0001718: OpenVAS XML-Respone can only be read if order and spaces are exactly as expectet by PacketFence - PacketFence

(0003454)
erSitzt (reporter)
2013-09-25 04:24

I've removed the Base64 encoded part of the response here to keep the post readable.

(0003455)
erSitzt (reporter)
2013-09-25 05:19

I suggest using XML::Simple, this returns an easy to use hash.

$VAR1 = {
          'report' => {
                      'format_id' => '6c248850-1f62-11e1-b082-406186ea4fc5',
                      'extension' => 'html',
                      'content_type' => 'text/html',
                      'content' => 'BASE64ENCODEDCONTENT',
                      'type' => 'scan',
                      'id' => '15ce0c2d-bf8c-4972-a0f6-fe1e75bb298a'
                    },
          'status' => '200',
          'status_text' => 'OK'
        };

This is what it looks like in openvas.pm

    my $xml = new XML::Simple;
    my $response = $xml->XMLin($output);
    my $status = $response->{'status'};
    my $escalator_id = $response->{'id'};

    # Fetch response status and escalator id
    # Scan escalator successfully created
    if ( defined($status) && $status eq $RESPONSE_RESOURCE_CREATED ) {
        $logger->info("Scan escalator named $name successfully created with id: $escalator_id");
        $this->{_escalatorId} = $escalator_id;
        return $TRUE;
    }

I've renamed $response to $status, because thats what it is.

I'll attach my version of the file.

(0003456)
erSitzt (reporter)
2013-09-25 08:30

I needed to untaint the result of the $command executed by pf_run in util.pm

From line 983:

    } else {
        # scalar context
        `$command` =~ /^(.*)$/;
        $result = $1;
        return $result if ($CHILD_ERROR == 0);
    }

Issue History
Date Modified	Username	Field	Change
2013-09-25 04:22	erSitzt	New Issue
2013-09-25 04:24	erSitzt	Note Added: 0003454
2013-09-25 05:19	erSitzt	Note Added: 0003455
2013-09-25 05:22	erSitzt	File Added: openvas.pm
2013-09-25 08:30	erSitzt	Note Added: 0003456

Notes
(0003454) erSitzt (reporter) 2013-09-25 04:24	I've removed the Base64 encoded part of the response here to keep the post readable.

(0003455) erSitzt (reporter) 2013-09-25 05:19	I suggest using XML::Simple, this returns an easy to use hash. $VAR1 = { 'report' => { 'format_id' => '6c248850-1f62-11e1-b082-406186ea4fc5', 'extension' => 'html', 'content_type' => 'text/html', 'content' => 'BASE64ENCODEDCONTENT', 'type' => 'scan', 'id' => '15ce0c2d-bf8c-4972-a0f6-fe1e75bb298a' }, 'status' => '200', 'status_text' => 'OK' }; This is what it looks like in openvas.pm my $xml = new XML::Simple; my $response = $xml->XMLin($output); my $status = $response->{'status'}; my $escalator_id = $response->{'id'}; # Fetch response status and escalator id # Scan escalator successfully created if ( defined($status) && $status eq $RESPONSE_RESOURCE_CREATED ) { $logger->info("Scan escalator named $name successfully created with id: $escalator_id"); $this->{_escalatorId} = $escalator_id; return $TRUE; } I've renamed $response to $status, because thats what it is. I'll attach my version of the file.

(0003456) erSitzt (reporter) 2013-09-25 08:30	I needed to untaint the result of the $command executed by pf_run in util.pm From line 983: } else { # scalar context `$command` =~ /^(.*)$/; $result = $1; return $result if ($CHILD_ERROR == 0); }

Relationships