Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

client: limit spider scope and use own proxies #6043

Merged
merged 1 commit into from
Dec 30, 2024

Conversation

thc202
Copy link
Member

@thc202 thc202 commented Dec 30, 2024

Limit to context, subtree, or target preventing any accesses outside the selected spider scope.
Use own proxies when spidering instead of the main one, to limit the scope and allow later to track the requests of each action.

@psiinon
Copy link
Member

psiinon commented Dec 30, 2024

Logo
Checkmarx One – Scan Summary & Details09095421-b677-41ab-a890-be8819c00805

New Issues

Severity Issue Source File / Package Checkmarx Insight
LOW Log_Forging /addOns/client/src/main/java/org/zaproxy/addon/client/spider/ClientSpiderDialog.java: 342 Attack Vector

@thc202 thc202 force-pushed the client/spider/limit-scope branch 7 times, most recently from ebe2e60 to 95ad5ef Compare December 30, 2024 13:51
@thc202 thc202 changed the title client: limit spider scope and use own proxies [WIP] client: limit spider scope and use own proxies Dec 30, 2024
@thc202 thc202 force-pushed the client/spider/limit-scope branch 2 times, most recently from 2e84d56 to 267856f Compare December 30, 2024 15:01
Limit to context, subtree, or target preventing any accesses outside
the selected spider scope.
Use own proxies when spidering instead of the main one, to limit the
scope and allow later to track the requests of each action.

Signed-off-by: thc202 <[email protected]>
@thc202 thc202 force-pushed the client/spider/limit-scope branch from 267856f to 05da347 Compare December 30, 2024 15:09
@thc202 thc202 changed the title [WIP] client: limit spider scope and use own proxies client: limit spider scope and use own proxies Dec 30, 2024
Comment on lines +109 to +113
MessagesTable.class.getResource("/resource/icon/16/152.png"));

private static final ImageIcon NOT_ALLOWED_ICON =
DisplayUtils.getScaledIcon(
MessagesTable.class.getResource("/resource/icon/16/149.png"));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we give the icons useful filenames?

I know this is a holdover from code/history but I think it'll be more maintenance friendly in the long run.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess these already exist, so maybe that's a change for another PR.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Those are core icons.

@kingthorin kingthorin merged commit 6b96a7b into zaproxy:main Dec 30, 2024
9 of 10 checks passed
@github-actions github-actions bot locked and limited conversation to collaborators Dec 30, 2024
@thc202 thc202 deleted the client/spider/limit-scope branch December 30, 2024 15:48
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants