ascanrules: Address External Redirect False Positives #6677

kingthorin · 2025-08-20T15:27:28Z

Overview

The External Redirect scan rules has been updated to account for potential false positives involving JavaScript comments.

psiinon · 2025-08-20T16:08:20Z

Checkmarx One – Scan Summary & Details – 2b9816e5-290f-41f3-89fa-e369ec35e7d3

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~Heap_Inspection~~	/addOns/authhelper/src/test/java/org/zaproxy/addon/authhelper/AuthUtilsUnitTest.java: 1346

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

...les/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java

kingthorin · 2025-08-26T21:13:40Z

Deconflicted

...les/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java

Copilot

Pull Request Overview

The External Redirect scan rule has been updated to reduce false positives by excluding JavaScript code that appears within comments from triggering redirect vulnerability alerts.

Added JavaScript comment parsing logic to filter out commented code before pattern matching
Enhanced test coverage with comprehensive comment scenarios including various escape sequences and edge cases
Updated changelog to document the false positive improvement

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
ExternalRedirectScanRule.java	Added JavaScript comment extraction logic and state machine parser to filter out commented code
ExternalRedirectScanRuleUnitTest.java	Added comprehensive test cases covering various JavaScript comment scenarios and edge cases
CHANGELOG.md	Documented the false positive fix for JavaScript comments

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java

kingthorin · 2025-09-04T11:25:34Z

Got all those I believe

kingthorin · 2025-10-13T21:58:56Z

I think this is ready for review now. I believe I've addressed everything discussed.

kingthorin · 2025-10-31T01:31:05Z

Maybe this is a preferable solution (using Rhino), it handles all the existing test cases added here except "Inline incomplete block", which is kind of understandable. I doubt that browsers would be able to handle JavaScript in that case either.

https://github.com/zaproxy/zap-extensions/compare/main...kingthorin:zap-extensions:redir-wavsep-fps-rhino?expand=1

Let me know what you think, not a full review just a gutt feel: "Ya that's better" "naw let's stick with the state machine" kinda thing.

thc202 · 2025-10-31T08:37:10Z

As said before any proven parser is preferable to manual parsing, the question is more which one. I don't have a preference as long it's being actively maintained (though using the engine we already bundle by default would be even better but that assumes it's possible).

kingthorin · 2025-10-31T10:35:51Z

Okay I've switched this over. Mainly I wanted to make sure that people were okay with using Rhino. It's maintained, its JS feature support is a bit behind but for the purpose here it should be totally fine.

kingthorin · 2025-10-31T11:22:32Z

Checking the failure.

kingthorin · 2025-10-31T12:22:27Z

Fixed

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java

thc202 · 2025-10-31T15:58:01Z

Thank you!

Copilot

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java

...les/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java

kingthorin · 2025-11-01T15:07:05Z

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java

+            // Rhino drops a character when the snippet ends with a single line comment so add a newline
+            AstRoot ast = parser.parse(jsSource + "\n", null, 1);


This can be seen by leveraging debugPrint() on the ast or comment, the length of the comment is always reported one character short 😞

Reported upstream: mozilla/rhino#2151

Without a doubt when others read this on Monday you'll wonder why this wasn't relevant before. But you can see from the simple example in the linked issue that it is a Rhino issue. I'm not sure, I didn't get to dig into that yet.

I can but I don't want it to derail this. Let me know if you prefer that I roll back to the previous state.

Signed-off-by: kingthorin <[email protected]>

kingthorin force-pushed the redir-wavsep-fps branch from a3c7e33 to a252c5b Compare August 20, 2025 15:40

kingthorin force-pushed the redir-wavsep-fps branch 3 times, most recently from 10ed03c to 6b120f2 Compare August 23, 2025 15:41

kingthorin commented Aug 24, 2025

View reviewed changes

...les/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java Outdated Show resolved Hide resolved

kingthorin marked this pull request as ready for review August 24, 2025 22:21

kingthorin requested a review from Copilot August 25, 2025 02:32

This comment was marked as outdated.

Sign in to view

kingthorin force-pushed the redir-wavsep-fps branch 6 times, most recently from 3c91fd7 to 436c2b7 Compare August 26, 2025 21:13

thc202 reviewed Sep 2, 2025

View reviewed changes

...les/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java Outdated Show resolved Hide resolved

kingthorin force-pushed the redir-wavsep-fps branch 5 times, most recently from 0d6d8cb to 6c9a24c Compare September 2, 2025 15:39

kingthorin requested a review from Copilot September 3, 2025 18:05

Copilot AI reviewed Sep 3, 2025

View reviewed changes

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java Outdated Show resolved Hide resolved

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java Outdated Show resolved Hide resolved

kingthorin force-pushed the redir-wavsep-fps branch from 6c9a24c to ff39efb Compare September 3, 2025 18:10

thc202 reviewed Sep 4, 2025

View reviewed changes

kingthorin force-pushed the redir-wavsep-fps branch from ff39efb to 40fd2ef Compare September 4, 2025 11:24

kingthorin force-pushed the redir-wavsep-fps branch from 40fd2ef to 89de190 Compare September 4, 2025 11:31

kingthorin force-pushed the redir-wavsep-fps branch from cb0c82e to 2d3fd86 Compare October 13, 2025 21:47

kingthorin force-pushed the redir-wavsep-fps branch from 2d3fd86 to 7b9242b Compare October 31, 2025 10:35

kingthorin force-pushed the redir-wavsep-fps branch from 7b9242b to ad16997 Compare October 31, 2025 12:18

kingthorin force-pushed the redir-wavsep-fps branch from ad16997 to 0ba6416 Compare October 31, 2025 15:39

thc202 reviewed Oct 31, 2025

View reviewed changes

.../ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java Outdated Show resolved Hide resolved

thc202 approved these changes Oct 31, 2025

View reviewed changes

kingthorin force-pushed the redir-wavsep-fps branch 2 times, most recently from e05fa64 to 23ca185 Compare October 31, 2025 17:17

kingthorin requested review from Copilot and psiinon October 31, 2025 23:24

Copilot AI reviewed Oct 31, 2025

View reviewed changes

kingthorin force-pushed the redir-wavsep-fps branch from 23ca185 to 9115ac2 Compare November 1, 2025 15:05

kingthorin commented Nov 1, 2025

View reviewed changes

kingthorin requested a review from Copilot November 1, 2025 15:07

This comment was marked as outdated.

Sign in to view

kingthorin force-pushed the redir-wavsep-fps branch from 9115ac2 to 9f0b6d3 Compare November 1, 2025 15:22

ascanrules: Address External Redirect False Positives

0562383

Signed-off-by: kingthorin <[email protected]>

kingthorin force-pushed the redir-wavsep-fps branch from 9f0b6d3 to 0562383 Compare November 1, 2025 15:22

kingthorin requested a review from thc202 November 3, 2025 12:29

psiinon approved these changes Nov 4, 2025

View reviewed changes

psiinon merged commit ab4c945 into zaproxy:main Nov 4, 2025
10 checks passed

github-actions bot locked and limited conversation to collaborators Nov 4, 2025

kingthorin deleted the redir-wavsep-fps branch November 4, 2025 13:57

		// Rhino drops a character when the snippet ends with a single line comment so add a newline
		AstRoot ast = parser.parse(jsSource + "\n", null, 1);

Uh oh!

ascanrules: Address External Redirect False Positives #6677

ascanrules: Address External Redirect False Positives #6677

Uh oh!

Conversation

kingthorin commented Aug 20, 2025

Overview

Uh oh!

psiinon commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

kingthorin commented Aug 26, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kingthorin commented Sep 4, 2025

Uh oh!

kingthorin commented Oct 13, 2025

Uh oh!

kingthorin commented Oct 31, 2025

Uh oh!

thc202 commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kingthorin commented Oct 31, 2025

Uh oh!

kingthorin commented Oct 31, 2025

Uh oh!

kingthorin commented Oct 31, 2025

Uh oh!

Uh oh!

thc202 commented Oct 31, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kingthorin Nov 1, 2025

Choose a reason for hiding this comment

Uh oh!

kingthorin Nov 1, 2025

Choose a reason for hiding this comment

Uh oh!

kingthorin Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

psiinon commented Aug 20, 2025 •

edited

Loading

thc202 commented Oct 31, 2025 •

edited

Loading

kingthorin Nov 3, 2025 •

edited

Loading