Skip to content

Commit d387303

Browse files
psiinonpsiinon
authored
Merge pull request #6537 from kingthorin/common-lib-help
commonlib: Add alert tag help and update the compliance tag URLs
2 parents 0fd3553 + ef689f0 commit d387303

File tree

5 files changed

+57
-2
lines changed

5 files changed

+57
-2
lines changed

‎addOns/commonlib/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77
## Unreleased
88
### Added
99
- Added Alert Tags for PCI DSS and HIPAA standards.
10+
- Added a help page for the alert tags provided through this add-on.
1011

1112
## [1.33.0] - 2025-06-20
1213
### Added

‎addOns/commonlib/src/main/java/org/zaproxy/addon/commonlib/CommonAlertTag.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,9 @@ public enum CommonAlertTag {
394394
*
395395
* @since 1.34.0
396396
*/
397-
PCI_DSS("PCI_DSS", "https://www.pcisecuritystandards.org/standards/pci-dss/"),
397+
PCI_DSS(
398+
"PCI_DSS",
399+
"https://www.zaproxy.org/docs/desktop/addons/common-library/alerttags/#compliance"),
398400

399401
/**
400402
* Indicates that the scan rule has been mapped to the HIPAA standard.
@@ -403,7 +405,7 @@ public enum CommonAlertTag {
403405
*/
404406
HIPAA(
405407
"HIPAA",
406-
"https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html");
408+
"https://www.zaproxy.org/docs/desktop/addons/common-library/alerttags/#compliance");
407409

408410
private String tag;
409411
private String value;

‎addOns/commonlib/src/main/javahelp/help/contents/alerttags.html‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
2+
<html>
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
5+
<title>
6+
Alert Tags
7+
</title>
8+
</head>
9+
<body>
10+
<h1>Alert Tags</h1>
11+
12+
The Common Library add-on provides Alert Tags for use by scan rules.
13+
14+
<p>
15+
Of note the following tags/groups of tags are included:
16+
<ul>
17+
<li>Custom Payloads - A tag which indicates the scan rules which support <a href="https://www.zaproxy.org/docs/desktop/addons/custom-payloads/">Custom Payloads functionality</a>.</li>
18+
<li>HIPAA (Health Insurance Portability and Accountability Act) - A tag representing alerts/rules which we've mapped to the HIPAA standard.</li>
19+
<li>OWASP Top 10 (2017) - Tags representing the risks/vulnerabilities from the 2017 OWASP Top 10 list.</li>
20+
<li>OWASP Top 10 (2021) - Tags representing the risks/vulnerabilities from the 2021 OWASP Top 10 list.</li>
21+
<li>PCI DSS (Payment Card Industry Data Security Standard) - A tag representing alerts/rules which we've mapped to the PCI DSS standard.</li>
22+
<li>Test Timing - A tag which represent rules/alerts which are based on time (induced delay) payloads.</li>
23+
<li>OWASP Web Security Testing Guide (v4.2) - Tags which map rules/alerts to the relevant sections of the OWASP WSTG (version 4.2).</li>
24+
</ul>
25+
26+
<h2 id="compliance">Compliance Tags</h2>
27+
28+
Please note that the PCI DSS and HIPAA standards deal with specific types of data, while an identified vulnerability may expose
29+
such data ZAP has insufficient context with which to differentiate what is or might be exposed by leveraging a given vulnerability.
30+
If the system being tested does not hold any such data then the related compliance tag <strong>may</strong> not be relevant.
31+
<p>
32+
See also:<br>
33+
<ul>
34+
<li><a href="https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html">HIPAA</a>.</li>
35+
<li><a href="https://www.pcisecuritystandards.org/standards/pci-dss/">PCI DSS</a>.</li>
36+
</ul>
37+
38+
<h2>CVE Tags</h2>
39+
Any alert that involves a specific CVE will (generally) also have a tag for
40+
that specific CVE identifier with a value that links to Mitre's National
41+
Vulnerability Database (NVD).
42+
43+
<h2>Policy Tags</h2>
44+
The add-on also provides a set of Alert Tags which associate various rule
45+
types or focus areas to scan policies, see the
46+
<a href="https://www.zaproxy.org/docs/desktop/addons/scan-policies/">Scan
47+
Policies add-on help</a> for further details.
48+
49+
</body>
50+
</html>

‎addOns/commonlib/src/main/javahelp/help/map.jhm‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@
66
<map version="1.0">
77
<mapID target="commonlib" url="contents/commonlib.html" />
88
<mapID target="commonlib.output.panel" url="contents/output-panel.html" />
9+
<mapID target="commonlib.alert.tags" url="contents/alerttags.html" />
910
</map>

‎addOns/commonlib/src/main/javahelp/help/toc.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
<tocitem text="Add Ons" tocid="addons">
99
<tocitem text="Common Library" target="commonlib">
1010
<tocitem text="Tabbed Output Panel" target="commonlib.output.panel" />
11+
<tocitem text="Alert Tags" target="commonlib.alert.tags" />
1112
</tocitem>
1213
</tocitem>
1314
</tocitem>

0 commit comments

Comments
 (0)