False positive w.r.t OS Command Injection
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
According to the current ZAP scanning rule set, ZAP reports OS command injection based on "sleep/timeout" conditions. Quite often the application in general takes more than 5s time to return a respond to the any malformed request. This increases the possibility of this being a false positive and creating unwanted alerts. Hence this rule set might not be appropriate to report OS Command injection and might make more sense if other test cases are used.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review ZAP's current OS command injection scanning rule, focusing on the sleep/timeout conditions described in the issue. Reproduce the behavior against malformed requests that take more than five seconds to return, then determine and test a less false-positive-prone detection approach. Done means slow responses no longer create unwanted OS command injection alerts while genuine cases remain detectable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100