Address potential classloader performance issues in JS scripts by kingthorin · Pull Request #504 · zaproxy/community-scripts

kingthorin · 2025-12-12T16:45:42Z

No description provided.

kingthorin · 2025-12-12T16:46:41Z

Note I used const in all the changes but didn't change/reduce other use of var. I can I just wasn't sure if it should be the same PR.

psiinon · 2025-12-12T16:47:59Z

Checkmarx One – Scan Summary & Details – 52f4454d-29a2-46d3-9bcd-4af0422c5656

New Issues (5)

Checkmarx found the following issues in this Pull Request

Issue	Source File / Package	Checkmarx Insight
Last User Is 'root'	/docker-wrapper: 10	details Leaving the last user as root can cause security risks. Change to another user after running the commands that need privileges `ID: 48tNdC6UziXyOGUccQZn3tPPzi4%3D`
MAINTAINER Instruction Being Used	/docker-wrapper: 3	details The MAINTAINER instruction sets the Author field of the generated images. The LABEL instruction is a much more flexible version of this and you sh... `ID: nlHBIHIr9RZHoVXOgGxJ9hQCHFA%3D`
Unpinned Actions Full Length Commit SHA	/codeql.yml: 31	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... `ID: z89ONTXYaYdPcNUEzfFqPVDqGfU%3D`
Unpinned Actions Full Length Commit SHA	/codeql.yml: 34	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... `ID: wmF9HbZcEd4Px83a0Vg%2BO%2F%2B%2B4BU%3D`
Unpinned Actions Full Length Commit SHA	/codeql.yml: 35	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... `ID: ivv4LqDvobLaIQBf4po7RJO0z9E%3D`

Fixed Issues (2)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CVE-2025-66418~~	Python-urllib3-2.5.0
	~~CVE-2025-66471~~	Python-urllib3-2.5.0

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

kingthorin · 2025-12-16T12:27:32Z

The CX failure is unrelated to the changes.

httpfuzzerprocessor/addCacheBusting.js

httpfuzzerprocessor/unexpected_responses.js

httpsender/Alert on HTTP Response Code Errors.js

thc202 · 2025-12-17T18:59:06Z

passive/Report non static sites.js

@@ -73,7 +76,5 @@ function appliesToHistoryType(historyType) {
  // return historyType == org.parosproxy.paros.model.HistoryReference.TYPE_SPIDER;


This should be updated as well.

I was suggesting doing the same as the other cases move it to the script declaration not keep it inside the function.

At HistoryReference or SPIDER_TYPE?

Move the HistoryReference.

standalone/historySourceTagger.js

targeted/json_csrf_poc_generator.js

Signed-off-by: kingthorin <[email protected]>

kingthorin · 2025-12-19T14:33:41Z

Think I got all those.

thc202 · 2025-12-19T16:55:28Z

CHANGELOG.md

 - Active and passive READMEs to include lastest JS script examples.
+- Reduce usage of fully qualified objects in loops or main methods to address potential classloader performance issues, in JavaScript scripts (Issue 9187).
+- Updated Alert_on_HTTP_Response_Code_Errors.js to work with GraalVM JavaScript engine.
+


Can be removed.

thc202 · 2025-12-19T17:02:48Z

Not all scripts were updated (some still left in the changed scripts), was that on purpose?

kingthorin · 2025-12-19T17:06:15Z

I thought I copied the full content from zaproxy/docker will check.

thc202 · 2025-12-19T17:14:05Z

I'm referring to scripts that are just here (e.g. Telerik Using Poor Crypto.js with Base64 and Alert, Capture and Replace Anti CSRF Token.js with ScriptVars).

kingthorin · 2025-12-19T17:26:11Z

My search must have missed them, thanks for clarifying.

kingthorin · 2025-12-19T18:10:24Z

I just remembered there were a few I left on purpose like in the extender scripts cause they're only used on install and uninstall or register and unregister, but I guess I should change them all to be consistent.

kingthorin force-pushed the adjust-java-type-usage branch from 39d4e87 to 80916f9 Compare December 12, 2025 16:53

kingthorin changed the title ~~Address potential classloader performance issues~~ Address potential classloader performance issues in JS scripts Dec 12, 2025

thc202 reviewed Dec 17, 2025

View reviewed changes

Address potential classloader performance issues

f6c4ce7

Signed-off-by: kingthorin <[email protected]>

kingthorin force-pushed the adjust-java-type-usage branch from 80916f9 to f6c4ce7 Compare December 19, 2025 14:31

thc202 reviewed Dec 19, 2025

View reviewed changes

		@@ -73,7 +76,5 @@ function appliesToHistoryType(historyType) {
		// return historyType == org.parosproxy.paros.model.HistoryReference.TYPE_SPIDER;

Uh oh!

Conversation

kingthorin commented Dec 12, 2025

Uh oh!

kingthorin commented Dec 12, 2025

Uh oh!

psiinon commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kingthorin commented Dec 16, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thc202 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

thc202 Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

kingthorin Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

thc202 Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kingthorin commented Dec 19, 2025

Uh oh!

thc202 Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thc202 commented Dec 19, 2025

Uh oh!

kingthorin commented Dec 19, 2025

Uh oh!

thc202 commented Dec 19, 2025

Uh oh!

kingthorin commented Dec 19, 2025

Uh oh!

kingthorin commented Dec 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

psiinon commented Dec 12, 2025 •

edited

Loading

thc202 Dec 19, 2025 •

edited

Loading