PoC: Setup ZAP in the test environment to run passive checks through the activation tests

[alopezari]

This PR aims to introduce OWASP ZAP as a pentesting tool to perform security checks passively on the Playwright tests by using it as a proxy.

In concrete, this PoC covers checking the feasibility of adding such feature, analyzing the behaviour of the QIT in that condition and overcome the main challenges we might find when setting up ZAP together with Playwright.

Below you can find the flows performed by the QIT when running Playwright tests both without the changes from this PR and with it.

Without the changes from this PR:

flowchart LR
    QIT --> PlaywrightTests
    PlaywrightTests -->|E2E tests<br/>API tests| SUT

    QIT[QIT]
    PlaywrightTests[Playwright Tests]
    SUT[SUT]

Loading

With the changes from this PR:

flowchart LR
    QIT --> PlaywrightTests
    PlaywrightTests -->|Proxy| ZAP
    ZAP -->|E2E tests<br/>API tests<br/>Security checks| SUT

    QIT[QIT]
    PlaywrightTests[Playwright Tests]
    ZAP[ZAP]
    SUT[SUT]

Loading

By setting ZAP as a proxy in Playwright, we will be able to run Playwright tests as usual, but now ZAP will perform security checks on all pages captured during the Playwright tests (no matter if they are E2E or API), generating a report at the end of the execution.

This new feature is controlled by a new environment variable QIT_SECURITY_CHECKS_PROXY in a way that - when enabled - it will start a container with ZAP running in daemon mode, configure Playwright to use it as a proxy, generate the security reports and turn down the new ZAP container together with the rest of the environment at the end of the flow.

Changes introduced in this PR

• The E2EEnvironment class was updated to start a container with ZAP running in daemon mode when setting up the environment if QIT_SECURITY_CHECKS_PROXY is enabled.
• The E2EEnvInfo class was updated with 2 new attributes * zap_container and zap_proxy, some values that we need in other parts of our code.
• The Environment class was updated to teardown the ZAP container (if QIT_SECURITY_CHECKS_PROXY is enabled) together with the rest of the environment.
• The PlaywrightRunner class was updated to set the ZAP proxy in the Playwright config and include the reports as part of the test artifacts if QIT_SECURITY_CHECKS_PROXY is enabled.

Testing instructions

• Checkout to this branch.
• Start the Compatibility Dashboard local environment.
• Configure QIT-CLI to use the local backend - php src/qit-cli.php backend:add, then choose Local.
• Run the activation tests with the security checks flag enabled - QIT_SECURITY_CHECKS_PROXY=1 php src/qit-cli.php run:activation automatewoo.
• Check in the terminal logs that Zaproxy was installed successfully - you should see something like:

Setting up Zaproxy for E2E security checks...
Waiting for Zaproxy to be ready...
Zaproxy is ready!

• Once the tests have finished running, make sure they passed and 2 new items are included with the test artifacts folder: zap-report.html and zap-report.json.
• Open these reports and verify that requests were indeed captured by ZAP and security rules were applied to it (attaching a JSON report for reference - zap-report.json)