zap

Hi,

I am getting some XSS Reflected and persistent alerts generated when a .xls or .pdf file contains unsantised XSS injection strings. I do not want to add an alert filter because it is an .asp page that generates these files and so there could be another XSS vulnerability on the page.

I was wondering if the XSS rule could check the Content-Type header and the file identifying line (first

Apache 部署GVA

部署版本

GVA 2.4.0

具体配置

VirtualHost 配置中加入:

    <Proxy /api>  
         Order deny,allow  
         Allow from all  
     </Proxy>  
     ProxyPass /api http://127.0.0.1:8888      
     ProxyPassReverse /api http://127.0.0.1:8888

此配置目的与 官方 nginx 提供配置类似。

注意

Apache 需要开启 proxy_module

http://127.0.0.1:8888 为后端默认地址，如已更改记得替换

If HTTP sites (is not HTTPS ones) use the Access-Control-Allow-Origin header then the site will typically not work.
ZAP should automatically fix this header.
https://stackoverflow.com/questions/61940616/how-do-i-work-with-http-sites-using-the-hud-in-owasps-zap-proxy