source code disclosure SVN throws false positive

[GoogleCodeExporter]

Name or identifier of scan rule: source code disclosure SVN

As many details as possible about the false positive:

I was given a report to evaluate, I have no access to the settings or version 
for ZAP used.

What I think happens is ... when an URL with 
http://host/dir/.svn/text-base/.svn-base or similar is requested and a 302 is 
returned and the destination URL returns a 200 ZAP assumes the URL exists. 

Sorry if this report is obsoleted by more recent versions. My intent is to find 
answers on suspicions which could not be validated against.

Original issue reported on code.google.com by joris.la...@gmail.com on 13 Jan 2015 at 10:52

[GoogleCodeExporter]

Original comment by kingtho...@gmail.com on 6 Mar 2015 at 12:57

• Changed title: source code disclosure SVN throws false positive

[GoogleCodeExporter]

Original comment by kingtho...@gmail.com on 6 Mar 2015 at 12:57

• Added labels: FalsePositive, Priority-Medium

[GoogleCodeExporter]

Code changes recently committed to resolve this, by not following redirects, 
and examining the response code more closely. Weekly releases after 2015-03-07, 
or version 2.4.0 or greater should not manifest this issue.

Original comment by colm.p.o...@gmail.com on 7 Mar 2015 at 10:39

• Changed state: Committed

[GoogleCodeExporter]

Fixed in 2.4.0

Original comment by psii...@gmail.com on 14 Apr 2015 at 11:03

• Changed state: Fixed