ascanrulesBeta: More example alerts

[kingthorin]

Overview

• CHANGELOG > Add notes.
• Scan rules > Add example alert functionality (6119).
• Unit tests > Assert the new example alerts.

Related Issues

• New common getExampleAlerts() method zaproxy#6119

Checklist

• [na] Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

[thc202]

The build is failing.

 SlackerCookieScanRuleUnitTest > shouldHaveExpectedExampleAlert() FAILED
    java.lang.AssertionError: 
    Expected: is "Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.\nThese cookies affected the response: oops\nThese cookies did NOT affect the response: bar,foo\n"
         but: was "Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.\nThese cookies affected the response: oops\nThese cookies did NOT affect the response: foo,bar\n"
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
        at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:6)
        at org.zaproxy.zap.extension.ascanrulesBeta.SlackerCookieScanRuleUnitTest.shouldHaveExpectedExampleAlert(SlackerCookieScanRuleUnitTest.java:79)

[thc202]

How was the test fixed?

There's a typo in the add-on ID.

[kingthorin]

I fixed the expected string. I had assumed the cookie collection was processed in order but apparently it's processed backwards 🤷‍♂️

(Or maybe not backwards but ordered...)

[thc202]

The push does not have any changes(?). The set used does not have a reliable ordering.

[kingthorin]

Oh I didn't realize I'd just been lucky. I had done multiple runs locally but not any statistically significant number.

Shall I switch specifically to a SortedSet for the example? Or use string starts with for the test?

[thc202]

Better with SortedSet, we do need a predictable/constant ordering otherwise we'll have unwanted changes in the website.

[kingthorin]

Done

[thc202]

Thank you!