ascanrules: Reflected XSS introduce param object

[kingthorin]

Overview

To facilitate further modifications and refactoring.

• CHANGELOG > Maint note already exists.
• CrossSiteScriptingScanRule > Introduce and leverage new param object.
• HtmlContextAnalyser > Throw an exception if the target param is empty as that leads to an infinite loop.

Related Issues

• [WIP] ascanrules: Fix for XSS issues related to javascript context. #3838

[psiinon]

Checkmarx One – Scan Summary & Details – ba1b1224-6458-4a38-93f2-dd8e3ff46a31

Great job! No new security vulnerabilities introduced in this pull request

---

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

[kingthorin]

Added "clean code" commit.
It removes an unused param in two methods in the rule, and returns an object directly skipping an intermediate store in the unit tests.

[Copilot]

Pull Request Overview

This pull request refactors the XSS scanning functionality to introduce a new parameter object (XssAttackParam) for improved readability and extendability, and adds an exception in HtmlContextAnalyser to prevent an infinite loop when the target parameter is empty. Key changes include:

• Adding a check in HtmlContextAnalyser to throw an exception for an empty target.
• Refactoring multiple performAttack methods in CrossSiteScriptingScanRule to use the new XssAttackParam.
• Updating the changelog with maintenance changes.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/httputils/HtmlContextAnalyser.java	Added a validation exception for an empty target parameter.
addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/CrossSiteScriptingScanRule.java	Replaced overloaded performAttack methods with a unified method using XssAttackParam and applied necessary refactoring across various attack tests.
addOns/ascanrules/CHANGELOG.md	Updated changelog to include maintenance changes.

[kingthorin]

Verified that the additional tests in #6638 also work here. I know this still requires attention, just making note.