Release 2.9.0

This is a bug fix and enhancement release, which requires a minimum of Java 8. Note that a minimum of Java 11 is recommended, especially for high DPI displays.

These release notes do not include all of the changes included in add-ons updated since 2.8.0.

Some of the more significant enhancements include:

Session Management Scripts

It's now possible to define scripts which handle non standard or more complex session management.
Session Management scripts have full access to the authentication request and response and can define custom mandatory and optional parameters. An example session management script for OWASP Juice shop is provided.

Active Scan Filter

It's now possible to filter requests in Active Scan. Below are the supported criteria's:

Custom Global/Script Variables

It's now possible for scripts to share custom global/script variables, which can be of any type not just strings, for example, lists, maps, GUI models.
In JavaScript they are accessed/set as follows: 

var ScriptVars = Java.type("org.zaproxy.zap.extension.script.ScriptVars")

ScriptVars.setScriptCustomVar(this.context, "var.name", {x: 1, y: 3})
print(ScriptVars.getScriptCustomVar(this.context, "var.name").y) // Prints 3

ScriptVars.setGlobalCustomVar("var.name", ["A", "B", "C", "D"])
print(ScriptVars.getGlobalCustomVar("var.name")[2]) // Prints C

Scan Rule Promotions

The following scan rules have been promoted:

Passive Scan Rules - Release

Filters Classes Removal

The classes/code for Filters functionality, deprecated since ZAP 2.4.0, has been removed. Add-ons that still use that will stop working.

Changes in Bundled Libraries

The following libraries were removed: no longer in use by core, add-ons should bundle the library, if needed. The following libraries were updated:

Enhancements

Bug fixes

ZAP API New Endpoints:

VIEW script / globalCustomVar

Gets the value (string representation) of a global custom variable. Returns an API error (DOES_NOT_EXIST) if no value was previously set.

VIEW script / globalCustomVars

Gets all the global custom variables (key/value pairs, the value is the string representation).

VIEW script / scriptCustomVar

Gets the value (string representation) of a custom variable. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists or if no value was previously set.

VIEW script / scriptCustomVars

Gets all the custom variables (key/value pairs, the value is the string representation) of a script. Returns an API error (DOES_NOT_EXIST) if no script with the given name exists.

ACTION alert / addAlert

Add an alert associated with the given message ID, with the provided details. (The ID of the created alert is returned.)

ACTION alert / updateAlert

Update the alert with the given ID, with the provided details.

ACTION pscan / disableAllTags

Disables all passive scan tags.

ACTION pscan / enableAllTags

Enables all passive scan tags.

ACTION script / clearGlobalCustomVar

Clears a global custom variable.

ACTION script / clearScriptCustomVar

Clears a script custom variable.

See also

    Introductionthe introduction to ZAP
    Releasesthe full set of releases
    Creditsthe people and groups who have made this release possible