GSoC2013 Ideas/OWASP ZAP Exploring Advanced reporting using BIRT - Revision history

Johanna Curiel at 09:26, 16 August 2013

2013-08-16T09:26:47Z

Johanna Curiel at 09:26, 16 August 2013

2013-08-16T09:26:12Z

Johanna Curiel at 23:35, 21 July 2013

2013-07-21T23:35:02Z

Johanna Curiel at 23:34, 21 July 2013

2013-07-21T23:34:31Z

Johanna Curiel at 23:03, 21 July 2013

2013-07-21T23:03:42Z

Johanna Curiel at 20:23, 19 July 2013

2013-07-19T20:23:25Z

Johanna Curiel at 16:21, 19 July 2013

2013-07-19T16:21:07Z

Johanna Curiel at 16:16, 19 July 2013

2013-07-19T16:16:48Z

Johanna Curiel at 16:11, 19 July 2013

2013-07-19T16:11:35Z

Johanna Curiel at 21:02, 10 July 2013

2013-07-10T21:02:14Z

@@ Line 231: / Line 231: @@
 We need to define a plan for this phase after Rauf has completed refining the code and submitting the code for final revision to Simon Bennets,project leader of OWASP ZAP.
-==Progress final midterm phase==
+=Progress final midterm phase=
 By the midterm, Rahul was able to finalize refining the code, enhancing error handling and some extra features such as been able to set a custom logo and opening the PDF file after the report has been generated.
 Right now, an important part is understanding the code to be able to create the interface to generate BIRT reports using scripted data source.
 For this part, Rauf(Student) and Johanna(mentor) will be discussing the actual flow and feedback with Simon about this flow and propose how to build this interface that will work with an scripted data source

← Older revision		Revision as of 09:26, 16 August 2013
Line 229:		Line 229:
	The challenge for the next phase consists in understanding ZAP code more deeply, especially because there is already an API.		The challenge for the next phase consists in understanding ZAP code more deeply, especially because there is already an API.

−	We need to define a plan for this phase after Rauf has completed ~~redifing~~ the code and submitting the code for final revision to Simon Bennets,project leader of OWASP ZAP.	+	We need to define a plan for this phase after Rauf has completed refining the code and submitting the code for final revision to Simon Bennets,project leader of OWASP ZAP.
		+
		+	==Progress final midterm phase==
		+	By the midterm, Rahul was able to finalize refining the code, enhancing error handling and some extra features such as been able to set a custom logo and opening the PDF file after the report has been generated.
		+
		+	Right now, an important part is understanding the code to be able to create the interface to generate BIRT reports using scripted data source.
		+	For this part, Rauf(Student) and Johanna(mentor) will be discussing the actual flow and feedback with Simon about this flow and propose how to build this interface that will work with an scripted data source

@@ Line 187: / Line 187: @@
   ii. To test openPDF() functionality
-===Jar file JS.JAR issue==
+===Jar file JS.JAR issue===
 A while ago we reported some issues with this jar. What we found out is that the jar from BIRT library contains digital signatures that must be removed. After doing that, the code is able to run from the Build source.

← Older revision		Revision as of 23:34, 21 July 2013
Line 186:		Line 186:
	ii. To test the generation of xml file		ii. To test the generation of xml file
	ii. To test openPDF() functionality		ii. To test openPDF() functionality
		+
		+	===Jar file JS.JAR issue==
		+	A while ago we reported some issues with this jar. What we found out is that the jar from BIRT library contains digital signatures that must be removed. After doing that, the code is able to run from the Build source.

← Older revision		Revision as of 23:03, 21 July 2013
Line 174:		Line 174:

	Rauf is working on unit tests for the methods created and enhance some bugs in the prototype. Also, he must research if we are able to generate a report on the fly, so no predefined report file is used, but instead, report is created on the fly. This seems possible using the Birt Design API jars, which are already included in the Jar library files. This has lower priorities , but we see the advantages as basically , everything could be generated code wise.		Rauf is working on unit tests for the methods created and enhance some bugs in the prototype. Also, he must research if we are able to generate a report on the fly, so no predefined report file is used, but instead, report is created on the fly. This seems possible using the Birt Design API jars, which are already included in the Jar library files. This has lower priorities , but we see the advantages as basically , everything could be generated code wise.
		+
		+	==Unit tests and enhacements==
		+
		+	In the birtreports package, Rauf did some big fixing and made the function openPDF functional so it opens the PDF after saving the file.
		+
		+	- The testbirt package contains a file that has 4 test cases on the LastReportScan file. We can add more test cases as we proceed that's why Rauf created a separate package(test birt). Rauf used Junit for the test cases.
		+
		+	- The four test cases are:
		+	i. To test if the xml file is missing
		+	ii. To test if the rptdesign file is missing
		+	ii. To test the generation of xml file
		+	ii. To test openPDF() functionality
		+

	==Enhancing Alerts report data==		==Enhancing Alerts report data==

@@ Line 194: / Line 194: @@
 ==Make the extension an Add-On==
-A lot of information is found on the OWASP ZAP developer Wiki on how to create an add-on, but for new and inexperienced developers working with OWASP ZAP this can be confusing. For this purpose, Johanna (mentor) created a guide step by step on how to create extensions and Add-ons. This is especially handy for developers working for the first time in OWASP ZAP. This guideline is available here: (feel free to comment and feedback!)
+A lot of information is found on the OWASP ZAP developer Wiki on how to create an add-on, but for new developers working with OWASP ZAP this can be confusing. For this purpose, Johanna (mentor) created a guide step by step on how to create extensions and Add-ons. This is especially handy for developers working for the first time in OWASP ZAP. This guideline is available here: (feel free to comment and feedback!)
 [[File:GuidelineZAPExtensionsAddOns1.0.pdf]]

@@ Line 166: / Line 166: @@
 ==Redefine prototype workflow==
-Rauf created a workflow which we discussed. The original workflow was missing a clear integration based on how the code works and how OWASP ZAP generates an XML file.
+Rauf(student) created a workflow which was discussed with Johanna(mentor). The original workflow was missing a clear integration based on how the code works and how OWASP ZAP generates an XML file.
 The following represents the actual flow built in the code after Rauf did the correct representation and understood how OWASP ZAP generates the Alert data and later on generates an XML file .
@@ Line 173: / Line 173: @@
 We presented the prototype to Simon, code was made available to him through DropBox. Simon was able to generate a report. Code will be soon available through Github
-Rauf is working on Unit tests for the methods created and enhance some bugs in the prototype. Also . he must research if we are able to generate a report on the fly, so no predefined report file is used, but instead, report is created on the fly. This seems possible using the Birt Design API jars, which are already included in the Jar library files. This has lower priorities , but we see the advantages as basically , everything could be generated code wise.
+Rauf is working on unit tests for the methods created and enhance some bugs in the prototype. Also, he must research if we are able to generate a report on the fly, so no predefined report file is used, but instead, report is created on the fly. This seems possible using the Birt Design API jars, which are already included in the Jar library files. This has lower priorities , but we see the advantages as basically , everything could be generated code wise.
 ==Enhancing Alerts report data==
@@ Line 180: / Line 180: @@
 * Each type of alert should only be shown once
 * Where multiple instances occur it would be good to see the first X details shown (where the user can specify X?), eg:
-Type of Alert:           X-Content-Type-Options header missing
+ Type of Alert:        X-Content-Type-Options header missing
-Low (Warning)         The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'
+ Low (Warning)         The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'
-First 10 examples:
+ First 10 examples:
      URL:https://mydummywebsite/home
      URL:https://mydummywebsite/etc
      URL:https://mydummywebsite/login
-Solution: This check is specific to Internet Explorer 8 and Google Chrome. Ensure each pagesets a Content-Type header and the X-CONTENT-TYPE-OPTIONS if the ContentType header is
+ Solution: This check is specific to Internet Explorer 8 and Google Chrome. Ensure each pagesets a Content-Type header and
 For this part, we can think of different solutions such as:
@@ Line 193: / Line 194: @@
 ==Make the extension an Add-On==
-A lot of information is found on the OWASP ZAP developer Wiki on how to create an add-on, but for new and inexperienced developers this can be confusing. For this purpose, Johanna (mentor) created a guide step by step on how to create extensions and Add-ons. This is especially handy for developers working for the first time in OWASP ZAP. This guideline is available here: (feel free to comment and feedback!)
+A lot of information is found on the OWASP ZAP developer Wiki on how to create an add-on, but for new and inexperienced developers working with OWASP ZAP this can be confusing. For this purpose, Johanna (mentor) created a guide step by step on how to create extensions and Add-ons. This is especially handy for developers working for the first time in OWASP ZAP. This guideline is available here: (feel free to comment and feedback!)
 [[File:GuidelineZAPExtensionsAddOns1.0.pdf]]

← Older revision		Revision as of 16:11, 19 July 2013
Line 161:		Line 161:
	Right now this is the first version. Charts are also generated by BIRT, creating a summary of the alerts xml output.		Right now this is the first version. Charts are also generated by BIRT, creating a summary of the alerts xml output.
	[[File:Zapalertreports.png]]		[[File:Zapalertreports.png]]
		+
		+	=Progress 2nd Phase (10th July - 18th July 2013) =
		+
		+	==Redefine prototype workflow==
		+
		+	Rauf created a workflow which we discussed. The original workflow was missing a clear integration based on how the code works and how OWASP ZAP generates an XML file.
		+	The following represents the actual flow built in the code after Rauf did the correct representation and understood how OWASP ZAP generates the Alert data and later on generates an XML file .
		+
		+	[[File:GuidelineZAPExtensionsAddOns1.0.pdf]]

@@ Line 108: / Line 108: @@
   [[File:GenerateReportsHMLTandPDF.GIF]]
-= Progress 2nd Phase: Integration with OWASP ZAP – FIRST PART (27 June - 7th July, 2013)=
+= Progress 2nd Phase: Integration with OWASP ZAP(27 June - 10th July, 2013)=
 During this phase we have focused on integrating the code with OWASP ZAP.
 The challenges in this phase are: