Addon SOAP is not working properly when active scan is invoked by API
Describe the bug:
I'm using ZAP by API and docker container.
When I' send a request to register the node (using SendRequest API), the SOAP addon is working properly get the SOAP action from body and registering the node correctly:
When by API I'm invoking Ascan.Scan I got the error url_not_found.
This exception is raised here:
The issue should be generated by row 292
where the getLeafName is returning the default leaf name and not the SOAP one (where the SOAP action is reported).
Going to ZAP extension repo for soap addon, I think the addOns/soap/src/main/java/org/zaproxy/zap/extension/soap/VariantSoap.java class is NOT overriding the String getLeafName(String nodeName, HttpMessage msg) of the Variant interface.
Therefore, using the default implementation of Variant, which is returning null, the leaf name doesn't seem correct.
I have another doubt as well, because my expectation is that
should invoke a SOAP method to get full path (but with the action) otherwise the for cycle before will be never correct for SOAP.
Not being so familiar with ZAP entities, maybe I'm wrong.
Steps to reproduce the behavior:
- SendRequest API adding a SOAP request
- Ascan.Scan API with the save URL, method and body of the previous
SendRequest
Expected behavior:
I'm expecting to invoke a Ascan.Scan without exception.
Software versions:
tested both 2.15 and 2.16 version
Screenshots:
Errors from the zap.log file:
Additional context:
No response
Would you like to help fix this issue?
- Yes
Source: zaproxy/zaproxy