OWASP Zap Plug-In Development - owasp

I need to develop a plugin for OWASP-Zap, but I can not build the project. There is a Quick Set Up for Eclipse but when I try to Team Project Set up then it fails and I have no idea why. Is there anybody here done something like that? I would appreciate if someone can help me.
The quickest way to set up a ZAP development environment is as follows:
1. Ensure you have a recent version of Eclipse - the Eclipse IDE for Java Developers is a good option (Ensure you have a version of Eclipse 4.2 or later installed or if using an earlier version, the "EGit - Git Team Provider" plug-in installed.)
2. Start Eclipse and select a new (empty) workspace
3. Select the menu: "File / Import"
4. Select "Team / Team Project Set" and click "Next >"
5. Select URL and enter: https://raw.githubusercontent.com/zaproxy/zap-admin/master/ZAP-projectSet.psf
6. Click "Finish" and wait for Eclipse to pull down all of the projects and build them.

I see, the psf was removed.
Check out these instructions > https://github.com/zaproxy/zaproxy/wiki/Contributing-Changes keep in mind that for the time being the master/beta/alpha branches in the extensions repo are all completely separate things (based on the status/quality of the extension(s)).
There's also a whole series of Blog posts that you might be interested in:
https://zaproxy.blogspot.com/2014/03/hacking-zap-1-why-should-you.html
https://zaproxy.blogspot.com/2014/03/hacking-zap-2-getting-started.html
https://zaproxy.blogspot.com/2014/04/hacking-zap-3-passive-scan-rules.html
https://zaproxy.blogspot.com/2014/04/hacking-zap-4-active-scan-rules.html
Edit 2022-05-03: There are updated Developer docs here: https://www.zaproxy.org/docs/developer/ including Creating a New Add-on in zap-extensions
Edit 2022-05-24: There is now an example add-on repo available: https://github.com/zaproxy/addon-java

Related

Eclipse Luna - Run Configurations won't display my git Project

Recently I pulled a project form Github. The language I'm working with is C. When I try to run it, it will say "The selection cannot be launched, and there are no recent launches." I can't compile either. So what I did was search the internet for how to fix this. And the mighty internet said I shall change my run configurations and select my project and then run that. This is what I tried - I opened the configurator and browsed for my project, but it wasn't displayed. I can see the project in the navigator and I can commit/push/pull as well. Still, I can't choose it in the run configurator. Any ideas what I could do?
Thank you very much!
PS: I already saw this post (Can't run project in Eclipse imported from Git) but there is no maven option when importing.

Eclipse Juno: Missing the "Classic Update"

In my project we control the plug-ins through the "Manage Configuration" possibility.
Downloaded plu-ins etc. are loaded thorugh an extension point from a file location (managed by SVN)
This has proven to be a reliable way of making sure all developers in a team share the same configuration.
I am now updating our project to Juno, and even after enabling the "Classic Update" in preferences, the menu item Help->Software Update->Manage Configuration is missing.
It also seems to be missing in the documentation for juno at http://help.eclipse.org/juno/index.jsp
Any help?
The Update Manager was deprecated a while ago, and has finally been removed in Juno (4.2). You can use the p2 director to perform command-line based installs.
There are other command line apps that can assist with mirroring features in existing update sites to a local directory that can be shared within a company or creating a composite repo that points off to multiple separate update sites (kinda one-stop-shopping) and even publishers that can take featuers and plugins without metadata and prep them for use with the p2 director.
EDIT: A quick tour of options is available here: http://pweclipse.blogspot.ca/2011/06/p2-cheatsheet.html

NetBeans version control for newb?

I'm a relatively new programmer and I've never used version control before. I'm working on a Java project in NetBeans and was wondering about some good version control options that are relatively easy to install and use. Not sure if it matters, but I run OSX.
Subversion was an easy solution for my project constraints. The Subversion guide for NetBeans: http://www.netbeans.org/kb/docs/ide/subversion.html was especially useful in terms of walking me through both installation and basic use.
On the menu if you go to Tools > Plugins, you can choose to install a plugin for whatever version control you're using. I've got IDE 6.7 installed, and it comes with Subversion SVN, CVS, and Mercurial.
When I setup my NB project as an SVN repository, I did it first outside of NB with the 'svn' command. Once set (it makes .svn folders everywhere) NetBeans automatically detected it and allows me to update/commit/all that stuff.
I'm Working on Mac OS X as well, with Netbeans 6.7 + SVN.
First thing to do is to create a new repository where all your files will be stored. This can be done using a GUI tool such as SVNx or through the command line :
svnadmin create REPOS_PATH
Once this is done, you're ready to import your project to the repository through the Netbeans interface ! If everything is set up in your netbeans, you should be able to right click a non-yet-version-controlled project and choose "Team > Import into SVN repository" or something like that (don't have NB right here to search for the right entry).
After that, if everything is alright, your project will be under the SVN version control. You can then do checkout to retrieve local working copy of the code, commit files, revert, etc...
Hope this helps !

How stable is the git plugin for eclipse?

I was intending to have a play with git, and was wondering if anyone had used the git plugin for eclipse
I see it's at version 0.3.1, and was wondering if anyone knew how stable it was / any gotchas?
Update:
If you are using a recent version of Eclipse, your Help menu has an 'Eclipse Marketplace...' link.
Enter 'git' in the Find field. This shows me EGit.
This is also very high in the Popular plugins list.
Click install. Much easier than having to add update site locations by hand.
Github blog spoke yesterday about Egit plugin:
http://freshmeat.net/projects/jgit/
I'm using if for day-to-day work and I find it stable. Lately the plugin has made good progress and has added:
merge support, including a in-Eclipse merge tool;
a basic synchronise view;
reading of .git/info/exclude and .gitignore files.
rebasing;
streamlined commands for pushing and pulling;
cherry-picking.
Be sure to skim the EGit User Guide for a good overview of the current functionality.
I find that I only need to drop to the comand line for interactive rebases.
As an official Eclipse project I am confident that EGit will receive all the main features of the command-line client.
EGit is still in eclipse incubation. You can install it using the Eclipse update manager.
Select Help -> Install New Software...
You probably do not have the JGit update URL in your list of sites so in the 'Work with:' field enter this url: http://www.jgit.org/updates
Click Add...
You should now see Eclipse Git Plugin - Integration Build (Incubation) listed as available software to install. Check it and click Next.
Click Next and agree to the license and it should be installed.
You can integrate Git-GUI with Eclipse as an alternative to EGit.
See this two part YouTube tutorial specific to Windows:
http://www.youtube.com/watch?v=DcM1xOiaidk
http://www.youtube.com/watch?v=1OrPJClD92s
It still seems barely usable, to tell the truth, especially in comparison to the CVS and SVN plugins. Is it really GIT so different that developer with four years of CVS and SVN plugin experience should be completely lost with completely different GUI, unheard commands, two or even single word error messages and "features" like overwriting the shared repository without warning? Do not use it, use command line interface. If you do not like command line interface, do not use GIT at all.
Meanwhile EclipseGit is an "Official Eclipse Technology Project" (09-05-07 GitWiki). I use the current version 0.5.0 (the Wiki is a step behind the development) from time to time, without any problems. Version comparison, commit, revert etc. is working well, although manual refresh's (F5) are necessary when using command line or other Git clients (usual and acceptable Eclipse behavior I think).
For a command line view from within eclipse, install the Aptana Eclipse Plugin, it provides you with a console. It's an incredible productivity boost if you do a lot of terminal commands.
I've set up EGit in Eclipse for a few of my projects and find that its a lot easier, faster to use a command line interface versus having to drill down menus and click around windows.
I would prefer something like a command line view within Eclipse to do all the Git duties.
egit has a serious bug when comparing a file in your working dir with an earlier - it flashes a blank tab. The bug has been around since 2010 and still has not been fixed.
This very basic feature which works very well in svn plugin is completely broken.
I've used it briefly, but it was still lacking support in several important areas (it wasn't doing renames/moves properly, or something). There also was no update site available for it.
I don't remember which version it was, but this was like 6 months ago. Hopefully it is better now.
You may be interested in these pointers: http://github.com/blog/232-github-and-eclipse
There is also gitclipse(based on JavaGit), but seems dead.

How do you make eclipse use an existing svn working copy?

I've got a working copy checked out with svn; furthermore, I've created a new project in Eclipse that has the root of the working copy as the project's location. I want to be able to do stuff like compare versions from Eclipse. I have Subclipse 1.4.8, but that doesn't seem to give me what I want. Am I doing something wrong?
i have an svn working copy that also is a project in eclipse. after installing the subclipse plugin i had the same problem, the working copy was not recognized as such.
i just managed by chance to get it recognized as an svn working copy by renaming the project in question and then renaming it back to its old name. not very nice, but it did the trick :-)
There is an option when creating a new project, to use an existing source directory:
New project/ new Java Project / Create project from existing source.
Use that, tell it where your source lives, and it should automatically detect if it's a SVN working copy.
I guess this is not possible with Subclipse as it's given in its documentation that, you can only import an existing svn-managed folder under one condition, according to the doc:
"The only requirement is that your
working copy has to also be a valid
Eclipse project."
So, if you have a working copy that is not a complete eclipse project, Subclipse will not connect it to SVN.
You can right click on the root node of your project and select: Team / Share project
Then you choose SVN, let the default settings and it should work fine!
I am answering this after a long time of the question being asked. I ended up here because I was facing the same problem.
My solution was to create an empty .svn folder at the root folder of the project (in the latest version of svn client tortoise all meta-data is at the root folder). Then did an eclipse refresh and voila it did the trick. I am running subclipse core - 1.8.4.
One step that seemed to work for me, that no one has explicitly mentioned yet: I closed and then re-opened the project. I tried the "rename" trick, above, and that didn't work, but perhaps the poster of that answer also closed the project - they didn't detail exactly what steps they went thru to rename it. (I found you don't have to close the project to rename it, but perhaps they did.)
< /rob>
In my case, I couldn't use an existing copy because I checked out the code using a newer version of Subversion on the command-line and Subclipse 1.4 couldn't recognize it. Upgrading and going through the improved "Share Project" menu resolved the problem.
I got this tip from the forums here:
http://subclipse.tigris.org/ds/viewMessage.do?dsForumId=1047&dsMessageId=2380064
I had the same issue and here are the details of the fix.
My Eclipse is "Helios Service Release 1".
I had an SVN checkout on my filesystem, I went to New Java Project, unchecked Use default location, chose the location, went to next step, chose the source folder and said Finish.
The project came up with no disk icon on it. As per few forum posts, right-clicked on the project, went to Team > Share Project, chose SVN, clicked Next, and the option was only to share the files to the SVN Repository for the first time.
I said Cancel, and the option is to make changes to the SVN plug-in settings. Went to Window menu, chose Preferences, browsed Team> SVN. Chose the SVN Connector tab, changed the SVNKit 1.2.3 to SVNKit 1.3.5 and said OK.
Then, right clicked on the project, said Team> SVN, on the next screen, chose the option Use Project Settings and clicked Finish. The disk button came to the project and the SVN URL got displayed on it.
Add the repository to your list of repositories in subclipse by choosing Window->Show View->Other... and choose SVN->SVN Repositories. Put in all the necessary info to connect to the repository.
Next, right click the repository and choose "checkout". If the project doesn't already have an eclipse .project file, you can create a new project from the source. If it already has a .project file, it will import that .project and use that as your eclipse project locally.
It will definitively not work if you use a different version of svn to checkout, that the one that is supported by Eclipse. I had this problem as I used svn 1.6 to checkout but I had an older eclipse version that had only 1.5. Subclipse has its own build-in svn client (Actually, in two flavors if I am not mistaken).
Check that the subclipse version matches the svn client that you used to checkout. You can check the plugin version number for subclipse (Help -> About -> Click on subversion logo) and match it against svn --version
This worked for me:
1) Go to the 'SVN Repository Exploring' perspective and add a folder somewhere above your working copy
2) Close and open the Eclipse projects.
This should then be enough to get them recognized by Subclipse.
I have encountered a similar situation were existing projects would not get associated with the Subversive plugin. Unfortunately, none of the previous suggestions helped (renaming projects etc.). What has helped is removing projects from Eclipse by deleting them -- just the projects from Package Explorer and not the actual directories and files on disc (the deletion prompt has a special checkbox for that, which is unchecked by default) -- and reimporting the deleted projects as existing projects back.
Of course, as mentioned in some of the answers here, the relevant SVN repositories need to be registered with Eclipse before reimporting the projects. Otherwise, there would no repositories to re-associate the projects with.
When you open a versioned project (i.e., a project in SVN working copy) in Eclipse, that was never previously used with Subclipse, you need to perform these steps:
Right-click the project in Project Explorer.
Select Team | Share Project.
At this point Subclipse will tell you that "The project is already configured with SVN repository information". Click Next.
Subclipse automatically recognizes this project as versioned and all the features of the SVN plug-in should become available.