Directly report false positives from inside ZAP
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
Issue
At the moment reporting false positives requires numerous steps. New users of ZAP may not know where to report false positives leading to the community missing potential bugs that can be improved and make ZAP better.
Also, the only option is 'delete' of an alert. Meaning that it doesn't show on the report and it's also impossible to create a report on the False Positives found.
Suggestion for improvement
Add two context menu items when right clicking on an alert item.
-
Mark as False PositiveDone in https://github.com/zaproxy/zaproxy/pull/5844 - Report False Positive to the ZAP project
The Mark as False Positive option could just Flag the option as False Positive and put it at the end of the report as a list of False Postives.
The Report False Positive to the ZAP Project item could include the data needed to evaluate the False Positive and automatically start a GitHub ticket, open a browser and fill the ticket with the useful information needed for developers to fix the issue.
Then end user can then fill the ticket with extra information to further clarify the bug. Or remove any identifying information.
Other open source project with similar functionality
Similar to how "ubuntu-bug" also known as "apport" works
https://wiki.ubuntu.com/Apport
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the alert-item context-menu actions and any existing ZAP-to-GitHub or browser-reporting flow. Implement the Report False Positive action so it gathers useful alert data, opens a prefilled GitHub ticket, and allows identifying information to be removed before submission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, java
- Domain
- desktop, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100