zaproxy / zaproxy/zaproxy

Scripts passed with the -script switch conflict with script folders

Open
#3,094 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component-Scripts enhancement Usability
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Steps:

  1. Launch ZAP GUI
  2. Add script folder in the list of script folders (options -> scripts -> add folder), i.e.: c:\zapscripts
  3. Create standalone zest script "justinbieber.zst" and store it in "c:\zapscripts\standalone\justinbieber.zst"
  4. Close ZAP GUI

Observed:
Path A) Execute: zap.bat -cmd -script c:\zapscripts\standalone\justinbieber.zst
ZAP returns silently.
Path B) Execute: zap.bat -script c:\zapscripts\standalone\justinbieber.zst
An exception is thrown in the console:
6915 [ZAP-BootstrapGUI] ERROR org.zaproxy.zap.extension.script.ExtensionScript - A script with the same name already exists: justinbieber.zst
java.security.InvalidParameterException: A script with the same name already exists: justinbieber.zst
at org.zaproxy.zap.extension.script.ScriptTreeModel.addScript(Unknown Source)
at org.zaproxy.zap.extension.script.ExtensionScript.addScript(Unknown Source)
at org.zaproxy.zap.extension.script.ExtensionScript.addScript(Unknown Source)
at org.zaproxy.zap.extension.script.ExtensionScript.openCmdLineFile(Unknown Source)
at org.zaproxy.zap.extension.script.ExtensionScript.execute(Unknown Source)
at org.parosproxy.paros.extension.ExtensionLoader.runCommandLine(Unknown Source)
at org.parosproxy.paros.control.Control.runCommandLine(Unknown Source)
at org.zaproxy.zap.GuiBootstrap.initControlAndPostViewInit(Unknown Source)
at org.zaproxy.zap.GuiBootstrap.access$100(Unknown Source)
at org.zaproxy.zap.GuiBootstrap$2.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

Expected:
When a script is launched by an explicit call to the -script switch in the command line, it may show a clear intent from the user ("I want to execute this script"), therefore scripts marked for automated loading at start (i.e. no execution) should either be ignored/skipped or at least not trigger a conflict and result in a silent "ignore".

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at ExtensionScript.openCmdLineFile and the ScriptTreeModel.addScript call shown in the stack trace, then reproduce both zap.bat command-line paths with a script folder containing the same Zest script. Done means an explicit -script invocation does not raise the duplicate-name conflict when the script is already loaded or marked for automated loading, and the behavior is verified for the reported setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.