Skip to content

Add fetchZAPResults.sh script to download ZAP reports from a URL #450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TheAuditorTool wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add fetchZAPResults.sh script to download ZAP reports from a URL #450

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f7af459
Add fetchZAPResults.sh script to download ZAP reports from a URL.
TheAuditorTool Apr 13, 2026
987d40d
Address review feedback on fetchZAPResults.sh
TheAuditorTool Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions scripts/fetchZAPResults.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
#!/usr/bin/env bash

# Downloads a ZAP XML report from a URL and saves it to the results/ directory.
# After downloading, run createScorecards.sh to generate the scorecard.
#
# Usage: scripts/fetchZAPResults.sh <ZAP_REPORT_URL> [OUTPUT_FILENAME]
#
# Examples:
# scripts/fetchZAPResults.sh http://172.17.0.3:8090/OTHER/core/other/xmlreport/
# scripts/fetchZAPResults.sh "http://zap:8090/OTHER/core/other/xmlreport/?apikey=abc123"
Copy link
Copy Markdown

@utafrali utafrali Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passing ?apikey=abc123 as part of the URL argument exposes the API key in the process list (ps aux or /proc/$PID/cmdline). Consider accepting the key as a separate argument and passing it via curl's -H flag instead:

# scripts/fetchZAPResults.sh <ZAP_REPORT_URL> [OUTPUT_FILENAME] [API_KEY]
if [ -n "${api_key:-}" ]; then
  curl_args=(-H "X-ZAP-API-Key: ${api_key}")
fi
curl -sS -o "${output}" -w '%{http_code}' "${curl_args[@]}" ...

This keeps the key out of the argument list. The existing ?apikey= query-param form can still be documented as an alternative for ZAP versions that require it in the URL.

# scripts/fetchZAPResults.sh http://zap:8090/OTHER/core/other/xmlreport/ my-zap-results.xml

source scripts/requireCommand.sh

requireCommand curl

if [ $# -eq 0 ]; then
echo "Usage: $0 <ZAP_REPORT_URL> [OUTPUT_FILENAME]"
echo ""
echo "Downloads a ZAP XML report from the given URL and saves it to results/."
echo "After downloading, run createScorecards.sh to generate the scorecard."
echo ""
echo "Examples:"
echo " $0 http://172.17.0.3:8090/OTHER/core/other/xmlreport/"
echo " $0 \"http://zap:8090/OTHER/core/other/xmlreport/?apikey=abc123\""
echo " $0 http://zap:8090/OTHER/core/other/xmlreport/ my-zap-results.xml"
exit 1
fi

zap_url="$1"

if [ $# -ge 2 ]; then
filename="$2"
else
benchmark_version=$(scripts/getBenchmarkVersion.sh)
date_stamp=$(date +%Y%m%d)
filename="Benchmark_${benchmark_version}-ZAP-${date_stamp}.xml"
fi

output="results/${filename}"

echo "Downloading ZAP report from: ${zap_url}"
http_code=$(curl -sS -o "${output}" -w '%{http_code}' --connect-timeout 10 --max-time 120 "${zap_url}")
Copy link
Copy Markdown

@utafrali utafrali Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The results/ directory is never created before curl writes to it. If the directory doesn't exist, curl will fail with Failed writing body and then the HTTP status check on line 45 may not behave as expected (the file won't exist for the head -2 check either). Add mkdir -p results/ between lines 40 and 42:

output="results/${filename}"
mkdir -p results/
echo "Downloading ZAP report from: ${zap_url}"


if [ "${http_code}" -ne 200 ]; then
echo "ERROR: Download failed with HTTP status ${http_code}"
Copy link
Copy Markdown

@utafrali utafrali Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Error messages on lines 46 and 52-54 are written to stdout instead of stderr. Tools and callers typically check stderr for diagnostics. Redirect them:

echo "ERROR: Download failed with HTTP status ${http_code}" >&2

and

echo "ERROR: Downloaded file does not appear to be a ZAP XML report." >&2
echo "First 3 lines of downloaded content:" >&2
head -3 "${output}" >&2

rm -f "${output}"
exit 1
fi

if ! head -2 "${output}" | grep -q "OWASPZAPReport"; then
echo "ERROR: Downloaded file does not appear to be a ZAP XML report."
echo "First 3 lines of downloaded content:"
head -3 "${output}"
rm -f "${output}"
exit 1
fi

echo "ZAP report saved to: ${output}"
echo "To generate the scorecard, run: ./createScorecards.sh"
Loading