owasp

The last few dependency updates have introduced deprecations in the bugtracker add-on. As mentioned here: zaproxy/zap-extensions#3273

They should be addressed.

What and where?
Please give the broken URL. Where is the link located?

Would you like to be assigned to this issue?
Check the box if you will submit a PR to fix this issue. Please read CONTRIBUTING.md.
-KONG [ ] Assign me, please!

Slack us first!
Hello. I write about problem here:
https://owasp.slack.com/archives/C2P5BA8MN/p1624892081234100

Be informative
As additional into slack I find the same behaviour with Risk Accepted findings. Into Metrics I see 0 Risk Accepted findings, but I have 1 Risk Accepted finding

Bug description
No error. Metrics into product, or metrics dushboard has incorrect info

Description

BeanUtils is a library that is doing automatic mapping to Java object.
It can cause arm when the attack controls part of the list of properties being sets. BeanUtils does not blacklist properties like class, classloader or other objects that are likely to load arbitrary classes and possibly run code.

Code

import org.apache.commons.beanutils.BeanUtils;

public

The current swagger definition is autogenerated. The automatically generated definitions rely on reflection and annotations to create the documentation. The reflection capabilities are poor at best and lead to missing API parameters. Annotations can help in some cases, but the only fix for Swagger is to create individual POJOs for every possible request. This will lead to unnecessary large number

Describe the bug

Many tests don't include standard headers, so when performing a test plenty of rules will be fired unnecessarily. We need to fix tests that don't have Accept or other headers like User-Agent... provided the test was not designed to avoid them.

Steps to reproduce

Run tests and see output.

Expected behaviour

We should match the minimal amount of rules