ReportParser { public ZapReport parse(InputStream inputStream) { SMInputFactory inputFactory = ZapUtils.newStaxParser(); try { SMHierarchicCursor rootC = inputFactory.rootElementCursor(inputStream); SMInputCursor owaspZapReportCursor = rootC.advance(); String gererated = owaspZapReportCursor.getAttrValue("generated"); String versionZAP = owaspZapReportCursor.getAttrValue("version"); SMInputCursor childCursor = rootC .childCursor(); List<Site> sites = new ArrayList<Site>(); while (childCursor.getNext() != null) { String nodeName = childCursor.getLocalName(); if ("site".equals(nodeName)) { sites.add(processSite(childCursor)); } } return new ZapReport(gererated, versionZAP, sites); } catch (XMLStreamException e) { throw new IllegalStateException("XML is not valid", e); } }  ZapReport parse(InputStream inputStream);  }
@Test public void parseReport() throws Exception { ReportParser parser = new ReportParser(); InputStream inputStream = getClass().getClassLoader() .getResourceAsStream("report/zaproxy-report.xml"); ZapReport zapReport = parser.parse(inputStream); assertThat(zapReport.getGenerated()).isEqualTo("Thu, 3 May 2018 06:15:48"); assertThat(zapReport.getVersionZAP()).isEqualTo("D-2018-03-26"); List<Site> sites = zapReport.getSites(); Site site = sites.get(0); assertThat(site.getHost()).isEqualTo("example.org"); assertThat(site.getName()).isEqualTo("http: assertThat(site.getPort()).isEqualTo(80); assertThat(site.isSsl()).isEqualTo(false); Collection<AlertItem> alerts = site.getAlerts(); assertThat(alerts.size()).isEqualTo(1); Iterator<AlertItem> iterator = alerts.iterator(); AlertItem alert = iterator.next(); assertThat(alert.getPluginid()).isEqualTo(10010); assertThat(alert.getAlert()).isEqualTo("Cookie No HttpOnly Flag"); assertThat(alert.getRiskcode()).isEqualTo(1); assertThat(alert.getConfidence()).isEqualTo(2); assertThat(alert.getRiskdesc()).isEqualTo("Low (Medium)"); assertThat(alert.getDesc()).isEqualTo( "<p>A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.</p>"); assertThat(alert.getInstances().size()).isEqualTo(20); assertThat(alert.getInstances().get(1).getUri()).isEqualTo("http: assertThat(alert.getInstances().get(1).getMethod()).isEqualTo("GET"); assertThat(alert.getInstances().get(1).getParam()).isEqualTo("_pxCaptcha"); assertThat(alert.getInstances().get(1).getEvidence()).isEqualTo("Set-Cookie: _pxCaptcha"); assertThat(alert.getAttack()).isNullOrEmpty(); assertThat(alert.getSolution()) .isEqualTo("<p>Ensure that the HttpOnly flag is set for all cookies.</p>"); assertThat(alert.getReference()).contains("<p>http: assertThat(alert.getCweid()).isEqualTo(16); assertThat(alert.getWascid()).isEqualTo(13); }
@Test public void parseReportNoInstances() throws Exception { ReportParser parser = new ReportParser(); InputStream inputStream = getClass().getClassLoader() .getResourceAsStream("report/zaproxy-report-no-instances.xml"); ZapReport zapReport = parser.parse(inputStream); assertThat(zapReport.getGenerated()).isEqualTo("Fri, 8 Jun 2018 09:55:08"); assertThat(zapReport.getVersionZAP()).isEqualTo("2.7.0"); List<Site> sites = zapReport.getSites(); Site site = sites.get(0); assertThat(site.getHost()).isEqualTo("example.org"); assertThat(site.getName()).isEqualTo("http: assertThat(site.getPort()).isEqualTo(80); assertThat(site.isSsl()).isEqualTo(false); Collection<AlertItem> alerts = site.getAlerts(); assertThat(alerts.size()).isEqualTo(3); Iterator<AlertItem> iterator = alerts.iterator(); AlertItem alert = iterator.next(); assertThat(alert.getPluginid()).isEqualTo(10015); assertThat(alert.getAlert()) .isEqualTo("Incomplete or No Cache-control and Pragma HTTP Header Set"); assertThat(alert.getRiskcode()).isEqualTo(1); assertThat(alert.getConfidence()).isEqualTo(2); assertThat(alert.getRiskdesc()).isEqualTo("Low (Medium)"); assertThat(alert.getDesc()).isEqualTo( "<p>The cache-control and pragma HTTP header have not been set properly or are missing allowing the browser and proxies to cache content.</p>"); assertThat(alert.getInstances()).isNull(); assertThat(alert.getUri()) .isEqualTo("http: assertThat(alert.getMethod()).isEqualTo("GET"); assertThat(alert.getParam()).isEqualTo("Cache-Control"); assertThat(alert.getEvidence()).isEqualTo("max-age=31449600, no-transform, public"); assertThat(alert.getAttack()).isNullOrEmpty(); assertThat(alert.getSolution()).isEqualTo( "<p>Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate; and that the pragma HTTP header is set with no-cache.</p>"); assertThat(alert.getReference()).contains( "<p>https: assertThat(alert.getCweid()).isEqualTo(525); assertThat(alert.getWascid()).isEqualTo(13); }
@Test public void parseReportMoreRules() throws Exception { ReportParser parser = new ReportParser(); InputStream inputStream = getClass().getClassLoader() .getResourceAsStream("report/zapproxy-report-more-rules.xml"); ZapReport zapReport = parser.parse(inputStream); assertThat(zapReport.getGenerated()).isEqualTo("Wed, 31 Oct 2018 19:13:06"); assertThat(zapReport.getVersionZAP()).isEqualTo("D-2018-10-29"); List<Site> sites = zapReport.getSites(); Site site = sites.get(0); assertThat(site.getHost()).isEqualTo("192.168.1.15"); assertThat(site.getName()).isEqualTo("https: assertThat(site.getPort()).isEqualTo(8443); assertThat(site.isSsl()).isEqualTo(true); Collection<AlertItem> alerts = site.getAlerts(); assertThat(alerts.size()).isEqualTo(18); }