Custom scripts

1. Select Custom scripts from the Advanced section in the configuration settings.
2. Click the + Add button.
3. Edit the prepopulated Name field as necessary.
4. Choose the appropriate Execution context for your script: :
   1. Before requestfor scripts to run before sending requests.
   2. After response for scripts to run after receiving responses.
   3. Parameter for tasks that involve multiple steps or filling out forms. You can use this context in conjuction with the setResultValue method to allow scripts to return results to AppScan.
5. Enter your JavaScript in the JavaScript field (code-editor) and use Ctrl+Space for auto-complete suggestions within the AppScan environment.
6. Click Add to save your script. The script is added to the list and enabled by default.
7. You can choose to enable or disable a script from the list of custom scripts using the Enable checkbox.
8. Manage your scripts using the Enable checkbox or by editing, deleting, or reordering them in the script list.
9. Click Start full scan to run the scan.
10. Result: The enabled scripts are executed for each request or response. You can view the details of the scripts from Data > Requests tab > Request/Response.

    Verify your script for syntax accuracy and compatibility with the supported JavaScript version in AppScan. For detailed guidelines, refer to JavaScript code.

    Note:

    • Custom scripts are saved in the scan configuration file and can be exported with a template. They are not included in scan results.
    • By default, custom scripts are encrypted when exported in a template. To disable encryption, set the General: Encrypt sensitive data setting to False in the scan configuration.

// Attach Authorization from stored global variable
var token = environment.globalVariables.get("Authorization");
if (token) request.headers.set("Authorization", token);

// Capture token from JSON response and store it for reuse
try {
		var result = JSON.parse(response.body);
		if (result && result.Authorization) {
			environment.globalVariables.addOrUpdate("Authorization", result.Authorization);
		}
} catch(e) { log(e); }

• No data objects (request or response) are available in this context; using them returns null.
• Return values with setResultValue(value).

// Example: Return a unique email for registration flows
function random(n) { return Math.random().toString(36).slice(2, 2+n); }
var email = "test_" + Date.now() + "_" + random(6) + "@example.test";
setResultValue(email);

// Examples:
// Handle headers
request.headers.set("Authorization", "Bearer");
request.headers.add("X-Trace", "abc");

// Manipulate body
request.body = JSON.stringify( { user:"admin" });
if(request.body.includes("admin") { ... }

// Read path
if (request.path.startsWith("/api/v1")) { ... }

// Edit query
request.query.addOrUpdate("lang","en")
request.query.remove("debug")
request.query.getQueryString()

// Read method
if (request.method == "GET") { ... }

1. Global variables: The global variables data is a key-value data structure designed to store user-specific data pairs. The keys are unique (meaning no two elements can have the same key, though multiple elements can share the same value), which is useful for sharing data between running scripts.
2. Scan status: Contains information about the current scan.

   // Check the status of the scan
   environment.status.isInExplore();
   environment.status.isInTest();

• Restricted functions: eval, Function (constructor), setTimeout, setlnterval. If any of these are used, the script fails.
• Limits: Maximum execution time: 5 seconds; memory limit: 64 MB. Exceeding these limits causes the script to fail.

  On failure, the scan pauses and details are recorded in UserScript.log.

• ES6: Generators, Tail calls
• ES8: Shared memory and atomics
• ES15: Atomics.waitAsync, Regex flag \v

1. Script failures: Check the logs folder (default: [UserDataFolder]\AppData\Roaming\HCL\AppScan Standard\logs) for details about the error. If you encounter an unhandled exception, wrap your code in a try...catch block to handle it gracefully.
2. Script not executing: Make sure the script is enabled in the configuration settings.

   If the issue is related to login/authorization, consider removing the negotiate value from Configuration→ Advanced Configuration → Security Package Order to prevent AppScan from handling those authentications automatically.