ascanrules: Tidy up External Redirect Scan Rule

[kingthorin]

Overview

• CHANGELOG > Add re-ordering note.
• ExternalRedirectScanRule > Use an enum for payloads & types. Move some logic to be within the payloads enum for simplicity. Move alert reference logic within the types enum. Move payload counts per Strength logic to init method and use a simplified case structure. Remove unnecessary comments.
• ExternalRedirectScanRuleUnitTest > Remove unnecessary assignments. Use isEmpty vs length greater than zero.

Related Issues

• ascanrules: External Redirect fix FN when simple allow list in place #6432 (comment)

Checklist

• Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

[psiinon]

Checkmarx One – Scan Summary & Details – 21de6ed5-ff3e-418e-89a8-7946be6cf307

Great job! No new security vulnerabilities introduced in this pull request

[kingthorin]

Is there any good reason for the type ints to be instantiated in the 0x## format?

L85-92

[thc202]

#6458 (comment)

No, and it would be better to use an enum to avoid duplication like in getExampleAlerts().

[kingthorin]

Done (I think)

[thc202]

The point of changing to enum was to also get rid of getAlertReference() and getRedirectionReason().

[kingthorin]

Got all those.

[Copilot]

Pull Request Overview

This PR tidies up the ExternalRedirectScanRule functionality by refactoring the payload and redirect type handling into enums and cleaning up test code.

• Replace integer constants with enums for redirect types and payloads.
• Refactor payload injection and payload count logic with switch expressions.
• Update unit tests to use .isEmpty() instead of length checks and remove redundant assignments.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRuleUnitTest.java	Refactored empty string checks and cleaned up some redundant assignments.
addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/ExternalRedirectScanRule.java	Replaced integer-based redirect types with enums and refactored payload injection and alert-building logic.
addOns/ascanrules/CHANGELOG.md	Added a maintenance note reflecting the code improvements.

[kingthorin]

It's at the top of the list.

[thc202]

Thank you!