search

zaproxy / community-scripts

A collection of ZAP scripts and tips provided by the community - pull requests very welcome!
Apache License 2.0
761 stars 235 forks source link

Implement `getMetadata` for active JS scripts #442

Closed ricekot closed 2 months ago

ricekot commented 3 months ago

Part of #440.

Also add relevant alert tags and assign categories. The scan rule IDs for these scripts were taken from the scanners.md file.

The status of these scripts has been set to alpha since community-scripts is an alpha add-on.

kingthorin commented 2 months ago

FYI I haven't forgotten this. I did go through a number and they seemed fine. I'll try to finish a review in the next few days.

psiinon commented 2 months ago

image

Looks pretty good 😁 Can we add meta data so we can link to the script source code? This might require code changes of course. If it does then maybe also change to be able to report the alert type? It would be better if it was "Alert Script" in this case

kingthorin commented 2 months ago

Can't we use getHelpLink like the other ascan rules? (I mean it'd have to be implemented but I don't see why it can't be similar)

Also should we have write-ups of these in the add-on help like we do for ascan/pascan java rules? (I have mixed feelings: Part of me says yes for consistency, part of me says no because that's just one more thing to maintain.)

kingthorin commented 2 months ago

I finally got to read through all of them, seems fine to me. Are there further changes/tweaks coming or shall I go ahead and approve?

thc202 commented 2 months ago

Thank you!

thc202 commented 2 months ago

@psiinon do you want to check this again?