<commit_before>/*
 * Zed Attack Proxy (ZAP) and its related class files.
 *
 * ZAP is an HTTP/HTTPS proxy for assessing web application security.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.zaproxy.zap.extension.pscan.scanner;

import java.io.BufferedReader;
import java.io.FileReader;
import java.io.IOException;

import net.htmlparser.jericho.Source;

import org.apache.log4j.Logger;
import org.parosproxy.paros.core.scanner.Alert;
import org.parosproxy.paros.network.HttpBody;
import org.parosproxy.paros.network.HttpMessage;
import org.zaproxy.zap.extension.pscan.PluginPassiveScanner;
import org.zaproxy.zap.extension.pscan.PassiveScanThread;

public class InformationDisclosureDebugErrors extends PluginPassiveScanner {

	private PassiveScanThread parent = null;
	private static final String debugErrorFile = "xml/debug-error-messages.txt";
	private static final Logger logger = Logger.getLogger(InformationDisclosureDebugErrors.class);
	
	@Override
	public void scanHttpRequestSend(HttpMessage msg, int id) {
		
	}

	@Override
	public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
		if (msg.getResponseBody().length() > 0 && msg.getResponseHeader().isText()) {
			String parameter;
			if ((parameter = doesRequestContainsDebugErrorMessage(msg.getResponseBody())) != null) {
				this.raiseAlert(msg, id, parameter);
			}
		}
	}

	private void raiseAlert(HttpMessage msg, int id, String infoDisclosureDBError) {
		Alert alert = new Alert(getId(), Alert.RISK_INFO, Alert.WARNING, 
		    	getName());
		    	alert.setDetail(
		    			"The response request appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages", 
		    	    msg.getRequestHeader().getURI().toString(),
		    	    infoDisclosureDBError,
		    	    "", 
		    	    "",
		    	    "Disable debugging messages before pushing to production", 
		            "", 
		            msg);
	
    	parent.raiseAlert(id, alert);
	}
	
	private String doesRequestContainsDebugErrorMessage (HttpBody body) {
		String line = null;
		BufferedReader reader = null;
		try {
			reader = new BufferedReader(new FileReader(debugErrorFile));
			while ((line = reader.readLine()) != null) {
				if (!line.startsWith("#") && body.toString().toLowerCase().contains(line.toLowerCase())) {
					reader.close();
					return line;
				}
			}
		} catch (IOException e) {
			logger.debug("Error on opening/reading debug error file. Error: " + e.getMessage());
		} finally {
			if (reader != null) {
				try {
					reader.close();			<commit_msg>Minor corrections for improvements (removing useless closing of reader-> catched later in finally block, method renaming)<commit_after>/*
 * Zed Attack Proxy (ZAP) and its related class files.
 *
 * ZAP is an HTTP/HTTPS proxy for assessing web application security.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.zaproxy.zap.extension.pscan.scanner;

import java.io.BufferedReader;
import java.io.FileReader;
import java.io.IOException;

import net.htmlparser.jericho.Source;

import org.apache.log4j.Logger;
import org.parosproxy.paros.core.scanner.Alert;
import org.parosproxy.paros.network.HttpBody;
import org.parosproxy.paros.network.HttpMessage;
import org.zaproxy.zap.extension.pscan.PluginPassiveScanner;
import org.zaproxy.zap.extension.pscan.PassiveScanThread;

public class InformationDisclosureDebugErrors extends PluginPassiveScanner {

	private PassiveScanThread parent = null;
	private static final String debugErrorFile = "xml/debug-error-messages.txt";
	private static final Logger logger = Logger.getLogger(InformationDisclosureDebugErrors.class);
	
	@Override
	public void scanHttpRequestSend(HttpMessage msg, int id) {
		
	}

	@Override
	public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
		if (msg.getResponseBody().length() > 0 && msg.getResponseHeader().isText()) {
			String parameter;
			if ((parameter = doesResponseContainsDebugErrorMessage(msg.getResponseBody())) != null) {
				this.raiseAlert(msg, id, parameter);
			}
		}
	}

	private void raiseAlert(HttpMessage msg, int id, String infoDisclosureDBError) {
		Alert alert = new Alert(getId(), Alert.RISK_INFO, Alert.WARNING, 
		    	getName());
		    	alert.setDetail(
		    			"The response request appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages", 
		    	    msg.getRequestHeader().getURI().toString(),
		    	    infoDisclosureDBError,
		    	    "", 
		    	    "",
		    	    "Disable debugging messages before pushing to production", 
		            "", 
		            msg);
	
    	parent.raiseAlert(id, alert);
	}
	
	private String doesResponseContainsDebugErrorMessage (HttpBody body) {
		String line = null;
		BufferedReader reader = null;
		try {
			reader = new BufferedReader(new FileReader(debugErrorFile));
			String sBody = body.toString().toLowerCase();
			while ((line = reader.readLine()) != null) {
				if (!line.startsWith("#") && sBody.contains(line.toLowerCase())) {
					return line;
				}
			}
		} catch (IOException e) {
			logger.debug("Error on opening/reading debug error file. Error: " + e.getMessage());
		} finally {
			if (reader != null) {
				try {
					reader.close();			
{'fraction_non_alphanumeric': 0.09869036482694106, 'fraction_numerical': 0.0018709073900841909, 'mean_word_length': 3.8196844477836214, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4267581', 'n_tokens_mistral': 1979, 'n_tokens_neox': 1812, 'n_words': 561}