LLM Integration #5861

TmmmmmR · 2024-10-30T09:41:38Z

Overview

This extension integrates LLM with ZAP and includes two main features:

API Sequencing: Import Swagger/OpenAPI definitions to generate sequences of HTTP calls for subsequent scanning operations.
Alert Review: Examine an alert and determine the confidence level based on evidence from ZAP, complete with an explanation for the updated confidence level.

Related Issues

Specify any related issues or pull requests by linking to them.

Checklist

For more details, please refer to the developer rules and guidelines.

Signed-off-by: Abdessamad TEMMAR <[email protected]>

… zap-llm

github-actions · 2024-10-30T09:41:52Z

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

I have read the CLA Document and I hereby sign the CLA

0 out of 2 committers have signed the CLA.
❌ @Temmar
❌ @TmmmmmR
temmar seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{Posted by the CLA Assistant Lite bot.}

kingthorin

I'll have to finish the rest of my review in a bit, but here's some starting bits.

README.md

addOns/llm/gradle.properties

addOns/llm/src/main/java/org/zaproxy/addon/llm/ExtensionLlm.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java

Signed-off-by: Abdessamad TEMMAR <[email protected]>

addOns/llm/src/main/java/org/zaproxy/addon/llm/ExtensionLlm.java

Signed-off-by: Abdessamad TEMMAR <[email protected]>

addOns/llm/src/main/java/org/zaproxy/addon/llm/communication/Confidence.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmAssistant.java

kingthorin · 2024-10-31T13:00:27Z

addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java

+                getExtAlert().updateAlert(updatedAlert);
+                getExtAlert().updateAlertInTree(originalAlert, updatedAlert);
                if (alert.getHistoryRef() != null) {
-                    alert.getHistoryRef().updateAlert(updated_alert);
+                    alert.getHistoryRef().updateAlert(updatedAlert);
                    if (alert.getHistoryRef().getSiteNode() != null) {
                        // Needed if the same alert was raised on another href for the same
                        // SiteNode
-                        alert.getHistoryRef().getSiteNode().updateAlert(updated_alert);
+                        alert.getHistoryRef().getSiteNode().updateAlert(updatedAlert);


I'm confused about these conditionals and doing the same action over and over, shouldn't the call hat 167 have done it regardless of the conditions?

I don't know why, but without this I get this exception when I do alert review for a node of alerts :

Index -1 out of bounds for length 10 java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 10

I used the same code from this extension : https://github.com/zaproxy/zap-extensions/blob/main/addOns/alertFilters/src/main/java/org/zaproxy/zap/extension/alertFilters/ExtensionAlertFilters.java#L459

addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/ImportDialog.java

Signed-off-by: Abdessamad TEMMAR <[email protected]>

kingthorin

Should only have the base help and messages.

kingthorin · 2024-10-31T16:56:38Z

There's likely a bunch of places swagger should be replaced with openapi.

https://swagger.io/blog/api-strategy/difference-between-swagger-and-openapi/

yns000 · 2024-11-08T16:05:38Z

Hi TmmmmmR,

I started my review on this, but ended up having a few questions, can I propose we setup a meeting between yourself and the 2 reviewers so that to see a demo of the addon?

Thank you,
Yiannis

TmmmmmR · 2024-11-11T14:38:35Z

Hello @yns000, yes of course ! I'm available on slack under the dev-llm channel, my username is temmar.

addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmAssistant.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/ImportDialog.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/settings/LlmOptionsPanel.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/settings/LlmOptionsParam.java

addOns/llm/src/main/java/org/zaproxy/addon/llm/utils/HistoryPersister.java

addOns/llm/src/main/javahelp/org/zaproxy/addon/llm/resources/help/contents/about.html

temmar and others added 4 commits October 24, 2024 16:52

First commit

7f029df

Update README.md

11a9d51

Signed-off-by: Abdessamad TEMMAR <[email protected]>

Merge branch 'main' of https://github.com/TmmmmmR/zap-extensions into…

caf49f6

… zap-llm

ZAP LLM - beta version

4b11032

kingthorin reviewed Oct 30, 2024

View reviewed changes

TmmmmmR added 3 commits October 31, 2024 13:44

update PR

d7cdcbb

cancel update for README.md

0252e5b

Signed-off-by: Abdessamad TEMMAR <[email protected]>

Fix minor prompt typo

9a86edc

Signed-off-by: Abdessamad TEMMAR <[email protected]>

kingthorin reviewed Oct 31, 2024

View reviewed changes

addOns/llm/src/main/java/org/zaproxy/addon/llm/ExtensionLlm.java Outdated Show resolved Hide resolved

Fix minor typo in variable name

73820ab

Signed-off-by: Abdessamad TEMMAR <[email protected]>

kingthorin reviewed Oct 31, 2024

View reviewed changes

addOns/llm/src/main/java/org/zaproxy/addon/llm/communication/Confidence.java Show resolved Hide resolved

kingthorin reviewed Oct 31, 2024

View reviewed changes

addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmAssistant.java Outdated Show resolved Hide resolved

kingthorin reviewed Oct 31, 2024

View reviewed changes

addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/ImportDialog.java Outdated Show resolved Hide resolved

Read LLM endpoint from settings

75ebe35

Signed-off-by: Abdessamad TEMMAR <[email protected]>

kingthorin reviewed Oct 31, 2024

View reviewed changes