PII Disclosure rule should not report on JS files by default about zaproxy HOT 12 CLOSED

How about at non LOW threshold we only scan responses if (respHeader.isHtml() || respHeader.isText() || respHeader.isJson() || respHeader.isXml()) ?
Where respHeader = msg.getResponseHeader().

from zaproxy.

@ganesh-dagadi its been assigned to you 😁 Let us know if you'd like any advice and guidance..

from zaproxy.

Sounds right too me. You should see other UnitTests for other rules that check/try this as well.

from zaproxy.

Sure. I'm not sure how that specific test class is setup but most of them have a private method creating the HttpMessage objects, you could add a default of text/html there and then override it in new tests, etc

from zaproxy.

Just remove isText() from your set of ORs.

from zaproxy.

I would like to work on this issue.

from zaproxy.

I'd suggest that this be tied to Threshold, some lame frameworks create a JS constants file that gets exposed so it would be good for users to be able to choose to scan them.

from zaproxy.

So as suggested by @psiinon , if the user selects Low threshold, we continue with the scan but when the threshold is not LOW and if ResourceIdentificationUtils.isJavascript() is true, we skip the scan. So can this be solved just by adding another guard clause?

from zaproxy.

Sure, yeah that sounds good.

from zaproxy.

As we are now checking based on the response header, I observed that most of the Unit tests do not set the response header - Content type. Do you recommend I add content type to all the Unit tests?

from zaproxy.

The method responseHeader.isText() return true if javascript is in content type. Here is the method

public boolean isText() {
        return this.hasContentType(new String[]{"text", "html", "javascript", "json", "xml"});
    }

https://github.com/zaproxy/zaproxy/blob/main/zap/src/main/java/org/parosproxy/paros/network/HttpResponseHeader.java#L259

So checking for isText() is returning true for javascript content type. Thus, at NON LOW threshold, javascript is also passing through the guard clause. Shall I remove isText() on NON LOW threshold or remove javascript from isText() method?

from zaproxy.

I have opened a Pull Request addressing this Issue.

from zaproxy.