Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Alert flags on fields with issues no longer work #290

Closed
psiinon opened this issue Dec 7, 2018 · 3 comments
Closed

Alert flags on fields with issues no longer work #290

psiinon opened this issue Dec 7, 2018 · 3 comments
Assignees
Labels

Comments

@psiinon
Copy link
Member

psiinon commented Dec 7, 2018

To reproduce scan the bodgeit search page to find the XSS. The search field is correctly highlighted and an icon is added, but clicking on that icon has no effect.
An error is shown in the console:

17:14:39 GMT-0500 (Eastern Standard Time) ERROR errorHandler: TypeError: json.alert is undefined
	 showAlertDetails    https://zap//zapCallBackUrl/-8471248859937673292?name=tools/utils/alertUtils.js 103:: {}
@psiinon psiinon added the bug label Dec 7, 2018
@psiinon
Copy link
Member Author

psiinon commented Dec 7, 2018

Looks like its calling the API endpoint /core/view/alert/?id=undefined ;)

@psiinon
Copy link
Member Author

psiinon commented Dec 7, 2018

@dscrobonia I think the bug is that https://github.com/zaproxy/zap-hud/blob/develop/src/main/zapHomeFiles/hud/tools/commonAlerts.js#L55 isnt including the tabId, unlike https://github.com/zaproxy/zap-hud/blob/develop/src/main/zapHomeFiles/hud/tools/commonAlerts.js#L71

The trouble is the message originates from inject.js: https://github.com/zaproxy/zap-hud/blob/develop/src/main/zapHomeFiles/hud/target/inject.js#L266 which doesnt appear to have access to the tabId. Will we need to pass that in or is there a better way?

@dscrobonia
Copy link
Contributor

ah! yah that is the bug. and the inject does have access to the tabId, because it generated it! https://github.com/zaproxy/zap-hud/blob/develop/src/main/zapHomeFiles/hud/target/inject.js#L13

:) good find

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants