Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Firing Range: Improve Escaped XSS results #7122

Open
6 tasks
psiinon opened this issue Mar 7, 2022 · 1 comment
Open
6 tasks

Firing Range: Improve Escaped XSS results #7122

psiinon opened this issue Mar 7, 2022 · 1 comment
Labels
add-on FalseNegative tracker

Comments

@psiinon
Copy link
Member

psiinon commented Mar 7, 2022 •
edited

We run ZAP against Google Firing Range (FR) using a scheduled task and publish the results on https://www.zaproxy.org/docs/scans/firingrange/

This is a tracker issue which covers improving the ZAP results against the 'Escaped XSS' section of FR.
It is important to note that the priority here is to improve the ZAP scan results against real work apps so any improvements should be generic rather than tailored for FR.

PRs do not have to fix all of the false negatives - a change which just finds one new XSS in that section would be appreciated.
For more information about improving scan rules see https://www.zaproxy.org/docs/contribute/scan-rules/
In this case the relevant scan rule is linked to from each test.
As always all PRs should include full unit tests.

It is possible that some of the FR tests are no longer valid due to browser security improvements. If you believe this to be the case then please let us know and we will do our best to confirm that.

As this is a tracker it will not be assigned to any one individual.

The following failing test cases have been assigned:

The following URLs are confirmed to be unexploitable on modern browsers:

The following URLs are believed to be unexploitable on modern browsers - if you disagree then please get in touch!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
add-on FalseNegative tracker
Milestone
No milestone
Development

No branches or pull requests
2 participants
@psiinon @ArkaprabhaChakraborty