Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/OtherDevOpsGene/zap-sonar-plugin
Integrates OWASP Zed Attack Proxy reports into SonarQube
https://github.com/OtherDevOpsGene/zap-sonar-plugin
appsec dynamic-analysis owasp owasp-zap security software-security sonar-plugin sonarqube zap
Last synced: 26 days ago
JSON representation
Integrates OWASP Zed Attack Proxy reports into SonarQube
- Host: GitHub
- URL: https://github.com/OtherDevOpsGene/zap-sonar-plugin
- Owner: OtherDevOpsGene
- License: gpl-3.0
- Created: 2015-12-07T23:26:11.000Z (about 9 years ago)
- Default Branch: main
- Last Pushed: 2023-11-03T16:41:56.000Z (about 1 year ago)
- Last Synced: 2024-05-18T20:41:30.234Z (7 months ago)
- Topics: appsec, dynamic-analysis, owasp, owasp-zap, security, software-security, sonar-plugin, sonarqube, zap
- Language: HTML
- Size: 1.42 MB
- Stars: 67
- Watchers: 15
- Forks: 29
- Open Issues: 21
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE.txt
Awesome Lists containing this project
- awesome-network-stuff - **40**星
- awesome-hacking-lists - OtherDevOpsGene/zap-sonar-plugin - Integrates OWASP Zed Attack Proxy reports into SonarQube (HTML)
README
# ZAP Plugin for SonarQube
[](https://travis-ci.org/OtherDevOpsGene/zap-sonar-plugin)
[](https://www.codacy.com/gh/OtherDevOpsGene/zap-sonar-plugin/dashboard?utm_source=github.com&utm_medium=referral&utm_content=OtherDevOpsGene/zap-sonar-plugin&utm_campaign=Badge_Grade)
[](https://codeclimate.com/github/OtherDevOpsGene/zap-sonar-plugin/maintainability)
[](https://depshield.github.io)
[](https://snyk.io/test/github/OtherDevOpsGene/zap-sonar-plugin)
[](https://www.deepcode.ai/app/gh/OtherDevOpsGene/zap-sonar-plugin/_/dashboard?utm_content=gh%2FOtherDevOpsGene%2Fzap-sonar-plugin)
Integrates [OWASP ZAP](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)
reports into SonarQube 7.9.6 LTS or higher.
The current LTS version of SonarQube is the target.
## About ZAP
OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing
tool for finding vulnerabilities in web applications.
People with a wide range of security experience can use ZAP and making it ideal
for developers and functional testers new to penetration testing.
ZAP provides automated scanners as well as a set of tools that allow you to find
security vulnerabilities manually.
## Installation
Copy the plugin (jar file) to `$SONAR_INSTALL_DIR/extensions/plugins` and
restart SonarQube.
## Plugin Configuration
A typical SonarQube configuration will have the following parameters. This
example assumes the use of a Jenkins workspace, but can easily be altered for
other CI/CD systems.
```ini
sonar.zaproxy.reportPath=${WORKSPACE}/zaproxy-report.xml
sonar.zaproxy.htmlReportPath=${WORKSPACE}/zaproxy-htmlReport.html
# Optional - specifies additional rules outside of what's included in the core
sonar.zaproxy.rulesFilePath=${WORKSPACE}/myrules.xml
```
## History
The ZAP SonarQube Plugin is derived from the
[OWASP Dependency-Check SonarQube Plugin](https://github.com/stevespringett/dependency-check-sonar-plugin).
Version 1.0 of the Dependency-Check plugin was [forked](https://github.com/polymont/dependency-check-sonar-plugin)
by @polymont with the intent of creating a generic OWASP SonarQube plugin to
support any OWASP project. The ZAP team wanted their own SonarQube plugin
independent of any other project. In addition, a number of critical defects
were discovered in the initial release of the Dependency-Check SonarQube plugin
that were later fixed in subsequent releases, but never addressed in the generic
OWASP version. The ZAP SonarQube Plugin is based on v1.0.3 of
the Dependency-Check SonarQube plugin with ZAP-specific contributions by @polymont.
## License
Permission to modify and redistribute is granted under the terms of the
[LGPLv3](http://www.gnu.org/licenses/lgpl.txt) license.