Class: Dradis::Plugins::Burp::Xml::Importer

Inherits:
Upload::Importer
  • Object
show all
Defined in:
lib/dradis/plugins/burp/xml/importer.rb

Constant Summary collapse

BURP_EXTENSION_TYPE = 
'134217728'.freeze
BURP_SEVERITIES = 
['Information', 'Low', 'Medium', 'High'].freeze

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(args = {}) ⇒ Importer

Returns a new instance of Importer.



22
23
24
25
 
# File 'lib/dradis/plugins/burp/xml/importer.rb', line 22

def initialize(args={})
  args[:plugin] = Dradis::Plugins::Burp
  super(args)
end

Class Method Details

.templates ⇒ Object 



18
19
20
 
# File 'lib/dradis/plugins/burp/xml/importer.rb', line 18

def self.templates
  { evidence: 'xml_evidence', issue: 'xml_issue' }
end

Instance Method Details

#import(params = {}) ⇒ Object 



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/dradis/plugins/burp/xml/importer.rb', line 27

def import(params = {})
  file_content = File.read(params[:file])

  if file_content =~ /base64="false"/
    error =  "Burp input contains HTTP request / response data that hasn't been Base64-encoded.\n"
    error << 'Please re-export your scanner results making sure the Base-64 encode option is selected.'

    logger.fatal{ error }
    content_service.create_note text: error
    return false
  end

  logger.info { 'Parsing Burp Scanner XML output file...' }
  doc = Nokogiri::XML(file_content) { |config| config.huge }
  logger.info { 'Done.' }

  if doc.root.name != 'issues'
    error = 'Document doesn\'t seem to be in the Burp Scanner XML format.'
    logger.fatal { error }
    content_service.create_note text: error
    return false
  end

  # This will be filled in by the Processor while iterating over the issues
  @issues     = []
  @severities = Hash.new(0)

  # We need to look ahead through all issues to bring the highest severity
  # of each instance to the Issue level.
  doc.xpath('issues/issue').each do |xml_issue|
    issue_id       = issue_id_for(xml_issue)
    issue_severity = BURP_SEVERITIES.index(xml_issue.at('severity').text)

    @severities[issue_id] = issue_severity if issue_severity > @severities[issue_id]
    @issues << xml_issue
  end

  @issues.each { |xml_issue| process_issue(xml_issue) }

  logger.info { 'Burp Scanner results successfully imported' }
  true
end