ZAP failing with: Supported versions = 2.4.0 and up - got 2.8.0

[hazana]

For both docker and installed glue fails to use ZAP:

~# docker run --network="host" owasp/glue -t zap --zap-host http://127.0.0.1 --zap-port 8080 http://127.0.0.1:3000
Loading scanner...
Logfile nil?
calling scan
Running scanner
Mounting http://127.0.0.1:3000 with #<Glue::URLMounter:0x000000025f0198>
Mounted http://127.0.0.1:3000 with #<Glue::URLMounter:0x000000025f0198>
Processing target...http://127.0.0.1:3000
Running tasks in stage: wait
Running tasks in stage: mount
Running tasks in stage: file
Running tasks in stage: code
Running tasks in stage: live
Install ZAP from owasp.org and ensure that the configuration to connect is correct.  Supported versions = 2.4.0 and up - got 2.8.0
Running tasks in stage: done
Running base report...


~/glue# ruby bin/glue -t zap --zap-host http://localhost --zap-port 8080 http://localhost:3000
Logfile nil?
calling scan
Running scanner
Loading scanner...
Mounting http://127.0.0.1:3000 with #<Glue::URLMounter:0x000055ea8d0de2b0>
Mounted http://127.0.0.1:3000 with #<Glue::URLMounter:0x000055ea8d0de2b0>
Processing target...http://127.0.0.1:3000
Running tasks in stage: wait
Running tasks in stage: mount
Running tasks in stage: file
Running tasks in stage: code
Running tasks in stage: live
Install ZAP from owasp.org and ensure that the configuration to connect is correct.  Supported versions = 2.4.0 and up - got 2.8.0
Running tasks in stage: done
Running base report...

[omerlh]

Yes, look like we're not supporting 2.8 yet. I guess due to zaproxy/zaproxy#5162 we need to change the code a bit. I'm not sure I'll do it as I think using the dynamic task is better. See the docs here for details on how to use it.

[hazana]

@omerlh What are the advantages of the dynamic task if Glue is being used to run the series of tools and having it send the reports to a seperate defect tracker?

[omerlh]

In this case, it will not be useful. The dynamic task makes it easier to integrate tools into Glue, and make it easier to update it when the external tool is changed. If you do not wish to use it, it requires a small change in the code - I might be able to do it later on this week. If you'll have time, a PR is appreciated - and I can guide you.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.