Point the scanner merge at /scanner/dast and skip non-JSON responses (#122)

lua-modules/vulnerableapp_utility.lua

@@ -1,27 +1,47 @@
+local cjson = require("cjson.safe")
+
 local vulnerableapp_utility = {}
 
+-- An app can answer 200 with a body that is not JSON. VulnerableApp-php does exactly that on the
+-- scanner endpoints, replying "/VulnerableApp-php/scanner/dast is not available" as text/html.
+-- Splicing such a body in produces a document that is not JSON at all, so the whole merged
+-- response becomes unreadable rather than one app being missing from it.
+--
+-- The body is decoded only to check it and is then discarded: the merge still splices the raw
+-- bytes, so each app's own key order and formatting reach the caller unchanged. A truncated body
+-- is refused because ngx.location.capture reports one with status 200 and a partial body, which
+-- can begin like JSON and still end mid-document. Only an object or an array is accepted, since
+-- the aggregate maps an app name to its findings and a bare number or string would satisfy the
+-- syntax without fitting that shape.
+local function carries_json(response)
+    if (not response or response.status ~= 200 or not response.body or response.truncated) then
+        return false
+    end
+    return type(cjson.decode(response.body)) == "table"
+end
+
 function vulnerableapp_utility.merge_vulnerability_information(vulnerableAppResponse, vulnerableAppJspResponse, vulnerableAppPhpResponse, llmForgeResponse)
     local response = "{"
     local appendComma = false
-    if (vulnerableAppResponse.status == 200) then
+    if (carries_json(vulnerableAppResponse)) then
         response = response .. '"VulnerableApp":' .. vulnerableAppResponse.body
         appendComma = true
     end
-    if (llmForgeResponse and llmForgeResponse.status == 200) then
+    if (carries_json(llmForgeResponse)) then
         if (appendComma) then
             response = response .. ","
         end
         appendComma = true
         response = response .. '"llmforge":' .. llmForgeResponse.body
     end
-    if (vulnerableAppJspResponse.status == 200) then
+    if (carries_json(vulnerableAppJspResponse)) then
         if (appendComma) then
             response = response .. ","
         end
         appendComma = true
         response = response .. '"VulnerableApp-jsp":' .. vulnerableAppJspResponse.body
     end
-    if (vulnerableAppPhpResponse.status == 200) then
+    if (carries_json(vulnerableAppPhpResponse)) then
         if (appendComma) then
             response = response .. ","
         end

nginx.conf

@@ -94,7 +94,7 @@ http {
 			default_type 'application/json';
 			content_by_lua_block {
 				local vulnerableAppResponse, vulnerableAppJspResponse, vulnerableAppPhpResponse = ngx.location.capture_multi({
-					{ "/VulnerableApp/scanner" },
+					{ "/VulnerableApp/scanner/dast" },
 					{ "/VulnerableApp-jsp/scanner/dast" },
 					{ "/VulnerableApp-php/scanner/dast" }
 				})