ascanrulesAlpha: Improve rule performance by not calculating Levenshtein distance above the threshold

[pf-msi]

Fixes partially zaproxy/zaproxy#6655.

Issue zaproxy/zaproxy#6655 describes three problems. This PR should fix first of them, regarding performance of WebCacheDeceptionScanRule. As suggested in the issue comments, there's no point in calculating exact Levenshtein distance after reaching specified threshold.

Signed-off-by: pf-msi piotr.furman@motorolasolutions.com

[thc202]

Tweaked the pull request description to not actually fix the issue if this is merged.

[kingthorin]

The CHANGELOG.md should be updated. The LGTM failure can be addressed by rebasing current.

Thanks for tackling this.

[kingthorin]

Cool, I didn't know this was a thing.

[kingthorin]

Looks good to me, just needs a change note.

[thc202]

The LGTM failure is caused by use of Java 11 APIs.

[kingthorin]

Oh oops, I just noticed the branch was behind 😉

[pf-msi]

Ok, there was no targetCompatibility in gradle config, I must have missed that ZAP is still on JDK 8. I'll remove this String.repeat call.

[thc202]

That's defined in

zap-extensions/addOns/addOns.gradle.kts

Lines 99 to 109 in c87edce

	java {
	// Compile with Java 8 when building ZAP releases.
	if (System.getenv("ZAP_RELEASE") != null) {
	toolchain {
	languageVersion.set(JavaLanguageVersion.of(8))
	}
	} else {
	sourceCompatibility = JavaVersion.VERSION_1_8
	targetCompatibility = JavaVersion.VERSION_1_8
	}
	}

[pf-msi]

Thanks, there is indeed. Now I wonder why it has built successfully locally in my environment, and did not complain about it :)

[thc202]

How did you build? Command line or IDE?

[pf-msi]

Fixed Java API and formatting issues.

[kingthorin]

I can squash this or it can be squashed at merge if it’s good to go.

[thc202]

IMO we should fix the issue rather than add workarounds (e.g. #2892). I might take a look at that the following days.

[kingthorin]

Okay.

[thc202]

Rebased to move the changelog entry to unreleased version.

[kingthorin]

Thank you both!

[thc202]

While longer term it would be better to replace the algorithm having this change is still better than keep hanging the scan rule.

[kingthorin]

I think a number of these can probably use ComparableResponse once it's ready.