Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OAST should cache a copy of the registered HTTP message #7027

Open
denniskniep opened this issue Jan 16, 2022 · 3 comments
Open

OAST should cache a copy of the registered HTTP message #7027

denniskniep opened this issue Jan 16, 2022 · 3 comments

Comments

@denniskniep
Copy link
Member

Describe the bug
After solving that issue: #7004
There will be no "ZAP IO Error" with the exception visible in the response in specific ActiveScan with OAST AddOn cases:

OAST create HistRef on incoming pingback. The catch of the send might happen later (e.g. OAST poll is 10 sec and 15 sec read timeout). In the catch block the exception is set to the HttpMessage response which is too late, because its already saved.

@denniskniep denniskniep changed the title Oast Oast not Attaching Error to ActiveScan Messages with Exception Jan 16, 2022
@denniskniep denniskniep changed the title Oast not Attaching Error to ActiveScan Messages with Exception Oast not attaching Error to ActiveScan messages with Exception Jan 16, 2022
@thc202
Copy link
Member

thc202 commented Jan 16, 2022

It would be better described as "OAST should cache a copy of the registered HTTP message" (or something along those lines) which is actually the problem, the current title is a side effect.

@denniskniep denniskniep changed the title Oast not attaching Error to ActiveScan messages with Exception OAST should cache a copy of the registered HTTP message Jan 16, 2022
@ricekot
Copy link
Member

ricekot commented Jun 19, 2022

The message that is added to the alerts is actually the one received by the OAST service and forwarded to ZAP, right? We would not want to change those. Also, the poll request is not shown in the History tab so I think in that case a warning should be sufficient.

@thc202
Copy link
Member

thc202 commented Jun 19, 2022

No, the alert has the message crafted by the scan rule which is about to be sent, e.g.: https://github.com/zaproxy/zap-extensions/blob/13364a19d5f9d9d51b60a78a37329498a9b070e2/addOns/ascanrulesAlpha/src/main/java/org/zaproxy/zap/extension/ascanrulesAlpha/OutOfBandXssScanRule.java#L167-L175

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

3 participants