Documentation
¶
Overview ¶
Package dastsession executes approved, authenticated DAST request batches.
Index ¶
- Constants
- type Service
- func (s *Service) Crawl(ctx context.Context, admitted safety.AdmittedAction, config dastsession.Config, ...) (dastcrawl.Result, error)
- func (s *Service) CrawlWithRate(ctx context.Context, admitted safety.AdmittedAction, ...) (dastcrawl.Result, error)
- func (s *Service) Execute(_ context.Context, _ safety.AdmittedAction, _ dastsession.Config, ...) (ports.DASTOutcome, error)
- func (s *Service) ExecuteWithBinding(ctx context.Context, admitted safety.AdmittedAction, ...) (ports.DASTOutcome, error)
Constants ¶
const ( ToolAuthenticatedDAST = "run_authenticated_dast" ActionAuthenticatedDAST = "dast.authenticated_scan" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service delegates all HTTP to the sandboxed helper and authorizes every request through the shared execution guard before the helper can issue it.
func NewService ¶
func (*Service) Crawl ¶
func (s *Service) Crawl(ctx context.Context, admitted safety.AdmittedAction, config dastsession.Config, input dastcrawl.Input, limits dastcrawl.Limits) (dastcrawl.Result, error)
Crawl submits each discovered GET/HEAD request through Execute, retaining its per-request authorization and sandbox helper boundary.
func (*Service) CrawlWithRate ¶
func (*Service) Execute ¶
func (s *Service) Execute(_ context.Context, _ safety.AdmittedAction, _ dastsession.Config, _ []dastsurface.Request) (ports.DASTOutcome, error)
Execute refuses, for the same reason Crawl does: without an approval-bound helper and configuration digest there is nothing tying this run to what a human approved, and dastengine.Engine rightly rejects such a plan. Refusing HERE names the missing binding instead of failing deep inside the engine with a message about a digest the caller was never asked to supply.
Use ExecuteWithBinding, passing the helper and digest from the approval whose argv commits to them -- exactly as dastworkflow/scan.go already does for CrawlWithRate.
func (*Service) ExecuteWithBinding ¶
func (s *Service) ExecuteWithBinding(ctx context.Context, admitted safety.AdmittedAction, helperBin, configDigest string, config dastsession.Config, requests []dastsurface.Request) (ports.DASTOutcome, error)
ExecuteWithBinding replays an approved request set. It reauthorizes every actual helper request; the helper receives credentials only as vault placeholders in env. helperBin and configDigest come from the approval that authorized this exact configuration.
Source Files