Cannot detect injection vulnerabilities on null value JSON objects

[gitveio]

As the title describes, if the JSON of the request content is:
{"name":null}
The attribute of name will not be tested at all. In fact, the name has a SQL injection problem.

But if you modify the JSON to:
{"name":""}
In this case, the problem will be detected. I am not sure if this is a real problem or just a configuration problem.
Can anyone help me, thanks

[thc202]

Right, null values are not tested, I guess they aren't because ZAP does not know which type is supposed to be there (e.g. is it an object, an array, or a string?). It could default to string...

[psiinon]

+1 for defaulting to string :)

[gitveio]

Understand, thank you for your reply.

[gitveio]

Can I deal with this one, and if so, whether dealing with all null values will significantly reduce the test speed. If it is me, an option switch may be added to "input vectors", which is not checked by default. Is this acceptable, or some other ideas.

[kingthorin]

I like the idea of making it optional, I'm not sure if it should be opt-in or opt-out. How often do uou see null values in json vs. empty strings?

It would be similar to the changes done here:

• ascan: Make addition of query param optional #4976
• Help update - Optional addition of query param zap-core-help#203

[thc202]

@gitveio are you still working on this issue?

[gitveio]

Sorry, I'm not working on it.

[thc202]

OK, no worries. Reopening, still worth addressing.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.