com.eviware.soapui.security.scan

Class CrossSiteScriptingScan

java.lang.Object

com.eviware.soapui.model.support.AbstractModelItem

com.eviware.soapui.impl.wsdl.AbstractWsdlModelItem<SecurityScanConfig>

com.eviware.soapui.security.scan.AbstractSecurityScan

com.eviware.soapui.security.scan.AbstractSecurityScanWithProperties

com.eviware.soapui.security.scan.CrossSiteScriptingScan

All Implemented Interfaces:

com.eviware.soapui.model.ModelItem, Releasable, SecurityScan, AnimatableItem, XPathReferenceContainer, Assertable, ResponseAssertion, com.eviware.soapui.support.PropertyChangeNotifier

public class CrossSiteScriptingScan
extends AbstractSecurityScanWithProperties

This checks whether any parameters sent in the request are included in the response, If they do appear, this is a good parameter to look at as a possible attack vector for XSS

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected static interface	CrossSiteScriptingScan.AdvancedSettings

Nested classes/interfaces inherited from class com.eviware.soapui.impl.wsdl.AbstractWsdlModelItem

AbstractWsdlModelItem.ExternalAction

Nested classes/interfaces inherited from interface com.eviware.soapui.model.testsuite.Assertable

Assertable.AssertionStatus

Field Summary

Fields

Modifier and Type	Field and Description
static String	NAME
static String	PARAMETER_EXPOSURE_SCAN_CONFIG
static String	TEST_CASE_RUNNER
static String	TEST_STEP
static String	TYPE

Fields inherited from class com.eviware.soapui.security.scan.AbstractSecurityScan

assertionsSupport, SECURITY_CHANGED_VALUES

Fields inherited from interface com.eviware.soapui.model.security.SecurityScan

SECURITY_SCAN_REQUEST_RESULT, STATUS_PROPERTY

Fields inherited from interface com.eviware.soapui.model.ModelItem

DESCRIPTION_PROPERTY, ICON_PROPERTY, LABEL_PROPERTY, NAME_PROPERTY, NAME_SUFFIX

Constructor Summary

Constructors

Constructor and Description
CrossSiteScriptingScan(TestStep testStep, SecurityScanConfig config, com.eviware.soapui.model.ModelItem parent, String icon)

Method Summary

Modifier and Type	Method and Description
ScanRequestReportData	buildRequestMetaData(SecurityScanRequestResult requestResult) Returns information of the nature of a security alert raised for a particular request, which is intended for use in a report.
protected void	clear()
protected void	execute(SecurityTestRunner securityTestRunner, TestStep testStep, SecurityTestRunContext context) should be implemented in every particular scan it executes one request, modified by securityScan if necessary and internally adds messages for logging to SecurityScanRequestResult
JComponent	getAdvancedSettingsPanel() Overide if SecurityScan needs advanced settings
JComponent	getComponent() Overide if SecurityScan have Optional component
String	getConfigDescription() Description used in the configuration panel
String	getConfigName() Name used in the configuration panel
String	getHelpURL() Help url used for configuration panel ( help for this check )
String	getScanTypeDescription() Used to describe what this type of scan does.
String	getType() The type of this check
protected boolean	hasNext(TestStep testStep, SecurityTestRunContext context) checks if specific SecurityScan still has modifications left
void	initializeScan(TestStep testStep) Override this template method to do specific initiation for scan.
void	release()
boolean	supportsJson()
void	updateSecurityConfig(SecurityScanConfig config)

Methods inherited from class com.eviware.soapui.security.scan.AbstractSecurityScanWithProperties

copyConfig, extractAllParameters, getParameterAt, getParameterByLabel, getParameterHolder, getXPathReferences, importParameter, setParameterHolder

Methods inherited from class com.eviware.soapui.security.scan.AbstractSecurityScan

addAssertion, addAssertionsListener, addPropertyChangeListener, addWsdlAssertion, assertResponse, cloneAssertion, createMessageExchange, getAssertableContent, getAssertableContentAsXml, getAssertableType, getAssertionAt, getAssertionByName, getAssertionCount, getAssertionList, getAssertions, getAssertionsSupport, getAssertionStatus, getDefaultAssertableContent, getExecutionStrategy, getInterface, getModelItem, getOriginalResult, getParametersString, getReportDescription, getRequest, getSecurityScanRequestResult, getSecurityScanResult, getSecurityStatus, getTestStep, isAllowedToRun, isApplyForFailedStep, isConfigurable, isDisabled, isRunOnlyOnce, isSecurable, isSingleRequestScan, isSkipFurtherRunning, moveAssertion, removeAssertion, removeAssertionsListener, removePropertyChangeListener, reportSecurityScanException, run, setApplyForFailedTestStep, setDisabled, setExecutionStrategy, setRunOnlyOnce, setSecurityScanRequestResult, setSkipFurtherRunning, setTestStep

Methods inherited from class com.eviware.soapui.impl.wsdl.AbstractWsdlModelItem

addExternalDependencies, afterLoad, afterSave, beforeSave, clearIdCache, createEventBusMessage, dependsOn, getConfig, getDescription, getExternalAction, getExternalDependencies, getIcon, getId, getName, getParent, getSettings, getWsdlModelItemById, getWsdlModelItemByName, initItemOrder, initWsdlModelItemOrder, resetConfigOnMove, resolve, setConfig, setDescription, setExternalAction, setIcon, setName, setSettings

Methods inherited from class com.eviware.soapui.model.support.AbstractModelItem

addPropertyChangeListener, fireIndexedPropertyChange, getChildren, getDashboardDbId, getProject, isNotifyPropertyChanged, notifyPropertyChanged, removeModelItemFromConfig, removePropertyChangeListener, setDashboardDbId, setNotifyPropertyChanged

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.eviware.soapui.model.security.SecurityScan

getConfig

Methods inherited from interface com.eviware.soapui.model.ModelItem

getChildren, getDescription, getIcon, getId, getName, getParent, getSettings, setName

Methods inherited from interface com.eviware.soapui.support.PropertyChangeNotifier

addPropertyChangeListener, removePropertyChangeListener

Field Detail

TYPE

public static final String TYPE

See Also:

Constant Field Values

NAME

public static final String NAME

See Also:

Constant Field Values

PARAMETER_EXPOSURE_SCAN_CONFIG

public static final String PARAMETER_EXPOSURE_SCAN_CONFIG

See Also:

Constant Field Values

TEST_CASE_RUNNER

public static final String TEST_CASE_RUNNER

See Also:

Constant Field Values

TEST_STEP

public static final String TEST_STEP

See Also:

Constant Field Values

Constructor Detail

CrossSiteScriptingScan

public CrossSiteScriptingScan(TestStep testStep,
                              SecurityScanConfig config,
                              com.eviware.soapui.model.ModelItem parent,
                              String icon)

Method Detail

getScanTypeDescription

public String getScanTypeDescription()

Description copied from interface: SecurityScan

Used to describe what this type of scan does. Should always return the same String; it's really static information. The string can contain HTML; this will be understood by the GUI which reads it.

Returns:

a short description of the scan type

initializeScan

public void initializeScan(TestStep testStep)

Description copied from interface: SecurityScan

Override this template method to do specific initiation for scan. For example: adding assertions

Specified by:

initializeScan in interface SecurityScan

Overrides:

initializeScan in class AbstractSecurityScanWithProperties

supportsJson

public boolean supportsJson()

Specified by:

supportsJson in class AbstractSecurityScanWithProperties

updateSecurityConfig

public void updateSecurityConfig(SecurityScanConfig config)

Specified by:

updateSecurityConfig in interface SecurityScan

Overrides:

updateSecurityConfig in class AbstractSecurityScanWithProperties

execute

protected void execute(SecurityTestRunner securityTestRunner,
                       TestStep testStep,
                       SecurityTestRunContext context)

Description copied from class: AbstractSecurityScan

should be implemented in every particular scan it executes one request, modified by securityScan if necessary and internally adds messages for logging to SecurityScanRequestResult

Specified by:

execute in class AbstractSecurityScan

buildRequestMetaData

public ScanRequestReportData buildRequestMetaData(SecurityScanRequestResult requestResult)

Description copied from interface: SecurityScan

Returns information of the nature of a security alert raised for a particular request, which is intended for use in a report.

Specified by:

buildRequestMetaData in interface SecurityScan

Overrides:

buildRequestMetaData in class AbstractSecurityScan

getComponent

public JComponent getComponent()

Description copied from class: AbstractSecurityScan

Overide if SecurityScan have Optional component

Specified by:

getComponent in interface SecurityScan

Overrides:

getComponent in class AbstractSecurityScan

getType

public String getType()

Description copied from interface: SecurityScan

The type of this check

Specified by:

getType in interface SecurityScan

Specified by:

getType in class AbstractSecurityScan

Returns:

hasNext

protected boolean hasNext(TestStep testStep,
                          SecurityTestRunContext context)

Description copied from class: AbstractSecurityScan

checks if specific SecurityScan still has modifications left

Specified by:

hasNext in class AbstractSecurityScan

clear

protected void clear()

Specified by:

clear in class AbstractSecurityScan

getConfigDescription

public String getConfigDescription()

Description copied from interface: SecurityScan

Description used in the configuration panel

Specified by:

getConfigDescription in interface SecurityScan

Specified by:

getConfigDescription in class AbstractSecurityScan

getConfigName

public String getConfigName()

Description copied from interface: SecurityScan

Name used in the configuration panel

Specified by:

getConfigName in interface SecurityScan

Specified by:

getConfigName in class AbstractSecurityScan

getHelpURL

public String getHelpURL()

Description copied from interface: SecurityScan

Help url used for configuration panel ( help for this check )

Specified by:

getHelpURL in interface SecurityScan

Specified by:

getHelpURL in class AbstractSecurityScan

getAdvancedSettingsPanel

public JComponent getAdvancedSettingsPanel()

Description copied from class: AbstractSecurityScan

Overide if SecurityScan needs advanced settings

Specified by:

getAdvancedSettingsPanel in interface SecurityScan

Overrides:

getAdvancedSettingsPanel in class AbstractSecurityScan

Returns:

release

public void release()

Specified by:

release in interface Releasable

Specified by:

release in interface SecurityScan

Overrides:

release in class AbstractSecurityScanWithProperties