Skip to content

add rapidast config and instruction to run it #1054

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PratikMahajan wants to merge 1 commit into
base: master
Choose a base branch
from
Open

add rapidast config and instruction to run it #1054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions dist/rapidast/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# RapidAST Security Scanning

Run automated security scans against OpenShift APIs using RapidAST container.
Copy link
Member

@hongkailiu hongkailiu Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NIT: to keep consistent with last section in the page.

Suggested change
Run automated security scans against OpenShift APIs using RapidAST container.
Run automated security scans against OpenShift upgrades APIs using RapidAST container.


## Quick Start

```bash
# Pull the container
podman pull quay.io/redhatproductsecurity/rapidast:latest

# Create results directory
mkdir -p results
Copy link
Contributor

@DavidHurta DavidHurta Nov 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Running the following podman command as is results in:

$ podman run   -v $(pwd)/rapidast-config.yaml:/tmp/config.yaml:Z   -v $(pwd)/results:/opt/rapidast/results:Z   quay.io/redhatproductsecurity/rapidast:latest   --config /tmp/config.yaml
INFO:Validating configuration
INFO:Configuration is valid
INFO:Starting the redaction and dumping process for the configuration file: /tmp/config.yaml
ERROR:Error occurred while dumping redacted config: [Errno 13] Permission denied: './results/openshift-upgrades-api'
ERROR:Failed to dump configuration. Exiting.

I had a look at the respective docs. They reference running $ chmod o+w ./results after creating the directory. This fixes the issue for me.

Copy link
Member

@hongkailiu hongkailiu Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe I am a mac user (same as Pratik?), the exact command works for me.

Copy link
Member

@hongkailiu hongkailiu Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NIT: Could we add dist/rapidast/results/ into .gitignore?


# Run security scan
podman run --rm \
-v $(pwd)/rapidast-config.yaml:/tmp/config.yaml \
-v $(pwd)/results:/opt/rapidast/results \
quay.io/redhatproductsecurity/rapidast:latest \
--config /tmp/config.yaml
Comment on lines +15 to +19
Copy link
Contributor

@DavidHurta DavidHurta Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Running the command as is results in (with a modified results directory permissions):

$ podman run   -v $(pwd)/rapidast-config.yaml:/tmp/config.yaml   -v $(pwd)/results:/opt/rapidast/results   quay.io/redhatproductsecurity/rapidast:latest   --config /tmp/config.yaml
Traceback (most recent call last):
  File "/opt/rapidast/./rapidast.py", line 625, in <module>
    run()
  File "/opt/rapidast/./rapidast.py", line 348, in run
    validate_config_schema(config_file)
  File "/opt/rapidast/./rapidast.py", line 293, in validate_config_schema
    config = yaml.safe_load(load_config_file(config_file))
  File "/opt/rapidast/./rapidast.py", line 91, in load_config_file
    return open(config_file_location, mode="r", encoding="utf-8")
PermissionError: [Errno 13] Permission denied: '/tmp/config.yaml'

I had a look at the respective docs. They reference the usage of :Z regarding the permissions on the mounts.

Copy link
Contributor

@DavidHurta DavidHurta Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: We can omit the --config flag if we utilize the default configuration path /opt/rapidast/config/config.yaml for the mount. Noting this in case you find it helpful.

```

## Configuration

- `rapidast-config.yaml`: Scan configuration for OpenShift upgrades API
- Disables only cookie/session rules (appropriate for stateless APIs)
- Uses passive scanning (safe for production)
37 changes: 37 additions & 0 deletions dist/rapidast/rapidast-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# RapidAST Configuration for OpenShift Upgrades API Security Scanning
# This configuration is optimized for stateless REST APIs
# - Uses passive scanning (safe for production)
# - Disables only cookie/session rules (not applicable to stateless APIs)
# - Provides comprehensive security coverage

config:
configVersion: 6

# Application configuration
application:
shortName: "openshift-upgrades-api" # Display name for reports
url: "https://api.stage.openshift.com" # Base URL (without path) stage as example

# General settings
general:
# No authentication required for the public API
# For authenticated APIs, add oauth2_rtoken, http_basic, etc.

# Scanner configurations
scanners:
zap: # OWASP ZAP scanner
# OpenAPI specification-based scanning
apiScan:
apis:
apiUrl: "https://api.stage.openshift.com/api/upgrades_info/openapi"

# Passive scanning rules (analyzes traffic without active attacks)
passiveScan:
# Disabled rules appropriate for stateless APIs:
# 10054: Cookie without SameSite Attribute (not applicable)
# 10112: Session Management Response Identified (not applicable)
disabledRules: "10054,10112"

Copy link
Contributor

@DavidHurta DavidHurta Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: I have quickly found out that html reports are supported! Could we add them as a format for a human-readable output? Although that may depend on how the configuration is to be consumed, which is not clear to me at the moment.

Suggested change
report:
format: ["json","html"]

# Additional ZAP extensions
miscOptions:
additionalAddons: "ascanrulesBeta" # Beta active scan rules
Copy link
Member

@hongkailiu hongkailiu Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is ascanrulesBeta for?
I cannot see its meaning in https://github.com/search?q=repo%3ARedHatProductSecurity%2Frapidast%20ascanrulesBeta&type=code

I cannot tell the difference either in the generated report withoutmiscOptions.