Refactor Dockerfile and scripts for improved functionality and cleanup

- Updated Dockerfile to change the entry point to CMD ["bash"] and removed obsolete loading.html copy.
- Enhanced run-docker.sh to ensure environment variables are correctly set and passed to the scanner.
- Modified security-check.sh to streamline the ZAP_TARGET assignment.
- Improved zap_processor.py to return detailed alerts from ZAP scans and updated HTML report generation to reflect these changes.
- Deleted obsolete OLD.sh script to declutter the project structure.

Author: fr4iser90

Dockerfile

@@ -51,7 +51,5 @@ RUN ln -s /zap/zap.sh /zap/zap-x.sh
 
 COPY scripts/webui.js /SimpleSecCheck/results/webui.js
 
-COPY web/loading.html /SimpleSecCheck/web/loading.html
-
 WORKDIR /zap/wrk
-ENTRYPOINT ["/SimpleSecCheck/scripts/security-check.sh"]
+CMD ["bash"]

rules/llm-ai-security.yml

@@ -10,10 +10,10 @@ rules:
               GOOGLE_API_KEY = "AIza..."
       - pattern-inside: |
           ... = os.environ.get("...") # Good: loaded from env
-        message: "Potential hardcoded LLM API key. Load keys from environment variables or a secure vault."
-        languages:
-          - python
-        severity: CRITICAL
+    message: "Potential hardcoded LLM API key. Load keys from environment variables or a secure vault."
+    languages:
+      - python
+    severity: CRITICAL
 
   - id: llm-direct-html-output
     patterns:

run-docker.sh

@@ -95,6 +95,7 @@ log_message "Starting Docker container for security scan..."
 
 # Set environment variables for Docker
 export TARGET_URL="$ZAP_TARGET"
+export ZAP_TARGET="$ZAP_TARGET"
 export TARGET_PATH_IN_CONTAINER="/target"
 export PROJECT_RESULTS_DIR="$RESULTS_DIR"
 export SCAN_TYPE="$SCAN_TYPE"
@@ -103,10 +104,13 @@ export SCAN_TYPE="$SCAN_TYPE"
 if [ "$SCAN_TYPE" = "code" ]; then
     # Code scan: mount code directory
     if docker-compose -f docker-compose.yml run --rm \
+        -e SCAN_TYPE="$SCAN_TYPE" \
+        -e ZAP_TARGET="$ZAP_TARGET" \
+        -e TARGET_URL="$ZAP_TARGET" \
         -v "$TARGET_PATH:/target:ro" \
         -v "$RESULTS_DIR:/SimpleSecCheck/results" \
         -v "$LOGS_DIR:/SimpleSecCheck/logs" \
-        scanner; then
+        scanner /SimpleSecCheck/scripts/security-check.sh; then
         log_success "Code security scan completed successfully!"
         OVERALL_SUCCESS=true
     else
@@ -116,9 +120,12 @@ if [ "$SCAN_TYPE" = "code" ]; then
 else
     # Website scan: no code mount needed
     if docker-compose -f docker-compose.yml run --rm \
+        -e SCAN_TYPE="$SCAN_TYPE" \
+        -e ZAP_TARGET="$ZAP_TARGET" \
+        -e TARGET_URL="$ZAP_TARGET" \
         -v "$RESULTS_DIR:/SimpleSecCheck/results" \
         -v "$LOGS_DIR:/SimpleSecCheck/logs" \
-        scanner; then
+        scanner /SimpleSecCheck/scripts/security-check.sh; then
         log_success "Website security scan completed successfully!"
         OVERALL_SUCCESS=true
     else

scripts/OLD.sh

@@ -10,6 +10,7 @@
 sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..')))
 from scripts.html_utils import html_header, html_footer, generate_visual_summary_section, generate_overall_summary_and_links_section
 from scripts.zap_processor import zap_summary, generate_zap_html_section
+from scripts.zap_xml_parser import parse_zap_xml, generate_html_report
 from scripts.semgrep_processor import semgrep_summary, generate_semgrep_html_section
 from scripts.trivy_processor import trivy_summary, generate_trivy_html_section
 from scripts.llm_connector import llm_client
@@ -34,7 +35,7 @@ def read_json(path):
 def main():
     debug(f"Starting HTML report generation. Output: {OUTPUT_FILE}")
     now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
-    target = os.environ.get('ZAP_TARGET', 'Unknown')
+    target = os.environ.get('ZAP_TARGET', os.environ.get('TARGET_URL', 'Unknown'))
     zap_html_path = os.path.join(RESULTS_DIR, 'zap-report.xml.html')
     zap_xml_path = os.path.join(RESULTS_DIR, 'zap-report.xml')
     semgrep_json_path = os.path.join(RESULTS_DIR, 'semgrep.json')
@@ -55,20 +56,18 @@ def main():
             f.write('''\n<!-- WebUI Controls -->\n<div style="margin: 1em 0;">\n  <button id="scan-btn">Jetzt neuen Scan starten</button>\n  <button id="refresh-status-btn">Status aktualisieren</button>\n  <span id="scan-status" style="margin-left:1em; color: #007bff;">Status wird geladen...</span>\n</div>\n<!-- Hinweis: Scan-Status und Trigger laufen über Port 9100 (Watchdog) -->\n''')
 
             # --- Visual summary with icons/colors for each tool ---
-            f.write(generate_visual_summary_section(zap_alerts, semgrep_findings, trivy_vulns))
+            f.write(generate_visual_summary_section(zap_alerts.get('summary', zap_alerts), semgrep_findings, trivy_vulns))
 
             # --- Overall Summary and Links ---
-            f.write(generate_overall_summary_and_links_section(zap_alerts, semgrep_findings, trivy_vulns, RESULTS_DIR, Path, os))
+            f.write(generate_overall_summary_and_links_section(zap_alerts.get('summary', zap_alerts), semgrep_findings, trivy_vulns, RESULTS_DIR, Path, os))
 
-            # ZAP Section
+            # ZAP Section - pass the full zap_alerts data structure
             f.write(generate_zap_html_section(zap_alerts, zap_html_path, Path, os))
 
             # Semgrep Section
-            f.write('<h2>Semgrep Static Code Analysis</h2>')
             f.write(generate_semgrep_html_section(semgrep_findings))
 
             # Trivy Section
-            f.write('<h2>Trivy Dependency & Container Scan</h2>')
             f.write(generate_trivy_html_section(trivy_vulns))
 
             f.write(html_footer())

scripts/generate-html-report.py

@@ -24,10 +24,8 @@ export SEMGREP_RULES_PATH_IN_CONTAINER="$BASE_PROJECT_DIR/rules"
 export TRIVY_CONFIG_PATH_IN_CONTAINER="$BASE_PROJECT_DIR/trivy/config.yaml"
 export ZAP_CONFIG_PATH_IN_CONTAINER="$BASE_PROJECT_DIR/zap/baseline.conf" # Note: your run_zap.sh hardcodes this.
 
-# --- DAST Target URL (from .env, passed to ZAP script) ---
-# TARGET_URL is from .env (e.g. http://host.docker.internal:8000)
-# Your run_zap.sh expects ZAP_TARGET as the env var.
-export ZAP_TARGET="${TARGET_URL:-http://host.docker.internal:8000}"
+# ZAP_TARGET is passed from run-docker.sh
+export ZAP_TARGET="${ZAP_TARGET:-http://host.docker.internal:8000}"
 
 # --- Determine scan type ---
 export SCAN_TYPE="${SCAN_TYPE:-code}" # Default to code scan