Skip to content

Commit fc162da

Browse files
TmmmmmRTmmmmmR
committed
second batch of reviews
1 parent ee8c904 commit fc162da

File tree

274 files changed

+91
-4446
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

274 files changed

+91
-4446
lines changed

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/ExtensionLlm.java

+2-3
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,6 @@ public void hook(ExtensionHook extensionHook) {
7272
extensionHook.getHookMenu().addImportMenuItem(getMenuLLM());
7373
extensionHook.getHookMenu().addPopupMenuItem(getCheckLlmMenu());
7474
extensionHook.addOptionsParamSet(getOptionsParam());
75-
// change to a message
7675
getView().getOptionsDialog().addParamPanel(ROOT, getOptionsPanel(), true);
7776

7877
extensionHook.addSessionListener(
@@ -114,10 +113,10 @@ private ZapMenuItem getMenuLLM() {
114113
if (menuLLM == null) {
115114
menuLLM =
116115
new ZapMenuItem(
117-
"llm.topmenu.import.importSwagger",
116+
"llm.topmenu.import.importOpenAPI",
118117
getView().getMenuShortcutKeyStroke(KeyEvent.VK_J, 0, false));
119118
menuLLM.setToolTipText(
120-
Constant.messages.getString("llm.topmenu.import.importSwagger.tooltip"));
119+
Constant.messages.getString("llm.topmenu.import.importOpenAPI.tooltip"));
121120
menuLLM.addActionListener(
122121
e -> {
123122
if (importDialog == null) {

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmAssistant.java

+2-3
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,22 @@
2727

2828
public interface LlmAssistant {
2929
@UserMessage(
30-
"Given the following swagger generate list of chained HTTP request to simulate a real world user : {{swagger}} ")
30+
"GGiven the following OpenAPI definition, generate a list of chained HTTP requests to simulate a real world user : {{swagger}} ")
3131
HttpRequestList extractHttpRequests(String swagger);
3232

3333
@UserMessage(
3434
"As software architect, and based on your previous answer, generate other potential missing endpoints that are not mentioned in the swagger file. For example, if there is GET /product/1, suggest DELETE /product/1 if it's not mentioned")
3535
HttpRequestList complete();
3636

3737
@SystemMessage(
38-
"You are a web application security expert in review false positives. Answer only in JSON.")
38+
"You are a web application security expert reviewing false positives. Answer only in JSON.")
3939
@UserMessage(
4040
"Your task is to review the following finding from ZAP (Zed Attack Proxy).\n"
4141
+ "The confidence level is a pull down field which allows you to specify how confident you are in the validity of the finding : \n"
4242
+ "- 0 if it's False Positive\n"
4343
+ "- 1 if it's Low\n"
4444
+ "- 2 if it's Medium\n"
4545
+ "- 3 if it's High\n"
46-
+ "- 4 if it's Confirmed\n"
4746
+ "\n"
4847
+ "The alert is described as follows : {{description}}\n"
4948
+ "\n"

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java

+11-10
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ public class LlmCommunicationService {
5252
private LlmOptionsParam llmOptionsParam;
5353

5454
private static final Logger LOGGER = LogManager.getLogger(LlmCommunicationService.class);
55-
private static final String AI_REVIEWED_TAG_KEY = "AI-Reviewed";
56-
private static final String AI_REVIEWED_TAG_VALUE = "1";
55+
private static final String AI_REVIEWD_TAG_KEY = "AI-Reviewed";
56+
private static final String AI_REVIEWD_TAG_VALUE = "1";
5757

5858
public String endpoint;
5959
private String apiKey;
@@ -90,13 +90,14 @@ public LlmCommunicationService(String modelName, String apiKey, String endpoint)
9090

9191
private Integer importHttpCalls(String swaggercontent) throws IOException {
9292
HttpRequestList listHttpRequest = llmAssistant.extractHttpRequests(swaggercontent);
93-
if (listHttpRequest == null)
93+
if (listHttpRequest == null) {
9494
throw new RuntimeException("An issue occurred hy trying to get response from LLM");
95+
}
9596
requestor.run(listHttpRequest);
9697
return listHttpRequest.getRequests().size();
9798
}
9899

99-
public Integer importSwaggerFromUrl(String urlString) {
100+
public Integer importOpenapiFromUrl(String urlString) {
100101
Integer endpointCount = 0;
101102
try {
102103
URL url = new URL(urlString);
@@ -114,24 +115,24 @@ public Integer importSwaggerFromUrl(String urlString) {
114115
new BufferedReader(new InputStreamReader((connection.getInputStream())));
115116
String openApiDefinition = br.lines().collect(Collectors.joining());
116117

117-
// Use the existing importSwagger method
118+
// Use the existing importOpenapi method
118119
endpointCount = importHttpCalls(openApiDefinition);
119120

120121
connection.disconnect();
121122
} catch (Exception e) {
122-
e.printStackTrace();
123+
LOGGER.error(e.getMessage());
123124
}
124125
return endpointCount;
125126
}
126127

127-
public Integer importSwaggerFromFile(String filePath) {
128+
public Integer importOpenapiFromFile(String filePath) {
128129
Integer endpointCount = 0;
129130

130131
try {
131132
// Read the file content into a String
132133
String openApiDefinition = new String(Files.readAllBytes(Paths.get(filePath)));
133134

134-
// Use the existing importSwagger method
135+
// Use the existing importOpenapi method
135136
endpointCount = importHttpCalls(openApiDefinition);
136137

137138
} catch (Exception e) {
@@ -145,7 +146,7 @@ public void reviewAlert(Alert alert) {
145146
Alert updatedAlert = alert;
146147
Alert originalAlert = updatedAlert.newInstance();
147148

148-
if (!alert.getTags().containsKey(AI_REVIEWED_TAG_KEY)) {
149+
if (!alert.getTags().containsKey(AI_REVIEWD_TAG_KEY)) {
149150
Confidence conf_llm;
150151
LOGGER.debug("Reviewing alert :" + alert.getName());
151152
LOGGER.debug("Confidence level from ZAP : " + alert.getConfidence());
@@ -160,7 +161,7 @@ public void reviewAlert(Alert alert) {
160161
"LLM Explanation : " + conf_llm.getExplanation() + "\n" + alert.getOtherInfo());
161162
Map<String, String> alertTags = alert.getTags();
162163

163-
alertTags.putIfAbsent(AI_REVIEWED_TAG_KEY, AI_REVIEWED_TAG_VALUE);
164+
alertTags.putIfAbsent(AI_REVIEWD_TAG_KEY, AI_REVIEWD_TAG_VALUE);
164165
updatedAlert.setTags(alertTags);
165166

166167
try {

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/ImportDialog.java

+28-34
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,12 @@ public class ImportDialog extends AbstractDialog {
6060
private static final long serialVersionUID = -7074394202143400215L;
6161

6262
private final ExtensionLlm extLlm;
63-
private JTextField fieldSwagger;
63+
private JTextField fieldOpenapi;
6464
private JButton buttonChooseFile;
6565
private JButton buttonCancel;
6666
private JButton buttonImport;
6767
private JProgressBar progressBar;
68+
private LlmOptionsParam llmOptionsParam;
6869

6970
public ImportDialog(JFrame parent, final ExtensionLlm extLlm) {
7071
super(parent, true);
@@ -79,12 +80,12 @@ public ImportDialog(JFrame parent, final ExtensionLlm extLlm) {
7980
var labelWsdl =
8081
new ZapHtmlLabel(
8182
"<html>"
82-
+ Constant.messages.getString("llm.importDialog.labelSwagger")
83+
+ Constant.messages.getString("llm.importDialog.labelOpenAPI")
8384
+ "<font color=red>*</font></html>");
8485
fieldsPanel.add(
8586
labelWsdl, LayoutHelper.getGBC(0, fieldsRow, 1, 0.5, new Insets(0, 0, 4, 4)));
8687
fieldsPanel.add(
87-
getSwaggerField(),
88+
getOpenapiField(),
8889
LayoutHelper.getGBC(1, fieldsRow, 1, 0.5, new Insets(0, 4, 4, 4)));
8990
fieldsPanel.add(
9091
getChooseFileButton(),
@@ -111,11 +112,11 @@ public ImportDialog(JFrame parent, final ExtensionLlm extLlm) {
111112
setDefaultCloseOperation(DISPOSE_ON_CLOSE);
112113
}
113114

114-
private boolean importSwagger()
115+
private boolean importOpenapi()
115116
throws IOException, URISyntaxException, ApiException, DatabaseException {
116117

117-
String swaggerLocation = getSwaggerField().getText();
118-
LlmOptionsParam llmOptionsParam = extLlm.getOptionsParam();
118+
String openapiLocation = getOpenapiField().getText();
119+
llmOptionsParam = extLlm.getOptionsParam();
119120
Integer endpointCount = 0;
120121

121122
if (StringUtils.isEmpty(llmOptionsParam.getApiKey())) {
@@ -134,40 +135,39 @@ private boolean importSwagger()
134135
new LlmCommunicationService(
135136
llmOptionsParam.getModelName(), llmOptionsParam.getApiKey(), llmOptionsParam.getEndpoint());
136137

137-
if (StringUtils.isEmpty(swaggerLocation)) {
138+
if (StringUtils.isEmpty(openapiLocation)) {
138139
ThreadUtils.invokeAndWaitHandled(
139140
() -> {
140141
showWarningDialog(
141142
Constant.messages.getString(
142-
"llm.importDialog.error.missingSwagger"));
143-
getSwaggerField().requestFocusInWindow();
143+
"llm.importDialog.error.missingOpenapi"));
144+
getOpenapiField().requestFocusInWindow();
144145
});
145146
return false;
146147
}
147148

148149
try {
149-
new URL(swaggerLocation).toURI();
150-
new URI(swaggerLocation, true);
151-
// implement logic here
152-
endpointCount = llmCommunicationService.importSwaggerFromUrl(swaggerLocation);
150+
new URL(openapiLocation).toURI();
151+
new URI(openapiLocation, true);
152+
endpointCount = llmCommunicationService.importOpenapiFromUrl(openapiLocation);
153153

154154
return true;
155155
} catch (URIException | MalformedURLException | URISyntaxException e) {
156156
// Not a valid URI, try to import as a file
157-
endpointCount = llmCommunicationService.importSwaggerFromFile(swaggerLocation);
157+
endpointCount = llmCommunicationService.importOpenapiFromFile(openapiLocation);
158158
}
159159

160-
var file = new File(swaggerLocation);
160+
var file = new File(openapiLocation);
161161
if (!file.canRead()) {
162162
ThreadUtils.invokeAndWaitHandled(
163163
() -> {
164-
showWarningFileNotFound(swaggerLocation);
165-
getSwaggerField().requestFocusInWindow();
164+
showWarningFileNotFound(openapiLocation);
165+
getOpenapiField().requestFocusInWindow();
166166
});
167167
return false;
168168
}
169169

170-
endpointCount = llmCommunicationService.importSwaggerFromFile(swaggerLocation);
170+
endpointCount = llmCommunicationService.importOpenapiFromFile(openapiLocation);
171171

172172
showMessageDialog(
173173
Constant.messages.getString("llm.importDialog.import.success", endpointCount));
@@ -185,12 +185,12 @@ private static void setContextMenu(JTextField field) {
185185
field.setComponentPopupMenu(jPopupMenu);
186186
}
187187

188-
private JTextField getSwaggerField() {
189-
if (fieldSwagger == null) {
190-
fieldSwagger = new JTextField(25);
191-
setContextMenu(fieldSwagger);
188+
private JTextField getOpenapiField() {
189+
if (fieldOpenapi == null) {
190+
fieldOpenapi = new JTextField(25);
191+
setContextMenu(fieldOpenapi);
192192
}
193-
return fieldSwagger;
193+
return fieldOpenapi;
194194
}
195195

196196
private JButton getChooseFileButton() {
@@ -213,7 +213,7 @@ private JButton getChooseFileButton() {
213213
if (state == JFileChooser.APPROVE_OPTION) {
214214
String filename = fileChooser.getSelectedFile().getAbsolutePath();
215215
try {
216-
getSwaggerField().setText(filename);
216+
getOpenapiField().setText(filename);
217217
Model.getSingleton()
218218
.getOptionsParam()
219219
.setUserDirectory(fileChooser.getCurrentDirectory());
@@ -248,20 +248,14 @@ private JButton getImportButton() {
248248
new Thread(
249249
() -> {
250250
try {
251-
if (importSwagger()) {
251+
if (importOpenapi()) {
252252
ThreadUtils.invokeAndWaitHandled(
253253
() -> {
254254
dispose();
255255
showProgressBar(false);
256256
});
257257
}
258-
} catch (IOException ex) {
259-
throw new RuntimeException(ex);
260-
} catch (URISyntaxException ex) {
261-
throw new RuntimeException(ex);
262-
} catch (ApiException ex) {
263-
throw new RuntimeException(ex);
264-
} catch (DatabaseException ex) {
258+
} catch (Exception ex) {
265259
throw new RuntimeException(ex);
266260
}
267261
},
@@ -296,7 +290,7 @@ private void showProgressBar(boolean show) {
296290
getProgressBar().setVisible(show);
297291

298292
getImportButton().setEnabled(!show);
299-
getSwaggerField().setEnabled(!show);
293+
getOpenapiField().setEnabled(!show);
300294
getChooseFileButton().setEnabled(!show);
301295
}
302296

@@ -310,6 +304,6 @@ private JProgressBar getProgressBar() {
310304
}
311305

312306
public void clearFields() {
313-
getSwaggerField().setText("");
307+
getOpenapiField().setText("");
314308
}
315309
}

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/settings/LlmOptionsPanel.java

+7-8
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public class LlmOptionsPanel extends AbstractParamPanel {
4242
private JTextField apiKeyTextField;
4343
private JTextField llmendpointTextField;
4444

45-
private JComboBox<String> llmModelsComboBox; // Added JComboBox for LLM models
45+
private JComboBox<String> llmModelsComboBox;
4646

4747
public LlmOptionsPanel() {
4848
super();
@@ -53,13 +53,13 @@ private void initComponents() {
5353
super.setName(Constant.messages.getString("llm.options.title"));
5454

5555
JLabel llmApiKey = new JLabel(Constant.messages.getString("llm.options.label.apikey"));
56-
this.apiKeyTextField = new JPasswordField(); // Initialize as JPasswordField
56+
this.apiKeyTextField = new JPasswordField();
5757

5858
JLabel llmendpoint = new JLabel(Constant.messages.getString("llm.options.label.endpoint"));
59-
this.llmendpointTextField = new JTextField(); // Initialize as JPasswordField
59+
this.llmendpointTextField = new JTextField();
6060

61-
JLabel llmModelsLabel = new JLabel("Select LLM Model:"); // Label for the combo box
62-
this.llmModelsComboBox = new JComboBox<>(new String[] {"gpt-4o"}); //
61+
JLabel llmModelsLabel = new JLabel("Select LLM Model:");
62+
this.llmModelsComboBox = new JComboBox<>(new String[] {"gpt-4o"});
6363

6464
GroupLayout layout = new GroupLayout(this);
6565
super.setLayout(layout);
@@ -77,7 +77,7 @@ private void initComponents() {
7777
.addComponent(llmendpoint)
7878
.addComponent(this.llmendpointTextField))
7979
.addGroup(
80-
layout.createSequentialGroup() // Add horizontal group for combo box
80+
layout.createSequentialGroup()
8181
.addComponent(llmModelsLabel)
8282
.addComponent(this.llmModelsComboBox)));
8383

@@ -94,8 +94,7 @@ private void initComponents() {
9494
.addGroup(
9595
layout.createParallelGroup(
9696
GroupLayout.Alignment
97-
.BASELINE) // Add vertical group for combo
98-
// box
97+
.BASELINE)
9998
.addComponent(llmModelsLabel)
10099
.addComponent(this.llmModelsComboBox)));
101100
}

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/settings/LlmOptionsParam.java

-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ public class LlmOptionsParam extends VersionedAbstractParam {
4949
private String modelName;
5050

5151
public String getApiKey() {
52-
// System.out.println("API KEY FROM attribute" + this.apiKey);
5352
return this.apiKey;
5453
}
5554

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/utils/HistoryPersister.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*
44
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
55
*
6-
* Copyright 2023 The ZAP Development Team
6+
* Copyright 2024 The ZAP Development Team
77
*
88
* Licensed under the Apache License, Version 2.0 (the "License");
99
* you may not use this file except in compliance with the License.

‎addOns/llm/src/main/java/org/zaproxy/addon/llm/utils/Requestor.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*
44
* ZAP is an HTTP/HTTPS proxy for assessing web application security.
55
*
6-
* Copyright 2023 The ZAP Development Team
6+
* Copyright 2024 The ZAP Development Team
77
*
88
* Licensed under the Apache License, Version 2.0 (the "License");
99
* you may not use this file except in compliance with the License.

‎addOns/llm/src/main/javahelp/org/zaproxy/addon/llm/resources/help/contents/about.html

+5-8
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,22 @@
22
<HTML>
33
<HEAD>
44
<TITLE>
5-
Simple Example - About
5+
ZAP LLM - About
66
</TITLE>
77
</HEAD>
88
<BODY>
9-
<H1>Simple Example - About</H1>
9+
<H1>ZAP LLM - About</H1>
1010

1111
<H2>Source Code</H2>
12-
<a href="https://github.com/zaproxy/zap-extensions/tree/main/addOns/simpleexample">https://github.com/zaproxy/zap-extensions/tree/main/addOns/simpleexample</a>
12+
<a href="https://github.com/zaproxy/zap-extensions/tree/main/addOns/simpleexample">https://github.com/zaproxy/zap-extensions/tree/main/addOns/llm</a>
1313

1414
<H2>Authors</H2>
1515
ZAP Dev Team
1616

1717
<H2>History</H2>
1818

19-
<H3>Version 2</H3>
20-
Updated to include example 'about' page.
21-
22-
<H3>Version 1</H3>
23-
First Version
19+
<H3>Version 0.0.1</H3>
20+
First Version to perform API sequencing and alert review
2421

2522
</BODY>
2623
</HTML>

0 commit comments

Comments
 (0)