#{method_name}")
       if tag && !tag.text.blank?
-        if tags_with_html_content.include?(method)
-          return Qualys::cleanup_html(tag.text)
+        if tags_with_base64.include?(method)
+          return decode_base64(tag)
         else
           return tag.text
         end
       else
         'n/a'
       end
+
     end
 
     private
-    def tags_with_html_content
-      []
+
+    def tags_with_base64
+      [:response_contents, :response_evidence]
+    end
+
+    def decode_base64(tag)
+      return 'n/a' unless tag
+
+      if tag['base64'] == 'true'
+        # The force_encoding is necessary as there is non-UTF content in the strings like \xE2
+        Base64.decode64(tag.text).force_encoding('UTF-8')
+      else
+        tag.text
+      end
     end
+    
+
   end
 end

data/templates/was-evidence.fields

@@ -3,4 +3,9 @@ was-evidence.ajax
 was-evidence.authentication
 was-evidence.ignored
 was-evidence.potential
+was-evidence.request_headers
+was-evidence.request_method
+was-evidence.request_url
+was-evidence.response_contents
+was-evidence.response_evidence
 was-evidence.url

data/templates/was-evidence.template

@@ -1,11 +1,16 @@
 #[Location]#
 %was-evidence.url%
 
-#[AccessPaths]#
-%was-evidence.access_paths%
-
-#[Flags]#
-Ajax: %was-evidence.ajax%
-Authentication: %was-evidence.authentication%
-Ignored: %was-evidence.ignored%
-Potential: %was-evidence.potential%
+#[Output]#
+*Request*
+
+Method: %was-evidence.request_method%
+URL: %was-evidence.request_url%
+
+bc.. %was-evidence.request_headers%
+
+p. *Response*
+
+Evidence: %was-evidence.response_evidence%
+
+bc.. %was-evidence.response_contents%

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-qualys
 version: !ruby/object:Gem::Version
-  version: 4.8.0
+  version: 4.10.0
 platform: ruby
 authors:
 - Daniel Martin
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-12 00:00:00.000000000 Z
+date: 2023-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -96,8 +96,7 @@ dependencies:
         version: 0.5.2
 description: This add-on allows you to upload and parse output produced from Qualys
   Vulnerability Scanner into Dradis.
-email:
-- etd@nomejortu.com
+email: 
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -160,11 +159,11 @@ files:
 - templates/was-issue.fields
 - templates/was-issue.sample
 - templates/was-issue.template
-homepage: http://dradisframework.org
+homepage: https://dradis.com/integrations/qualys.html
 licenses:
 - GPL-2
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -179,8 +178,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key:
+rubygems_version: 3.1.4
+signing_key: 
 specification_version: 4
 summary: Qualys add-on for the Dradis Framework.
 test_files: