zaproxy / zaproxy/zaproxy

OWASP ZAP 'stuck' 'Shutting down server and database' with large sessions

Open
#4,348 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Usability
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

On several occasions now, I've been running OWASP ZAP (on port 8081) against debug projects in Visual Studio 2015 and when I try to close the application after marathon sessions (over a period 2-3 days) that result in session files in excess of 2.x GB in size, the application sits with a (modal) dialog of 'Shutting down server and database'.

There's usually a flurry of disk activity which can go on for some time, but then nothing appears to happen afterwards. After half an hour of 'nothingness' I usually assume that nothing is really happening and kill the process. Before closing the application I always save the current session off in case there's anything I might need reporting-wise later on.

Today, I thought I'd see what happened when I click on the 'X' (close dialog) button on this popup and the application simply closed (apparently cleanly, as there was nothing sinister hiding in Event Viewer)

My process is:

Start Visual Studio 2015 Update 3 Debugging (3 website projects, 2 of which are WCF services)
Work my way through every screen and function in the UI element of the application
Set out a scope relevant only to the 3 projects in use
Set 'Active Scan -> Timeout to 0'
Start an 'Active Scan'

Occasionally I'll have to interact with Visual Studio that may have highlighted an in-handled exception, where I just get it to continue (for some reason it ignores the exception settings telling it not to throw in-handled CLR exceptions).

Present in the latest version (2.7) and has been present in unidentified versions from last year, 2014 and 2015 also, which were entirely separate machines and organisations.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing shutdown after a multi-day scan with a session file larger than 2 GB, then observe the “Shutting down server and database” dialog and the disk activity. Compare a normal close with closing the dialog using its X button; done means the shutdown completes reliably without requiring the process to be killed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.