Support PATCH method

[frankie1984]

We use a zest script to go thru a flow with SAML.
Halfway thru that flow we need to perform a HTTP Patch.

We found out that HTTP Patch is nog supported.

Why is dat not supported? And is there a better way than using zest script?

We run zap scan from gitlab with an automation plan that kicks off the zest script to be able to run the SAML usecase.

[psiinon]

I can't think of a good reason why its not supported, so would definitely be good with extending Zest to support PATCH.

[frankie1984]

the impl is in: ComponentsHttpClient
I will make a pull request for it.

[thc202]

Would be good to know what/why you are not seeing PATCH being sent when using Zest in ZAP as that should be working. (Not against changing that class, but if you are running Zest from ZAP that class should be irrelevant).

[frankie1984]

Were triggering the zest script from within an Automation flow.
We create the zest script in the ZAP UI.

• type: script
  parameters:
  name: project-flow
  type: sequence
  action: add
  engine: "Zest : Mozilla Zest"
  source: "${ZEST_SCRIPT_PATH}"

If you say theres a better way than that would be nice.

the error we get is this:

Unexpected error Method not supported: PATCH - see log for details
Job sequence-activeScan finished, time taken: 00:00:23
Automation plan failures:
Unexpected error Method not supported: PATCH - see log for details
ZAP scan failed

[thc202]

Yeah, that needs to be fixed in the Zest add-on.

[kingthorin]

See L193

zest/src/main/java/org/zaproxy/zest/impl/ComponentsHttpClient.java

Lines 168 to 194 in a93a80c

	public ZestResponse send(ZestRequest req) throws IOException {
	HttpRequestBase method;
	switch (req.getMethod()) {
	case "GET":
	method = new HttpGet(req.getUrl().toString());
	break;
	case "POST":
	method = new HttpPost(req.getUrl().toString());
	break;
	case "OPTIONS":
	method = new HttpOptions(req.getUrl().toString());
	break;
	case "HEAD":
	method = new HttpHead(req.getUrl().toString());
	break;
	case "PUT":
	method = new HttpPut(req.getUrl().toString());
	break;
	case "DELETE":
	method = new HttpDelete(req.getUrl().toString());
	break;
	case "TRACE":
	method = new HttpTrace(req.getUrl().toString());
	break;
	default:
	throw new IllegalArgumentException("Method not supported: " + req.getMethod());
	}

[frankie1984]

it only needs:

case "PATCH":
method = new HttpPatch(req.getUrl().toString());
break;

will you fix it or should i make a pullrequest?

[thc202]

Feel free to PR but that class is irrelevant to ZAP (or should be, which is bug in the Zest add-on).

[frankie1984]

yes i know, thats why i created this issue here in the zest project

[kingthorin]

Feel free to PR but that class is irrelevant to ZAP (or should be, which is bug in the Zest add-on).

Okay thanks.

yes i know, thats why i created this issue here in the zest project

He means the zest add-on in https://github.com/zaproxy/zap-extensions (vs. here in this repo which is the zest library).

[thc202]

For the record it was actually a bug in the sequence add-on.