rackerlabs/deuce — pull request #233 by jc7998 (2014-12-02 18:15:13+00:00)
Title: DO NOT MERGE: API Test using ZAP

I've been thinking for a while that I would like to add a job to our CICD process that did some security validation of our APIs.

Zed Attack Proxy (https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) allows us to do a quick validation.
The script leverages the code created for the API tests and uses ZAP:
* creates a map of the Deuce API/site using ZAP as a proxy
* performs an active scan for all sorts of vulnerabilities

After setting up ZAP (which runs using Java), the execution with nosetests takes about 10 min., though the runtime can be increased/decreased based on the attach strength and the API coverage.

In order to use it with CI, we'd need a Jenkins slave in which ZAP is installed.
Have a job step start ZAP in daemon mode and execute the script. ZAP's shutdown can be handled by Jenkins or by the script.

I understand that the benefits are limited, but I do not think there are any downsides.
Thoughts?