Release 2.7.0

This is a bug fix and enhancement release, which requires a minimum of Java 8.

Some of the more significant enhancements include: Note that if you do have any problems with this release then there is also a new 'Help/Support Info...' menu item that provides essential information about your ZAP installation which you should include with any issues you raise.

Enhancements:

Bug fixes:

ZAP API Breaking Changes:

ACTION authentication / setAuthenticationMethod

The authentication type "formBasedAuthentication" will now require the login URL always in encoded form. The change ensures the login URL is used/sent as it was specified. Previously it would accept partially encoded URLs but they would be re-encoded when used, potentially leading to a different URL being used/sent.

VIEW context / contextList

This change will break the consumers that were manually parsing/extracting the names from the string. The structure of the data returned was changed to properly separate each name: 

{"contextList":["Context 1","Context 2"]}
and: 

<contextList type="list">
    <contextName>Context 1</contextName>
    <contextName>Context 2</contextName>
</contextList>
instead of: 

{"contextList":"[Context 1, Context 2]"}
and: 

<contextList>[Context 1, Context 2]</contextList>

VIEW core / setOptionUseProxyChain

Changed to return FAIL if the outgoing proxy was not enabled (because the required address/hostname was not previously set), before it would return always OK.

ZAP API Changed Endpoints:

VIEW core / alerts

Added optional riskId parameter to facilitate filtering the risk. Where riskId is in the range 0 for Informational and 3 for High.

VIEW core / numberOfAlerts

Added optional riskId parameter to facilitate filtering the risk. Where riskId is in the range 0 for Informational and 3 for High.

VIEW core / urls

Added optional baseurl parameter, to filter the URLs that are returned.

VIEW ascan / scans

Changed to also return the total number of alerts raised and messages sent during each scan.

VIEW ascan / scanProgress

Changed to also return the number of alerts raised by each scanner.

ZAP API New Endpoints:

VIEW core / alertsSummary

A new summary view for Alerts which displays counts of Alerts per Risk level. Optionally, filtered by a baseurl value. 

{"High":0,"Low":132,"Medium":39,"Informational":153}

VIEW core / messagesById

Gets the HTTP messages with the given IDs.

VIEW core / messagesHarById

Gets the HTTP messages with the given IDs, in HAR format.

VIEW core / optionAlertOverridesFilePath

Gets the path to the file with alert overrides.

VIEW core / optionMaximumAlertInstances

Gets the maximum number of alert instances to include in a report.

VIEW core / optionMergeRelatedAlerts

Gets whether or not related alerts will be merged in any reports generated.

VIEW core / zapHomePath

Gets the path to ZAP's home directory.

VIEW localProxies / additionalProxies

Gets all of the additional proxies that have been configured.

VIEW spider / optionAcceptCookies

Gets whether or not a spider process should accept cookies while spidering.

ACTION core / deleteAlert

Deletes the alert with the given ID.

ACTION core / setOptionAlertOverridesFilePath

Sets (or clears, if empty) the path to the file with alert overrides.

ACTION core / setOptionMaximumAlertInstances

Sets the maximum number of alert instances to include in a report. A value of zero is treated as unlimited.

ACTION core / setOptionMergeRelatedAlerts

Sets whether or not related alerts will be merged in any reports generated.

ACTION ascan / importScanPolicy

Imports a Scan Policy using the given file system path.

ACTION ascan / skipScanner

Skips the scanner using the IDs of the scan and the scanner.

VIEW localProxies / addAdditionalProxy

Adds a new proxy using the details supplied.

VIEW localProxies / removeAdditionalProxy

Removes the additional proxy with the specified address and port.

ACTION spider / setOptionAcceptCookies

Sets whether or not a spider process should accept cookies while spidering.

Vulnerability Details

The following vulnerability has been reported in a previous version of ZAP.
Many thanks to all of the researchers who have ethically reported issues to us via our bug bounty program.
If you need more details about this vulnerability then please contact us.

Windows Uninstaller Vulnerable to DLL Hijacking

The ZAP Windows Uninstaller for 2.6.0 is vulnerable to DLL Hijacking on Windows. This was a vulnerability in the 3rd party installer Install4j which has now been fixed.
Note that this can only occur if a malicious DLL is already on the path.

Credit: Sajeeb Lohani (sml555) of Bulletproof ZDS

See also

    Introductionthe introduction to ZAP
    Releasesthe full set of releases
    Creditsthe people and groups who have made this release possible