jira_scan 0.0.2 → 0.0.3

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YmVmMjdhMTg1NThlZmMzNDBjNzE3Y2Q0MjY3NzQ1MTY5OTRlMjc5Yg==
+    N2U3MTgzNjZlMDY0N2Q5MzJiMTJhYjFlZjA3ODg4Njg3YmNmYzVlOA==
   data.tar.gz: !binary |-
-    OTk3Mjc4M2FiNDU0MzdlYjU0ZjhiYTA2MzdlNWRjZjk2YWQ5NzQxOA==
+    ZTBmYmNhMmQ0MDQ0MTdmY2Q4MWRiYzQ1MzUxMWNmOWJmNmQwZjljOQ==
 SHA512:
   metadata.gz: !binary |-
-    ZDk2MTdhZjM5ZWI3Y2NjYWIwNzI0MzhiZjU1NzNiNDg3NDU2NjViODJlZjQ2
-    ZDg4YTg3NGQ1YTg4NGMwZTMyMDNlNjVkNzhhOGMxZTEzMGY5ODdiNDgzMzkw
-    ZGYwM2E1MDJkZjkxZDY2NzdjNGU3NTMzZDEzNmY0Zjk2MzQ1ZDI=
+    ZTg1NzllMDk0MWNlNWRjZDEwNTcyMTc0YWJlMmMzYjUzYjk3ZjUzMjkyYWIw
+    M2U2YmI5MjllMTEzNTc0NGE4YWVkMzE0Y2I2MzVkOWY3NDAyYjc1MTVkZjQ2
+    YTJjMGZiYTcyYWFjMjRmZmI2YzdkMDAwMTVkMTVjYzRlODVmNDE=
   data.tar.gz: !binary |-
-    NzA2ODczZTI3YzAxYWFhYmEyMWMyMjJjYjJhYzIyN2I0ZDkzYjllZThiMTZi
-    MTNhMWNjYmZkZThhZTNkNThmY2UzOWJjMTQ5YTk2M2NjZWY2ZTRmNDQzZjAy
-    Y2RiMzZhMmQ1YzUzNDg0ZDIxNDA3YjEwOWNkZmQzMjBmMzgzYmE=
+    NDc1ODc0MjIzMGY1YzlkMGYzMGY4Y2Q1ZmI3MDkwNjczNzI4ZDE5NDdhYmQ1
+    NzgwMTZiOGU3N2Y3MGVkYTQxMGE1ODMxMTVkNTBjNTIwOTQxMjI2OTJkZTg0
+    YmExYzZlOWFkNGUyODZkYTA0M2QwYWJhZTI1YmQwZGM5N2UxNmQ=

data/bin/jira-scan

@@ -17,7 +17,7 @@ def banner
   _   | | | '__/ _` |\\___ \\ / __/ _` | '_ \\ 
  | |__| | | | | (_| |____) | (_| (_| | | | |
   \\____/|_|_|  \\__,_|_____/ \\___\\__,_|_| |_|
-                               version 0.0.2"
+                               version 0.0.3"
   puts
   puts '-' * 60
 end
@@ -39,6 +39,10 @@ opts = OptionParser.new do |o|
     options[:skip] = true
   end
 
+  o.on('-i', '--insecure', 'Skip SSL/TLS validation') do
+    options[:insecure] = true
+  end
+
   o.on('-v', '--verbose', 'Enable verbose output') do
     options[:verbose] = true
   end
@@ -53,6 +57,7 @@ opts.parse!
 
 $VERBOSE = true unless options[:verbose].nil?
 @check = true unless options[:skip]
+@insecure = false unless options[:insecure]
 
 if options[:url].nil?
  puts opts
@@ -85,7 +90,9 @@ def scan(url)
 
   # Check if the URL is Jira
   if @check
-    unless JiraScan::isJira(url)
+    is_jira = JiraScan::detectJiraDashboard(url)
+    is_jira = JiraScan::detectJiraLogin(url) unless is_jira
+    unless is_jira
       puts '- Jira not found'
       exit(1)
     end
@@ -93,7 +100,8 @@ def scan(url)
   end
 
   # Get Jira version
-  version = JiraScan::getVersion(url)
+  version = JiraScan::getVersionFromDashboard(url)
+  version = JiraScan::getVersionFromLogin(url) unless version
   puts "+ Version: #{version}" if version
 
   # Dev mode enabled
@@ -109,7 +117,7 @@ def scan(url)
   if user_picker
     puts '+ User Picker Browser is available'
     # Retrieve list of first 1,000 users 
-    users = JiraScan::getUsersFromUserPicker(url)
+    users = JiraScan::getUsersFromUserPickerBrowser(url)
     unless users.empty?
       puts "+ Found users (#{users.length}):"
       table = Terminal::Table.new :headings => ['Username', 'Full Name', 'Email'], :rows => users
@@ -150,7 +158,15 @@ def scan(url)
   end
 
   # Retrieve list of field names
-  field_names = JiraScan::getFieldNames(url)
+  field_names = JiraScan::getFieldNamesQueryComponentDefault(url)
+  unless field_names.empty?
+    puts "+ Found field names (#{field_names.length}):"
+    table = Terminal::Table.new :headings => ['Name', 'ID', 'Key', 'IsShown', 'Last Viewed'], :rows => field_names
+    puts table
+  end
+
+  # Retrieve list of field names
+  field_names = JiraScan::getFieldNamesQueryComponentJql(url)
   unless field_names.empty?
     puts "+ Found field names (#{field_names.length}):"
     table = Terminal::Table.new :headings => ['Name', 'ID', 'Key', 'IsShown', 'Last Viewed'], :rows => field_names

data/lib/jira_scan.rb

@@ -10,16 +10,33 @@ require 'net/http'
 require 'openssl'
 
 class JiraScan
-  VERSION = '0.0.2'.freeze
+  VERSION = '0.0.3'.freeze
 
   #
-  # Check if Jira
+  # Check if URL is running Jira using Login page
   #
   # @param [String] URL
   #
   # @return [Boolean]
   #
-  def self.isJira(url)
+  def self.detectJiraLogin(url)
+    url += '/' unless url.to_s.end_with? '/'
+    res = sendHttpRequest("#{url}login.jsp")
+
+    return false unless res
+    return false unless res.code.to_i == 200
+
+    res.body.to_s.include?('JIRA')
+  end
+
+  #
+  # Check if URL is running Jira using Dashboard page
+  #
+  # @param [String] URL
+  #
+  # @return [Boolean]
+  #
+  def self.detectJiraDashboard(url)
     url += '/' unless url.to_s.end_with? '/'
     res = sendHttpRequest("#{url}secure/Dashboard.jspa")
 
@@ -30,13 +47,13 @@ class JiraScan
   end
 
   #
-  # Get Jira version
+  # Get Jira version from Dashboard page
   #
   # @param [String] URL
   #
   # @return [String] Jira version
   #
-  def self.getVersion(url)
+  def self.getVersionFromDashboard(url)
     url += '/' unless url.to_s.end_with? '/'
     res = sendHttpRequest("#{url}secure/Dashboard.jspa")
 
@@ -58,6 +75,35 @@ class JiraScan
     "#{version}-##{build}"
   end
 
+  #
+  # Get Jira version from Login page
+  #
+  # @param [String] URL
+  #
+  # @return [String] Jira version
+  #
+  def self.getVersionFromLogin(url)
+    url += '/' unless url.to_s.end_with? '/'
+    res = sendHttpRequest("#{url}login.jsp")
+
+    return unless res
+    return unless res.code.to_i == 200
+
+    version = res.body.to_s.scan(%r{<meta name="ajs-version-number" content="([\d\.]+)">}).flatten.first
+    build = res.body.to_s.scan(%r{<meta name="ajs-build-number" content="(\d+)">}).flatten.first
+
+    unless version && build
+      if res.body.to_s =~ /Version: ([\d\.]+)-#(\d+)/
+        version = $1
+        build = $2
+      else
+        return
+      end
+    end
+
+    "#{version}-##{build}"
+  end
+
   #
   # Check if dev mode is enabled
   #
@@ -258,7 +304,7 @@ class JiraScan
   #
   # @return [Array] list of field names
   #
-  def self.getFieldNames(url)
+  def self.getFieldNamesQueryComponentDefault(url)
     url += '/' unless url.to_s.end_with? '/'
     res = sendHttpRequest("#{url}secure/QueryComponent!Default.jspa")
 
@@ -284,6 +330,39 @@ class JiraScan
     []
   end
 
+  #
+  # Retrieve list of field names from QueryComponent!Jql.jspa (EDB-49924)
+  #
+  # @param [String] URL
+  #
+  # @return [Array] list of field names
+  #
+  def self.getFieldNamesQueryComponentJql(url)
+    url += '/' unless url.to_s.end_with? '/'
+    res = sendHttpRequest("#{url}secure/QueryComponent!Jql.jspa?jql=")
+
+    return [] unless res
+    return [] unless res.code.to_i == 200
+    return [] unless res.body.to_s.start_with?('{"searchers"')
+
+    searchers = JSON.parse(res.body.to_s)["searchers"]
+    return [] if searchers.empty?
+
+    groups = searchers['groups']
+    return [] if groups.empty?
+
+    field_names = []
+    groups.each do |g|
+      g['searchers'].each do |s|
+        field_names << s
+      end
+    end
+
+    JSON.parse(field_names.to_json, symbolize_names: true).map {|f| [f[:name], f[:id], f[:key], f[:isShown].to_s, f[:lastViewed]] }
+  rescue
+    []
+  end
+
   private
 
   #
@@ -299,8 +378,7 @@ class JiraScan
     http = Net::HTTP.new(target.host, target.port)
     if target.scheme.to_s.eql?('https')
       http.use_ssl = true
-      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-      # http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.verify_mode = @insecure ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
     end
     http.open_timeout = 20
     http.read_timeout = 20

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jira_scan
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Brendan Coles
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-23 00:00:00.000000000 Z
+date: 2021-07-11 00:00:00.000000000 Z
 dependencies: []
 description: A simple remote scanner for Atlassian Jira
 email: bcoles@gmail.com