Release 2.12.0

This is a bug fix and enhancement release, which now requires a minimum of Java 11.
As the main zaproxy/zaproxy repo has just reached 10k stars we're calling this the 'Ten Thousand Star' Release!

This release fixes an HTML Injection vulnerability in the ZAP Desktop which was rated a P3 / Medium level vulnerability. While we do not think that it can be exploited in any meaningful way, desktop users are still recommended to update from older ZAP versions a.s.a.p.

These release notes do not include all of the changes included in add-ons updated since 2.11.1.

Some of the more significant enhancements include:

Network Add-On

The core networking code has been replaced by a new add-on which means changes are no longer bound to core/stable releases. This add-on uses a modern network stack which will make it much easier to support modern protocols such as HTTP/2.
In addition the following features have been added:

Spider Add-On

To facilitate more frequent functional enhancements and bug fixes the core Spider has been moved to an add-on which means such changes are no longer bound to core/stable releases. Other add-ons which use Traditional Spider functionality have also been re-worked to support the Spider add-on, including: Quick Start, Form Handler, GraphQL, OpenAPI, SOAP, and the Automation Framework. More details are given below.

Import/Export Add-On

The Import/Export add-on allows to import/export data (e.g. HTTP Messages, URLs) to/from ZAP, it supersedes core functionality and the following add-ons which will no longer be available in the marketplace:

Database Add-On

A new add-on was introduced for database related functionality in ZAP. This add-on provides the SQLite database engine for other add-ons to use. It also adds support for the ZAP permanent database.

The permanent database allows storing information that may be used across ZAP sessions. For example, it is used by the OAST add-on to persist BOAST payloads that can be polled in future ZAP sessions to list out-of-band interactions made to the service while ZAP wasn't running.

Multi-threaded Passive Scanner

The passive scanner has been updated to use a configurable number of threads, by default 4. This has been shown to significantly reduce the time spent processing the passive scan queue.

Bit.ly Telemetry Removal

From this release ZAP will no longer use bit.ly for any telemetry. Instead it uses our own services on the zaproxy.org domain. For full details see the FAQ: What 'calls home' does ZAP make?.

Scan Rule Promotions

A significant number of scan rules have been promoted in this release.

The following Active scan rules have been promoted to Release status:

The following Passive scan rules have been promoted to Release status: The following Active scan rules have been promoted to Beta status (and will therefore now be included in the Packaged scans): The following Passive scan rules have been promoted to Beta status (and will therefore now be included in the Packaged scans):

Dependency Updates

As usual the release includes dependency updates. Of particular note is the updated Log4j library. The previous stable release contained a Log4j library that was flagged as being vulnerable, although we believe it was not exploitable.

The following libraries were updated:

The following libraries were moved out of the core and into add-ons: The following libraries were removed:

Add-Ons

New Add-Ons

The following add-ons are included by default in this release for the first time:

Updated Add-Ons

All of the add-ons included by default have been updated since the last full release.

Removed Add-Ons

The following add-ons are no longer included, having been superseded by the Import/Export add-on:

Desktop HTML Injection Fix

This release includes a fix to prevent HTML Injection in the ZAP Desktop GUI. Thank you to “issuefinder” for reporting this to us via our bug bounty program. The vulnerability was rated as a P3 / Medium and desktop users are recommended to update from older ZAP versions a.s.a.p.

Enhancements

Spider Add-on

The following table illustrates the differences/improvements versus the 2.11/2.11.1 release(s).
Before After
Base - Proper handling Base - Proper handling
A, Link, Area - ‘href’ attribute A, Link, Area - ‘href’ attribute
Frame, IFrame, Script, Img - ‘src’ attribute Applet, Audio, Embed, Frame, IFrame, Input, Script, Img, Video - ‘src’ attribute
Meta - ‘http-equiv’ for ’location’ and ‘refresh’ Meta - ‘http-equiv’ for ’location’, ‘refresh’ and ‘Content-Security-Policy’, ’name’ for ‘msapplication-config’
Applet - ‘codebase’, ‘archive’ attributes
Img - ’longdesc’, ’lowsrc’, ‘dynsrc’, ‘srcset’ attributes
Isindex - ‘action’ attribute
Object - ‘codebase’, ‘data’ attributes
Svg - ‘href’ and ‘xlink:href’ attributes of ‘image’ and ‘script’ elements
Table - ‘background’ attribute
Video - ‘poster’ attribute
Form - proper handling of Forms with both GET and POST method. The fields values are generated validly, including HTML 5.0 input types. Form - proper handling of Forms with both GET and POST method. The fields values are generated validly, including HTML 5.0 input types ‘form’, ‘formaction’, ‘formmethod’ attributes of buttons are also respected.
Comments - Valid tags found in comments are also analyzed, if specified in the Options Spider screen Comments - Valid tags found in comments are also analyzed, if specified in the Options Spider screen
Import - ‘implementation’ attribute
Inline string - ‘p’, ’title’, ’li’, ‘h1’, ‘h2’, ‘h3’, ‘h4’, ‘h5’, ‘h6’, and ‘blockquote’ tags
SVG image files are parsed to identify HREF attributes and extract/resolve any contained links.

Requester Add-On

The Manual Request Editor and Resend dialogues were moved to the Requester add-on. This add-on will now provide the base infrastructure for add-ons to edit and send messages, the following add-ons are now using the Requester add-on: Plug-n-Hack Configuration (Client Messages) and WebSockets.

The Requester tab was also updated to provide the same functionalities that the dialogues provide.

Bug fixes

ZAP API Breaking Changes:

VIEW alert / alertCountsByRisk

The returned data now includes the False Positive count. This change may break existing consumers as the number of expected alerts might no longer be the same. For example, if a Medium risk alert is marked as False Positive, the structure of returned data will be: 

{"High":0,"Low":3,"Medium":0,"Informational":2,"False Positive":1}
instead of: 

{"High":0,"Low":3,"Medium":1,"Informational":2}

Endpoints With Response Changes

The following endpoints used to return "OK" for all inputs. They now return suitable error messages (such as "does_not_exist" or "illegal_parameter") when the inputs are invalid.

ZAP API New Endpoints:

ZAP API Deprecated Endpoints:

The following endpoints have been superseded by the Import/Export add-on: The following endpoints have been superseded by the Network add-on:

Binary Incompatible Changes

The following classes (all of which were deprecated more than 5 years ago) have been removed: The following methods (all of which were deprecated more than 5 years ago) have been removed: The following fields (all of which were deprecated more than 5 years ago) have been removed:

See Also

    Introductionthe introduction to ZAP
    Releasesthe full set of releases
    Creditsthe people and groups who have made this release possible