Automation - make variable substitution work anywhere in yaml

Is your feature request related to a problem? Please describe.

I have tried to use (env) variables in my YAML file for the automation framework, but it looks like variables only work in the env.ctx section of that YAML.

Describe the solution you’d like

It would be nice if I could write a YAML file like so:

env:
  contexts:
    # .. my context
jobs:
  - type: "openapi"
    parameters:
      apiFile: ${OPENAPI_FILE}

Additionally, using variables defined in env.vars should be usable across the configuration as well:

env:
  contexts:
    # .. my context
  vars:
    myApiFile: openapi.json
jobs:
  - type: "openapi"
    parameters:
      apiFile: ${myApiFile}

Describe alternatives you’ve considered

I have also tried pulling in the environment variables via env.parameters.vars, like so:

env:
  contexts:
    # .. my context
  vars:
    openapiFile: ${OPENAPI_FILE}
jobs:
  - type: "openapi"
    parameters:
      apiFile: ${openapiFile}

Screenshots

No response

Additional context

• When I use a variable that does not exist somewhere in the env.contexts, I get an error saying “Variable myVariable used but not specified”, but when I try ${myVariable} in the jobs section, it’s just null
• I looked at the PR that implemented variable substitution for the automation framework (https://github.com/zaproxy/zap-extensions/pull/2883) and it looks pretty clear to me that this only works for the env section.
• However that PR also contains some docs, like this line: vars: # List of 1 or more variables, can be used throughout the config. This seems to suggest that variables can be used throughout the config.

Would you like to help fix this issue?

• Yes

[twolfart]

I have not looked at integer substitution though. Could you please give an example of something that doesn’t work @psiinon ?

env:
  vars:
    SPIDER_DURATION: 5

jobs:
  - type: spider
    parameters:
      maxDuration: ${SPIDER_DURATION}

Results in:

Automation plan failures:
        Invalid value for job spider parameter maxDuration - ${SPIDER_DURATION} should be an integer

[psiinon]

@rethab great! I’m assigned this issue to you. We do have a load of docs eg https://www.zaproxy.org/docs/contribute/coding/ I’ve labelled this as a ‘good first issue’ as there are already examples in the code of how to do this, but if you need any pointers then just say. We do need unit tests for all PRs but again, if you need any advice and guidance for that then just say. You dont have to fix everything in your first PR - just fixing one instance would be fine and a good way to get used to our proceedures 😃