Skip to content

Zap-advanced scan: Ajax spider puts random text in the form fields even when 'randomInputs' is set to false #1265

@sourabhsdeshpande

Description

@sourabhsdeshpande

🐞 Bug report

Describe the bug

Even when a value for randomInputs is set to false, spider still puts in random text in the form fields and then finds the urls.
When form field is drop down, it selects first item from the list and so on...

Steps To Reproduce

Steps to reproduce the behavior:

  1. Create a yaml file to scan application using Zap-advanced-scan.
  2. Make sure that, Spider is ajax spider (ajax: true) and randomInputs is set to false.
  3. Run the scan. If you see the logs, it shows that spider has put text in the input form fields.

Expected behavior

Spidering should not put any text in any form field when randomInputs is set to false.

System:

  • secureCodeBox Version/Release: 3.10.0
  • OS: Linux
  • Kubernetes Version: Client v1.21.3, Server v1.22.6
  • Docker Version: 20.10.13
  • Browser: Not applicable

Screenshots / Logs

image

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugBugsscannerImplement or update a security scanner

    Type

    No type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions