zaproxy / zaproxy/zaproxy

Directly report false positives from inside ZAP

Open
#5,843 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component-UI enhancement Usability
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Issue

At the moment reporting false positives requires numerous steps. New users of ZAP may not know where to report false positives leading to the community missing potential bugs that can be improved and make ZAP better.
Also, the only option is 'delete' of an alert. Meaning that it doesn't show on the report and it's also impossible to create a report on the False Positives found.

Suggestion for improvement

Add two context menu items when right clicking on an alert item.

The Mark as False Positive option could just Flag the option as False Positive and put it at the end of the report as a list of False Postives.

The Report False Positive to the ZAP Project item could include the data needed to evaluate the False Positive and automatically start a GitHub ticket, open a browser and fill the ticket with the useful information needed for developers to fix the issue.

Then end user can then fill the ticket with extra information to further clarify the bug. Or remove any identifying information.

Other open source project with similar functionality

Similar to how "ubuntu-bug" also known as "apport" works
https://wiki.ubuntu.com/Apport

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the alert-item context-menu actions and any existing ZAP-to-GitHub or browser-reporting flow. Implement the Report False Positive action so it gathers useful alert data, opens a prefilled GitHub ticket, and allows identifying information to be removed before submission.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, java
Domain
desktop, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.