Skip to content

Security platform dependency #586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Antu7 wants to merge 4 commits into
base: dev
Choose a base branch
from
Open

Security platform dependency #586

Antu7 wants to merge 4 commits into from

Conversation

@Antu7
Copy link
Collaborator

@Antu7 Antu7 commented Aug 20, 2025

PR Checklist

  • Tests for the changes have been added / updated.
  • Documentation comments have been added / updated.
  • A changelog entry has been made.
  • Version number has been updated.
  • Required modules have been added to respective "requirements*.txt" files.
  • Relevant Test Cases added to this description (below).
  • (Team) Label with affected action categories and semver status.

Overview

This PR addresses critical cross-platform compatibility issues with security scanning tools Arachni and Wapiti, and introduces Docker-based Arachni for consistent behavior across all platforms.

Current Behavior (Issues Fixed):

  • Arachni: Fails on macOS with "Too many levels of symbolic links" and library dependency errors
  • Wapiti: Installation fails on macOS due to Python 3 compatibility issues and missing greenlet dependency
  • Platform Dependency: Security tools only work reliably on Linux, breaking automation on macOS/Windows

New Behavior:

  • Arachni: Now runs via Docker container, ensuring identical behavior across Linux, macOS, and Windows
  • Wapiti: Integrated with uvx/uv for cross-platform execution without global installation
  • Cross-Platform: All security tools now work consistently regardless of operating system
  • Automated Setup: No manual intervention required - tools are automatically configured

Breaking Changes:

  • Arachni: Now requires Docker to be installed and running (previously used native binaries)
  • Wapiti: Now uses uvx/uv execution instead of global pip installation

Test Cases

  • TEST-8309 - Security scanning with Arachni and Wapiti

Technical Details

Arachni Docker Integration:

  • Added Dockerfile.arachni for custom lightweight Arachni image
  • Added docker-compose.yml for container orchestration with memory limits
  • Updated arachni_download.py to use Docker instead of native installation
  • Fixed arachni_run.py for proper HTML report generation and directory handling
  • Reports are now saved as both AFR files and compressed HTML (.html.zip)

Wapiti Cross-Platform Fix:

  • Integrated uvx/uv execution for Wapiti without global installation
  • Added automatic fallback chain: binary → uvx → uv → system package managers
  • Fixed greenlet dependency issue with --with greenlet flag
  • Added comprehensive installation verification and error handling

Files Modified:

  • Framework/Built_In_Automation/Security/BuiltInFunctions.py - Added Wapiti auto-installation and uvx integration
  • Framework/Built_In_Automation/Security/arachni_download.py - Converted to Docker-based approach
  • Framework/Built_In_Automation/Security/arachni_run.py - Fixed HTML report generation and Docker execution
  • Framework/Built_In_Automation/Security/helper.py - Enhanced helper functions
  • Added Dockerfile.arachni and docker-compose.yml for containerization

Benefits

  • Reliability: Security scans now work consistently across all platforms
  • Maintainability: No more platform-specific binary downloads or dependency issues
  • Performance: Docker-based Arachni provides consistent performance regardless of host OS
  • User Experience: Zero manual setup required - tools work out of the box
  • Future-Proof: Easy to update security tools by updating Docker images

Testing

  • ✅ Tested on macOS (Apple Silicon) with Docker
  • ✅ Verified Arachni scan execution and report generation
  • ✅ Confirmed Wapiti execution via uvx/uv
  • ✅ Validated cross-platform compatibility approach

Antu7 added 3 commits August 19, 2025 00:19
@Antu7
wipty running for mac independently feature added
b883195
@Antu7
Add Docker-based Arachni security scanning with cross-platform support
aefa55b 
- Add Dockerfile.arachni for containerized Arachni
- Add docker-compose.yml for easy container management
- Update arachni_download.py to use Docker instead of native installation
- Fix arachni_run.py for proper HTML report generation
- Add reports directory with sample scan outputs
- Exclude uv.lock from commit to avoid dependency conflicts
@Antu7
Remove reports folder from repository
f233269 
- Delete arachni_report.html.zip (sample scan output)
- Delete output.afr (sample scan results)
- Keep reports folder structure for future scan outputs
- Exclude uv.lock from commit to avoid dependency conflicts
@Antu7 Antu7 added the enhancement New feature or request label Aug 20, 2025
@Antu7 Antu7 self-assigned this Aug 20, 2025
@Antu7
Fix Arachni and Wapiti report saving to use test case security_report…
3d82aeb 
… directory

- Update arachni_run.py to save reports directly to security_report_dir parameter
- Modify BuiltInFunctions.py to pass security_report_dir to Arachni scan
- Remove Wapiti subfolder creation for consistent report location
- Update docker-compose.yml to remove root-level volume mounts
- All security tools (Nmap, Arachni, Wapiti) now save to same location
- Eliminate dependency on root-level reports folder
- Use docker cp for direct file transfer from container to test case directory
@Antu7 Antu7 requested a review from sazid August 20, 2025 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sazid sazid Awaiting requested review from sazid

At least 1 approving review is required to merge this pull request.

Assignees

@Antu7 Antu7

Labels

enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Antu7