问题描述
我是Owasp ZAP的新手，我有一个基于登录的经过身份验证的Web应用程序。登录后，当我在Owasp中进行调试时，期望动态生成用户名，密码和csrf令牌。 现在，要使ZAP jenkins作业成功，如何在ZAP jenkins作业中传递CSRF令牌？
我相信因此，我的错误越来越少-
[ZAP Jenkins Plugin] SPIDER SCAN STATUS [ 0% ]
[ZAP Jenkins Plugin] ALERTS COUNT [ 0 ]
9117 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider - Starting spider...
9117 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider - Scan will be performed from the point of view of User: fred
9134 [ZAP-SpiderThreadPool-0-thread-1] INFO org.zaproxy.zap.users.User - Authenticating user: USER
9266 [ZAP-SpiderThreadPool-0-thread-1] ERROR org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType - Unable to prepare authentication message: Index: 0,Size: 0
java.lang.indexoutofboundsexception: Index: 0,Size: 0
at java.util.ArrayList.rangeCheck(UnkNown Source)
at java.util.ArrayList.get(UnkNown Source)
at org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType$PostBasedAuthenticationMethod.extractParametersFromPostData(PostBasedAuthenticationMethodType.java:458)
at org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType$PostBasedAuthenticationMethod.replaceAntiCsrftokenValueIfrequired(PostBasedAuthenticationMethodType.java:420)
at org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType$PostBasedAuthenticationMethod.authenticate(PostBasedAuthenticationMethodType.java:339)
at org.zaproxy.zap.users.User.authenticate(User.java:265)
at org.zaproxy.zap.users.User.processMessagetoMatchUser(User.java:175)
at org.parosproxy.paros.network.HttpSender.sendAuthenticated(HttpSender.java:581)
at org.parosproxy.paros.network.HttpSender.sendAuthenticated(HttpSender.java:573)
at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478)
at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:448)
at org.zaproxy.zap.spider.SpiderTask.fetchResource(SpiderTask.java:445)
at org.zaproxy.zap.spider.SpiderTask.runImpl(SpiderTask.java:218)
at org.zaproxy.zap.spider.SpiderTask.run(SpiderTask.java:190)
at java.util.concurrent.ThreadPoolExecutor.runWorker(UnkNown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(UnkNown Source)
at java.lang.Thread.run(UnkNown Source)
9270 [ZAP-SpiderThreadPool-0-thread-1] INFO org.zaproxy.zap.users.User - Authentication Failed for user: USER
9326 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.users.User - Authenticating user: USER
9389 [ZAP-SpiderThreadPool-0-thread-2] ERROR org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType - Unable to prepare authentication message: Index: 0,Size: 0
at java.util.ArrayList.rangeCheck(UnkNown Source)
at java.util.ArrayList.get(UnkNown Source)
at org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType$PostBasedAuthenticationMethod.extractParametersFromPostData(PostBasedAuthenticationMethodType.java:458)
at org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType$PostBasedAuthenticationMethod.replaceAntiCsrftokenValueIfrequired(PostBasedAuthenticationMethodType.java:420)
at org.zaproxy.zap.authentication.PostBasedAuthenticationMethodType$PostBasedAuthenticationMethod.authenticate(PostBasedAuthenticationMethodType.java:339)
at org.zaproxy.zap.users.User.authenticate(User.java:265)
at org.zaproxy.zap.users.User.processMessagetoMatchUser(User.java:175)
at org.parosproxy.paros.network.HttpSender.sendAuthenticated(HttpSender.java:581)
at org.parosproxy.paros.network.HttpSender.sendAuthenticated(HttpSender.java:573)
at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478)
at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:448)
at org.zaproxy.zap.spider.SpiderTask.fetchResource(SpiderTask.java:445)
at org.zaproxy.zap.spider.SpiderTask.runImpl(SpiderTask.java:218)
at org.zaproxy.zap.spider.SpiderTask.run(SpiderTask.java:190)
at java.util.concurrent.ThreadPoolExecutor.runWorker(UnkNown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(UnkNown Source)
at java.lang.Thread.run(UnkNown Source)
9391 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.users.User - Authentication Failed for user: USER
9438 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.spider.Spider - Spidering process is complete. Shutting down...
9441 [ZAP-SpiderShutdownThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread - Spider scanning complete: true
解决方法
您可以（使用以下常规脚本）禁用CSRF。转到Manage Jenkins >> Script Console，然后执行以下常规脚本。
import jenkins.model.Jenkins
def instance = Jenkins.instance
instance.setCrumbIssuer(null)