<commit_before>/*
 * Zed Attack Proxy (ZAP) and its related class files.
 *
 * ZAP is an HTTP/HTTPS proxy for assessing web application security.
 *
 * Copyright 2019 The ZAP Development Team
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.zaproxy.zap.extension.pscanrulesAlpha;

import net.htmlparser.jericho.Element;
import net.htmlparser.jericho.Source;
import org.parosproxy.paros.Constant;
import org.parosproxy.paros.core.scanner.Alert;
import org.parosproxy.paros.network.HttpMessage;
import org.zaproxy.zap.extension.pscan.PassiveScanThread;
import org.zaproxy.zap.extension.pscan.PluginPassiveScanner;

import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.function.Predicate;

import static net.htmlparser.jericho.HTMLElementName.LINK;
import static net.htmlparser.jericho.HTMLElementName.SCRIPT;

/** Detect missing attribute integrity in tag <script> */
public class SubResourceIntegrityAttributeScanner extends PluginPassiveScanner {
    /** Prefix for internationalized messages used by this rule */
    private static final String MESSAGE_PREFIX = "pscanalpha.sri-integrity.";

    // From
    // https://w3c.github.io/webappsec-subresource-integrity/#verification-of-html-document-subresources
    // To support integrity metadata for some of these elements, a new integrity attribute is added
    // to
    // the list of content attributes for the link and script elements.
    // Note: A future revision of this specification is likely to include integrity support for all
    // possible subresources, i.e., a, audio, embed, iframe, img, link, object, script, source,
    // track,
    // and video elements.
    private static final List<String> SUPPORTED_ELEMENTS = Arrays.asList(SCRIPT, LINK);

    private static final Map<String, String> CONTENT_ATTRIBUTES =
            new HashMap<String, String>() {
                {
                    put(SCRIPT, "src");
                    put(LINK, "href");
                }
            };

    private PassiveScanThread parent;

    @Override
    public void scanHttpRequestSend(HttpMessage msg, int id) {
        // do nothing
    }

    @Override
    public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
        List<Element> sourceElements = source.getAllElements();
        sourceElements.stream()
                .filter(element -> SUPPORTED_ELEMENTS.contains(element.getName()))
                .filter(unsafeSubResource(msg.getRequestHeader().getHostName()))
                .forEach(
                        element -> {
                            Alert alert =
                                    new Alert(
                                            getPluginId(),
                                            Alert.RISK_MEDIUM,
                                            Alert.CONFIDENCE_HIGH,
                                            getName());

                            alert.setDetail(
                                    getString("desc"),
                                    msg.getRequestHeader().getURI().toString(),
                                    "",
                                    "",
                                    "",
                                    getString("soln"),
                                    getString("refs"),
                                    element.toString(),
                                    287, // Improper Authentication
                                    -1, // Not applicable
                                    msg);
                            parent.raiseAlert(id, alert);<commit_msg>Sub Resource Integrity Missing Attribute is a misconfiguration<commit_after>/*
 * Zed Attack Proxy (ZAP) and its related class files.
 *
 * ZAP is an HTTP/HTTPS proxy for assessing web application security.
 *
 * Copyright 2019 The ZAP Development Team
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.zaproxy.zap.extension.pscanrulesAlpha;

import net.htmlparser.jericho.Element;
import net.htmlparser.jericho.Source;
import org.parosproxy.paros.Constant;
import org.parosproxy.paros.core.scanner.Alert;
import org.parosproxy.paros.network.HttpMessage;
import org.zaproxy.zap.extension.pscan.PassiveScanThread;
import org.zaproxy.zap.extension.pscan.PluginPassiveScanner;

import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.function.Predicate;

import static net.htmlparser.jericho.HTMLElementName.LINK;
import static net.htmlparser.jericho.HTMLElementName.SCRIPT;

/** Detect missing attribute integrity in tag <script> */
public class SubResourceIntegrityAttributeScanner extends PluginPassiveScanner {
    /** Prefix for internationalized messages used by this rule */
    private static final String MESSAGE_PREFIX = "pscanalpha.sri-integrity.";

    // From
    // https://w3c.github.io/webappsec-subresource-integrity/#verification-of-html-document-subresources
    // To support integrity metadata for some of these elements, a new integrity attribute is added
    // to
    // the list of content attributes for the link and script elements.
    // Note: A future revision of this specification is likely to include integrity support for all
    // possible subresources, i.e., a, audio, embed, iframe, img, link, object, script, source,
    // track,
    // and video elements.
    private static final List<String> SUPPORTED_ELEMENTS = Arrays.asList(SCRIPT, LINK);

    private static final Map<String, String> CONTENT_ATTRIBUTES =
            new HashMap<String, String>() {
                {
                    put(SCRIPT, "src");
                    put(LINK, "href");
                }
            };

    private PassiveScanThread parent;

    @Override
    public void scanHttpRequestSend(HttpMessage msg, int id) {
        // do nothing
    }

    @Override
    public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
        List<Element> sourceElements = source.getAllElements();
        sourceElements.stream()
                .filter(element -> SUPPORTED_ELEMENTS.contains(element.getName()))
                .filter(unsafeSubResource(msg.getRequestHeader().getHostName()))
                .forEach(
                        element -> {
                            Alert alert =
                                    new Alert(
                                            getPluginId(),
                                            Alert.RISK_MEDIUM,
                                            Alert.CONFIDENCE_HIGH,
                                            getName());

                            alert.setDetail(
                                    getString("desc"),
                                    msg.getRequestHeader().getURI().toString(),
                                    "",
                                    "",
                                    "",
                                    getString("soln"),
                                    getString("refs"),
                                    element.toString(),
                                    16, // Improper Authentication
                                    15, // Not applicable
                                    msg);
                            parent.raiseAlert(id, alert);
{'fraction_non_alphanumeric': 0.08189448441247002, 'fraction_numerical': 0.003117505995203837, 'mean_word_length': 1.8207642881298614, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 17, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 43, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2776383', 'n_tokens_mistral': 2064, 'n_tokens_neox': 1968, 'n_words': 596}