Repository navigation
Conversation
Adds a shell script that downloads a ZAP XML report from a remote ZAP instance via its REST API and saves it to the results/ directory. This enables scorecard generation when ZAP and Benchmark run in separate Docker containers without a shared filesystem. Closes #21
- Add mkdir -p results/ before curl writes to it (fixes failure on fresh clone) - Pass API key via X-ZAP-API-Key header instead of URL query param (keeps key out of process list and shell history) - Redirect all error/usage output to stderr - Validate getBenchmarkVersion.sh output is non-empty before building filename
Bumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) from 2.22.4 to 2.23.0. - [Commits](FasterXML/jackson-databind@jackson-databind-2.22.4...jackson-databind-2.23.0) --- updated-dependencies: - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.23.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…t/maven/com.fasterxml.jackson.core-jackson-databind-2.23.0 Bump com.fasterxml.jackson.core:jackson-databind from 2.22.4 to 2.23.0
…-zap-results-from-url-21 Add fetchZAPResults.sh script to download ZAP reports from a URL
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
6 open issues
curlfails before receiving an HTTP response,http_codecan be empty or non-numeric (or… · Newcurlfails before receiving an HTTP response,http_codecan be empty or non-numeric (or… · Newsource scripts/requireCommand.shandscripts/getBenchmarkVersion.shassume the script is… · Newsource scripts/requireCommand.shandscripts/getBenchmarkVersion.shassume the script is… · Newset -euo pipefail) so… · New
What changed in this PR
Syncs the fork with upstream OWASP-Benchmark/BenchmarkJava master, including the upstream Jackson databind bump and adding a helper script to download ZAP XML results for scorecard generation.
Changes:
- Added
scripts/fetchZAPResults.shto download and validate a ZAP XML report intoresults/. - Updated
jackson-databinddependency version inpom.xmlto match upstream.
| File | Description |
|---|---|
| scripts/fetchZAPResults.sh | New utility script to fetch ZAP XML reports and save them under results/. |
| pom.xml | Bumps com.fasterxml.jackson.core:jackson-databind version per upstream sync. |
Review effort: Lite
| mkdir -p results/ | ||
| output="results/${filename}" | ||
|
|
||
| curl_args=(-sS -o "${output}" -w '%{http_code}' --connect-timeout 10 --max-time 120) |
Comment on lines
+60
to
+66
| http_code=$(curl "${curl_args[@]}" "${zap_url}") | ||
|
|
||
| if [ "${http_code}" -ne 200 ]; then | ||
| echo "ERROR: Download failed with HTTP status ${http_code}" >&2 | ||
| rm -f "${output}" | ||
| exit 1 | ||
| fi |
Comment on lines
+13
to
+15
| source scripts/requireCommand.sh | ||
|
|
||
| requireCommand curl |
| if [ -n "${2:-}" ]; then | ||
| filename="$2" | ||
| else | ||
| benchmark_version=$(scripts/getBenchmarkVersion.sh) |
Comment on lines
+55
to
+57
| if [ -n "${api_key}" ]; then | ||
| curl_args+=(-H "X-ZAP-API-Key: ${api_key}") | ||
| fi |
| @@ -0,0 +1,77 @@ | |||
| #!/usr/bin/env bash | |||
|
|
|||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upstream head:
a452b3aafd232245d0753e54eb243d6651f8ef96.