Skip to content

Commit 3153375

Browse files
psiinonpsiinon
committed
2.17 Headline changes and Alert details
Signed-off-by: Simon Bennetts <[email protected]>
1 parent 582ca08 commit 3153375

File tree

2 files changed

+197
-14
lines changed

2 files changed

+197
-14
lines changed

‎addOns/help/src/main/javahelp/contents/releases/2.17.0.html‎

Lines changed: 81 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,48 +11,116 @@ <H1>Release 2.17.0</H1>
1111

1212
This is a bug fix and enhancement release.
1313

14-
TBC
15-
1614
<H3>Alert De-duplication</H3>
17-
Changes have been made in order to reduce the number of alerts which ZAP may raise that are duplicaes or highly similar, more closely being aligned with the Sites Tree representation.
15+
Changes have been made in order to reduce the number of alerts which ZAP may raise that are duplicates or highly similar, more closely being aligned with the Sites Tree representation.
1816
See the <a href="https://www.zaproxy.org/blog/2025-09-30-alert-de-duplication/">Alert De-duplication blog</a> for further details.
1917

2018
<H3>Systemic Alerts</H3>
21-
TBC
19+
Alerts that are typically site-wide will now be flagged as being "Systemic" in both the ZAP Desktop UI and in reports.
20+
<p>
21+
This can also significantly reduce the number of "duplicate" alerts reported.
22+
23+
<H3>Insights</H3>
24+
A new "Insights" tab shows key information which is not related to vulnerabilities, or potentially even related to the application in question.
25+
<p>
26+
Insights tell you more about your applications, about the effectiveness of a scan, and can even stop a scan early if significant problems are identified.
27+
<p>
28+
Insights are also available in all of the official ZAP reports.
29+
30+
<H3>Improved Disk and Memory Space Error Handling</H3>
31+
ZAP will now detect disk and memory space issues and attempt to handle them more gracefully.
32+
<p>
33+
Any problems encountered will be reported via the Insights.
34+
35+
<H3>Automation Disk Space Reduction</H3>
36+
Active Scan Temporary HTTP Messages are no longer persisted by default when ZAP is run headless.
37+
This can significantly reduce the amount of disk space needed.
38+
<p>
39+
The option is also available in the Desktop but is turned off be default, so that the user can inspect them.
2240

2341
<H3>Structured Reports ISO 8601 Standard Date</H3>
2442
The structured reports (JSON and XML) now have an ISO 8601 standard date field/attribute (“created”);
2543
the existing “generatedString” field will be removed in the future.
2644

27-
<H3>Active Scan Temporary HTTP Messages</H3>
28-
If this option is selected the active scanner will persist all HTTP messages sent while active scanning, which allows to further inspect them (e.g. custom passive scanners, manually).
29-
They are temporary and removed once the session is closed, for cases where the HTTP messages are not necessary it is advised to disable this option for performance reasons (I/O, disk space).
30-
<p>
31-
By default the HTTP messages are persisted unless in command line mode, where sessions are usually discarded once ZAP finishes.
32-
3345
<H3>Dependency Updates</H3>
3446

3547
As usual the release includes dependency updates.
3648
<p>
3749
The following libraries were updated:
3850

3951
<ul>
40-
<li>TBC</li>
52+
<li>Commons Beanutils, 1.10.1 → 1.11.0</li>
53+
<li>Commons Codec, 1.18.0 → 1.20.0</li>
54+
<li>Commons CSV, 1.12.0 → 1.14.1</li>
55+
<li>Commons IO, 2.18.0 → 2.21.0</li>
56+
<li>Commons Lang3, 2.17.0 → 3.19.0</li>
57+
<li>Commons Text, 1.13.0 → 1.14.0</li>
58+
<li>Flatlaf, 3.5.4 → 3.6.2</li>
59+
<li>Flatlaf Swingx, 3.5.4 → 3.6.2</li>
60+
<li>Jfreechart, 1.5.5 → 1.5.6</li>
61+
<li>Jgrapht Core, 0.9.0 → 0.9.2</li>
62+
<li>Log4j 1.2 API, 2.24.3 → 2.25.2</li>
63+
<li>Log4j API, 2.24.3 → 2.25.2</li>
64+
<li>Log4j Core, 2.24.3 → 2.25.2</li>
65+
<li>Log4j Jul, 2.24.3 → 2.25.2</li>
4166
</ul>
4267

4368
<H2>Add-Ons</H2>
4469

4570
<H3>Updated Add-Ons</H3>
4671
All of the add-ons included by default have been updated since the last full release.
4772

73+
<H3>New Add-Ons</H3>
74+
75+
<ul>
76+
<li>Insights - as detailed above</li>
77+
</ul>
78+
4879
<H2>Enhancements</H2>
4980
<ul>
50-
<li>TBC</li>
81+
<li><a href="https://github.com/zaproxy/zaproxy/issues/2382">Issue 2382</a> : IOException - data file enlarge failed</li>
82+
<li><a href="https://github.com/zaproxy/zaproxy/issues/3486">Issue 3486</a> : Enhancement: ZAP GUI Warn User When its out of Memory</li>
83+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8904">Issue 8904</a> : JSON Input Vector doesn't handle top level primitive types</li>
84+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8910">Issue 8910</a> : Sync anti-csrf token regen/use in active scanner</li>
85+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8911">Issue 8911</a> : New variant: Request body with no or plain text content type</li>
86+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8919">Issue 8919</a> : Avoid concurrent scan of similar pages</li>
87+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8920">Issue 8920</a> : Exclude anti-csrf tokens from the active scan</li>
88+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8955">Issue 8955</a> : zap.sh does not respect $JAVA_HOME</li>
89+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8982">Issue 8982</a> : Include rule name in Active Scan skip tooltip</li>
90+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8992">Issue 8992</a> : Allow to copy rule config fields</li>
91+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8997">Issue 8997</a> : Improve support for FreeBSD</li>
92+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9044">Issue 9044</a> : Implement DPI-aware divider sizing for WorkbenchPanel split panes</li>
93+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9067">Issue 9067</a> : Alert tree de-duplication</li>
94+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9072">Issue 9072</a> : Address log flooding when DB is full</li>
95+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9073">Issue 9073</a> : Reset search field on session changes</li>
96+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9074">Issue 9074</a> : Add option for temp active scan msgs persistence</li>
97+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9097">Issue 9097</a> : Systemic alert support</li>
98+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9108">Issue 9108</a> : Get false positive alerts from alert/view/alerts/ API endpoint</li>
99+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9113">Issue 9113</a> : Adjust Alert compareTo and equals for case sensitive URI comparison</li>
100+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9117">Issue 9117</a> : Record stats for authenticated ascans</li>
101+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9120">Issue 9120</a> : Change policies to support statsId and readonly</li>
102+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9123">Issue 9123</a> : Make script-based auth method easier to extend</li>
103+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9136">Issue 9136</a> : Suppress XML prolog errors</li>
104+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9138">Issue 9138</a> : Allow to lock scan policies</li>
105+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9153">Issue 9153</a> : Set systemic limit default</li>
51106
</ul>
52107

53108
<H2>Bug fixes</H2>
54109
<ul>
55-
<li>TBC</li>
110+
<li><a href="https://github.com/zaproxy/zaproxy/issues/4530">Issue 4530</a> : Site Tree XML POST Parameter Name Issue</li>
111+
<li><a href="https://github.com/zaproxy/zaproxy/issues/6656">Issue 6656</a> : Default Content-Type charset is not always considered</li>
112+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8327">Issue 8327</a> : Handle lack of disk space better</li>
113+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8888">Issue 8888</a> : Alerts Summary reports on filtered alerts. Difference between 2.15.0 &amp; 2.16.0</li>
114+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8909">Issue 8909</a> : User Defined Variant, correct bounds check</li>
115+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8934">Issue 8934</a> : Error dialog re cannot snapshot session while actions running contains HTML tags</li>
116+
<li><a href="https://github.com/zaproxy/zaproxy/issues/8969">Issue 8969</a> : Align combined fields in std dialog</li>
117+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9002">Issue 9002</a> : Fixed structured POST data node names</li>
118+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9003">Issue 9003</a> : Correct poll header validation/usage</li>
119+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9015">Issue 9015</a> : Do not warn on charset aliases</li>
120+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9075">Issue 9075</a> : Guard against multipart parsing errors</li>
121+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9085">Issue 9085</a> : Fix GUI exceptions while updating add-ons</li>
122+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9106">Issue 9106</a> : Fix error importing context with auth script</li>
123+
<li><a href="https://github.com/zaproxy/zaproxy/issues/9127">Issue 9127</a> : Do not warn on empty encoded HTTP bodies</li>
56124
</ul>
57125

58126
<H2>See Also</H2>

‎addOns/help/src/main/javahelp/contents/start/features/alerts.html‎

Lines changed: 116 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,123 @@ <H1>Alerts</H1>
3333
All alerts are listed in the <a href="../../ui/tabs/alerts.html">Alerts tab</a>
3434
and a count of the total number of alerts by risk is shown in the <a href="../../ui/footer.html">footer</a>.
3535
</p>
36+
<p>
37+
The full set of alerts that ZAP can raise is available online at
38+
<a href="https://www.zaproxy.org/docs/alerts/">https://www.zaproxy.org/docs/alerts/</a>
39+
</p>
40+
41+
<a name="alertfields"></a><H2>Alert Fields</H2>
42+
43+
The following fields are supported.
44+
45+
<a name="alert-name"></a><H3>Name</H3>
46+
47+
The name of the alert, for example "Cross Site Scripting (Reflected)"
48+
49+
<a name="alert-url"></a><H3>URL</H3>
50+
51+
The URL related to the alert.
52+
53+
<a name="alert-nodename"></a><H3>Node Name</H3>
54+
55+
A normalised version of the URL, which is also used in the <a href="sitestree.html">Sites Tree</a>
56+
57+
<a name="alert-risk"></a><H3>Risk</H3>
58+
59+
The relative severity of the alert.
60+
<p>
61+
One of:
62+
<ul>
63+
<li>Informational
64+
<li>Low
65+
<li>Medium
66+
<li>High
67+
</ul>
68+
69+
The risk is automatically set for Alerts raised by ZAP.
70+
If you want to change the risk you can either do that manually for each alert or you can create an
71+
Alert Filter to do it automatically.
72+
73+
<a name="alert-confidence"></a><H3>Confidence</H3>
74+
75+
The relative confidence in the alert.
76+
<p>
77+
One of:
78+
<ul>
79+
<li>False Positive
80+
<li>Low
81+
<li>Medium
82+
<li>High
83+
<li>Confirmed
84+
</ul>
85+
86+
ZAP will not raise an alert with a confidence of either "False Positive" or "Confirmed".
87+
However you can set these levels either manually or via an Alert Filter.
88+
89+
<a name="alert-param"></a><H3>Parameter</H3>
90+
91+
The name of the parameter that was attacked.
92+
This will be empty if the alert is not associated with a specific parameter.
93+
94+
<a name="alert-attack"></a><H3>Attack</H3>
95+
96+
The payload used to find the alert.
97+
This will be empty for passive alerts.
98+
99+
<a name="alert-evidence"></a><H3>Evidence</H3>
100+
101+
A string that appears in the request or response which was used to help identify the alert.
102+
This will be empty if there is no relevant string, for example for missing security headers.
103+
104+
<a name="alert-cweid"></a><H3>CWE ID</H3>
105+
106+
The <a href="https://cwe.mitre.org/">Common Weakness Enumeration</a> ID.
107+
108+
<a name="alert-wascid"></a><H3>WASC ID</H3>
109+
110+
The <a href="http://projects.webappsec.org/w/page/13246978/Threat%20Classification">Web Application Security Consortium</a> ID.
111+
112+
<a name="alert-source"></a><H3>Source</H3>
113+
114+
The component which raised the alert, and the ID of the rule.
115+
116+
<a name="alert-alertref"></a><H3>Alert Reference</H3>
117+
118+
The ID of the rule which raised the alert, optionally followed by a dash and the alert type.
119+
<p>
120+
All of the alerts raised by ZAP are listed on
121+
<a href="https://www.zaproxy.org/docs/alerts/">https://www.zaproxy.org/docs/alerts/</a>,
122+
and they all have a static page with a URL based on the Alert Reference.
123+
124+
<a name="alert-input"></a><H3>Input Vector</H3>
125+
126+
The <a href="../../ui/dialogs/options/ascaninput.html">Active Scan Input Vector</a> used to identify the element attacked.
127+
This will be empty for passive alerts or if the alert is not associated with a specific parameter.
128+
129+
<a name="alert-desc"></a><H3>Description</H3>
130+
131+
A detailed description of the alert. This will be the same text for all alert instances with the same reference.
132+
133+
<a name="alert-other"></a><H3>Other Info</H3>
134+
135+
Alert specific information, which is potentially different for each alert raised.
136+
137+
<a name="alert-solution"></a><H3>Solution</H3>
138+
139+
Potential solutions to the underlying problem.
140+
Note that these solutions will be generic as ZAP does not access any source code.
141+
This will be the same text for all alert instances with the same reference.
142+
143+
<a name="alert-ref"></a><H3>Reference</H3>
144+
145+
A set of links to more information about the alert online.
146+
147+
<a name="alert-tags"></a><H3>Alert Tags</H3>
148+
149+
The tags associated with the alert.
150+
The full set of tags supported are listed on <a href="https://www.zaproxy.org/alerttags/">https://www.zaproxy.org/alerttags/</a>.
36151

37-
<a name="alertoverrides"></a><H2>Alert overrides</H2>
152+
<a name="alertoverrides"></a><H2>Alert Overrides</H2>
38153

39154
Alerts raised by ZAP include both generic and specific information about the alerts raised.
40155
The specific information relates directly to the potential issue found, such as the URL and the parameter affected.

0 commit comments

Comments
 (0)