{"action":"created","comment":{"url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments/62053641","id":62053641,"diff_hunk":"@@ -0,0 +1,65 @@\n+/*\n+Script to detect if the site use the protection bring by the \"SameSite\" cookie attribute.\n+\n+Knowing that point is interesting because the goal of this attribute is to mitigate CSRF attack.\n+\n+Links:\n+- https://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue\n+- https://tools.ietf.org/html/draft-west-first-party-cookies\n+- https://www.chromestatus.com/feature/4672634709082112\n+\n+Author: dominique.righetto@gmail.com\n+*/\n+\n+function scan(ps, msg, src) {\n+\t//Docs on alert raising function:\n+\t// raiseAlert(risk, int confidence, String name, String description, String uri, \n+\t//\t\tString param, String attack, String otherInfo, String solution, String evidence, \n+\t//\t\tint cweId, int wascId, HttpMessage msg)\n+\t// risk: 0: info, 1: low, 2: medium, 3: high\n+\t// confidence: 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed\n+\n+\t//Common variables\n+\tvar cweId = 352; \n+\tvar wascId = 9;\n+\tvar url = msg.getRequestHeader().getURI().toString();\t\n+\tvar cookieHeaderNames = [\"Set-Cookie\", \"Set-Cookie2\"];\n+\tvar cookieSameSiteAttributeNameLower = \"samesite\";\n+\n+\t//Response headers collection\n+\tvar responseHeaders = msg.getResponseHeader();\n+\n+\t//Detect and analyze presence of the cookie headers\n+\tfor(var i = 0 ; i < cookieHeaderNames.length ; i++){\n+\t\tvar headerName = cookieHeaderNames[i];\n+\t\tif(responseHeaders.getHeaders(headerName)){\n+\t\t\t//Check if the cookie header values contains the SameSite attribute\n+\t\t\tvar headerValues = responseHeaders.getHeaders(headerName).toArray();\n+\t\t\tfor(var j = 0 ; j < headerValues.length ; j++){\n+\t\t\t\tvar cookieValue = headerValues[j].toLowerCase();\n+\t\t\t\tvar cookieAttributes = cookieValue.split(\";\");\n+\t\t\t\t//Inspect each attribute in order to avoid false-positive spot\n+\t\t\t\t//by simply searching \"samesite=\" on the whole cookie header value...\n+\t\t\t\tvar sameSiteAttrFound = false;\n+\t\t\t\tvar sameSiteAttrValue = null;\n+\t\t\t\tfor(var k = 0 ; k < cookieAttributes.length ; k++){\n+\t\t\t\t\tvar parts = cookieAttributes[k].split(\"=\");\n+\t\t\t\t\tif(parts[0].trim() === cookieSameSiteAttributeNameLower){\n+\t\t\t\t\t\tsameSiteAttrFound = true;\n+\t\t\t\t\t\tsameSiteAttrValue = parts[1].trim();\n+\t\t\t\t\t\tbreak;\n+\t\t\t\t\t}\n+\t\t\t\t}\n+\t\t\t\t//Analyze if the attribute is present and raise info alert\n+\t\t\t\tif(sameSiteAttrFound){\n+\t\t\t\t\tvar cookieName = cookieAttributes[0].split(\"=\")[0].trim();\n+\t\t\t\t\tvar description = \"The current site use the 'SameSite' cookie attribute protection on cookie named '\" + cookieName + \"', value is set to '\" + sameSiteAttrValue + \"' protection level.\";\n+\t\t\t\t\tvar infoLinkRef = \"https://tools.ietf.org/html/draft-west-first-party-cookies\\nhttps://chloe.re/2016/04/13/goodbye-csrf-samesite-to-the-rescue\";\t","path":"passive/detect_samesite_protection.js","position":57,"original_position":57,"commit_id":"22a8d680c7a74a2a775c192628a11aa35258b791","original_commit_id":"22a8d680c7a74a2a775c192628a11aa35258b791","user":{"login":"thc202","id":4639210,"avatar_url":"https://avatars.githubusercontent.com/u/4639210?v=3","gravatar_id":"","url":"https://api.github.com/users/thc202","html_url":"https://github.com/thc202","followers_url":"https://api.github.com/users/thc202/followers","following_url":"https://api.github.com/users/thc202/following{/other_user}","gists_url":"https://api.github.com/users/thc202/gists{/gist_id}","starred_url":"https://api.github.com/users/thc202/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thc202/subscriptions","organizations_url":"https://api.github.com/users/thc202/orgs","repos_url":"https://api.github.com/users/thc202/repos","events_url":"https://api.github.com/users/thc202/events{/privacy}","received_events_url":"https://api.github.com/users/thc202/received_events","type":"User","site_admin":false},"body":"The tab at the end of the line could be removed.","created_at":"2016-05-04T14:55:33Z","updated_at":"2016-05-04T14:55:33Z","html_url":"https://github.com/zaproxy/community-scripts/pull/36#discussion_r62053641","pull_request_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36","_links":{"self":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments/62053641"},"html":{"href":"https://github.com/zaproxy/community-scripts/pull/36#discussion_r62053641"},"pull_request":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36"}}},"pull_request":{"url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36","id":60992397,"html_url":"https://github.com/zaproxy/community-scripts/pull/36","diff_url":"https://github.com/zaproxy/community-scripts/pull/36.diff","patch_url":"https://github.com/zaproxy/community-scripts/pull/36.patch","issue_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/36","number":36,"state":"open","locked":false,"title":"Scripts about CSP policies notification feature and SameSite cookie protection.","user":{"login":"righettod","id":1573775,"avatar_url":"https://avatars.githubusercontent.com/u/1573775?v=3","gravatar_id":"","url":"https://api.github.com/users/righettod","html_url":"https://github.com/righettod","followers_url":"https://api.github.com/users/righettod/followers","following_url":"https://api.github.com/users/righettod/following{/other_user}","gists_url":"https://api.github.com/users/righettod/gists{/gist_id}","starred_url":"https://api.github.com/users/righettod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/righettod/subscriptions","organizations_url":"https://api.github.com/users/righettod/orgs","repos_url":"https://api.github.com/users/righettod/repos","events_url":"https://api.github.com/users/righettod/events{/privacy}","received_events_url":"https://api.github.com/users/righettod/received_events","type":"User","site_admin":false},"body":"Hello,\r\n\r\n_First script:_\r\nThe goal of the proposed script \"**detect_samesite_protection.js**\" is to detect if the site use the protection bring by the \"SameSite\" cookie attribute.\r\n\r\nKnowing that point is interesting because the goal of this attribute is to mitigate CSRF attack.\r\n\r\n\r\n_Second script:_\r\nThe goal of the proposed script \"**detect_csp_notif_and_reportonly.js**\" is to detect the following points about CSP policies defined by a site:\r\n\r\n- If policies send notifications about violations (some kind of monitoring by the site owner),\r\n- If policies behave into \"report-only\" mode (no blocking, only report violations).\r\n\r\nThese informations are interesting from an attacker/researcher point of view because it indicates to him that:\r\n\r\n- His input validation probing tentatives will be potentially quickly detected (depending on the monitoring level by site owner),\r\n- The CSP policies in place will not block the exploitation if a vulnerability is found into input validation,\r\n- Perhaps the endpoint receiving notifications is vulnerable to some injection.\r\n\r\nThanks in advance for your feedback.\r\n\r\nRegards.","created_at":"2016-02-28T14:04:07Z","updated_at":"2016-05-04T14:55:33Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f6487de51b3b17814c09f3fa7009435623c230d4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36/commits","review_comments_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36/comments","review_comment_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/36/comments","statuses_url":"https://api.github.com/repos/zaproxy/community-scripts/statuses/22a8d680c7a74a2a775c192628a11aa35258b791","head":{"label":"righettod:master","ref":"master","sha":"22a8d680c7a74a2a775c192628a11aa35258b791","user":{"login":"righettod","id":1573775,"avatar_url":"https://avatars.githubusercontent.com/u/1573775?v=3","gravatar_id":"","url":"https://api.github.com/users/righettod","html_url":"https://github.com/righettod","followers_url":"https://api.github.com/users/righettod/followers","following_url":"https://api.github.com/users/righettod/following{/other_user}","gists_url":"https://api.github.com/users/righettod/gists{/gist_id}","starred_url":"https://api.github.com/users/righettod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/righettod/subscriptions","organizations_url":"https://api.github.com/users/righettod/orgs","repos_url":"https://api.github.com/users/righettod/repos","events_url":"https://api.github.com/users/righettod/events{/privacy}","received_events_url":"https://api.github.com/users/righettod/received_events","type":"User","site_admin":false},"repo":{"id":52723577,"name":"community-scripts","full_name":"righettod/community-scripts","owner":{"login":"righettod","id":1573775,"avatar_url":"https://avatars.githubusercontent.com/u/1573775?v=3","gravatar_id":"","url":"https://api.github.com/users/righettod","html_url":"https://github.com/righettod","followers_url":"https://api.github.com/users/righettod/followers","following_url":"https://api.github.com/users/righettod/following{/other_user}","gists_url":"https://api.github.com/users/righettod/gists{/gist_id}","starred_url":"https://api.github.com/users/righettod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/righettod/subscriptions","organizations_url":"https://api.github.com/users/righettod/orgs","repos_url":"https://api.github.com/users/righettod/repos","events_url":"https://api.github.com/users/righettod/events{/privacy}","received_events_url":"https://api.github.com/users/righettod/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/righettod/community-scripts","description":"A collection of ZAP scripts provided by the community - pull requests very welcome!","fork":true,"url":"https://api.github.com/repos/righettod/community-scripts","forks_url":"https://api.github.com/repos/righettod/community-scripts/forks","keys_url":"https://api.github.com/repos/righettod/community-scripts/keys{/key_id}","collaborators_url":"https://api.github.com/repos/righettod/community-scripts/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/righettod/community-scripts/teams","hooks_url":"https://api.github.com/repos/righettod/community-scripts/hooks","issue_events_url":"https://api.github.com/repos/righettod/community-scripts/issues/events{/number}","events_url":"https://api.github.com/repos/righettod/community-scripts/events","assignees_url":"https://api.github.com/repos/righettod/community-scripts/assignees{/user}","branches_url":"https://api.github.com/repos/righettod/community-scripts/branches{/branch}","tags_url":"https://api.github.com/repos/righettod/community-scripts/tags","blobs_url":"https://api.github.com/repos/righettod/community-scripts/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/righettod/community-scripts/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/righettod/community-scripts/git/refs{/sha}","trees_url":"https://api.github.com/repos/righettod/community-scripts/git/trees{/sha}","statuses_url":"https://api.github.com/repos/righettod/community-scripts/statuses/{sha}","languages_url":"https://api.github.com/repos/righettod/community-scripts/languages","stargazers_url":"https://api.github.com/repos/righettod/community-scripts/stargazers","contributors_url":"https://api.github.com/repos/righettod/community-scripts/contributors","subscribers_url":"https://api.github.com/repos/righettod/community-scripts/subscribers","subscription_url":"https://api.github.com/repos/righettod/community-scripts/subscription","commits_url":"https://api.github.com/repos/righettod/community-scripts/commits{/sha}","git_commits_url":"https://api.github.com/repos/righettod/community-scripts/git/commits{/sha}","comments_url":"https://api.github.com/repos/righettod/community-scripts/comments{/number}","issue_comment_url":"https://api.github.com/repos/righettod/community-scripts/issues/comments{/number}","contents_url":"https://api.github.com/repos/righettod/community-scripts/contents/{+path}","compare_url":"https://api.github.com/repos/righettod/community-scripts/compare/{base}...{head}","merges_url":"https://api.github.com/repos/righettod/community-scripts/merges","archive_url":"https://api.github.com/repos/righettod/community-scripts/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/righettod/community-scripts/downloads","issues_url":"https://api.github.com/repos/righettod/community-scripts/issues{/number}","pulls_url":"https://api.github.com/repos/righettod/community-scripts/pulls{/number}","milestones_url":"https://api.github.com/repos/righettod/community-scripts/milestones{/number}","notifications_url":"https://api.github.com/repos/righettod/community-scripts/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/righettod/community-scripts/labels{/name}","releases_url":"https://api.github.com/repos/righettod/community-scripts/releases{/id}","deployments_url":"https://api.github.com/repos/righettod/community-scripts/deployments","created_at":"2016-02-28T13:54:33Z","updated_at":"2016-02-28T13:54:34Z","pushed_at":"2016-04-27T17:40:58Z","git_url":"git://github.com/righettod/community-scripts.git","ssh_url":"git@github.com:righettod/community-scripts.git","clone_url":"https://github.com/righettod/community-scripts.git","svn_url":"https://github.com/righettod/community-scripts","homepage":null,"size":90,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zaproxy:master","ref":"master","sha":"f3dcee9a0a7f776c5c7925cbc18712b1ae451250","user":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"repo":{"id":28714269,"name":"community-scripts","full_name":"zaproxy/community-scripts","owner":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zaproxy/community-scripts","description":"A collection of ZAP scripts provided by the community - pull requests very welcome!","fork":false,"url":"https://api.github.com/repos/zaproxy/community-scripts","forks_url":"https://api.github.com/repos/zaproxy/community-scripts/forks","keys_url":"https://api.github.com/repos/zaproxy/community-scripts/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zaproxy/community-scripts/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zaproxy/community-scripts/teams","hooks_url":"https://api.github.com/repos/zaproxy/community-scripts/hooks","issue_events_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/events{/number}","events_url":"https://api.github.com/repos/zaproxy/community-scripts/events","assignees_url":"https://api.github.com/repos/zaproxy/community-scripts/assignees{/user}","branches_url":"https://api.github.com/repos/zaproxy/community-scripts/branches{/branch}","tags_url":"https://api.github.com/repos/zaproxy/community-scripts/tags","blobs_url":"https://api.github.com/repos/zaproxy/community-scripts/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zaproxy/community-scripts/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zaproxy/community-scripts/git/refs{/sha}","trees_url":"https://api.github.com/repos/zaproxy/community-scripts/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zaproxy/community-scripts/statuses/{sha}","languages_url":"https://api.github.com/repos/zaproxy/community-scripts/languages","stargazers_url":"https://api.github.com/repos/zaproxy/community-scripts/stargazers","contributors_url":"https://api.github.com/repos/zaproxy/community-scripts/contributors","subscribers_url":"https://api.github.com/repos/zaproxy/community-scripts/subscribers","subscription_url":"https://api.github.com/repos/zaproxy/community-scripts/subscription","commits_url":"https://api.github.com/repos/zaproxy/community-scripts/commits{/sha}","git_commits_url":"https://api.github.com/repos/zaproxy/community-scripts/git/commits{/sha}","comments_url":"https://api.github.com/repos/zaproxy/community-scripts/comments{/number}","issue_comment_url":"https://api.github.com/repos/zaproxy/community-scripts/issues/comments{/number}","contents_url":"https://api.github.com/repos/zaproxy/community-scripts/contents/{+path}","compare_url":"https://api.github.com/repos/zaproxy/community-scripts/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zaproxy/community-scripts/merges","archive_url":"https://api.github.com/repos/zaproxy/community-scripts/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zaproxy/community-scripts/downloads","issues_url":"https://api.github.com/repos/zaproxy/community-scripts/issues{/number}","pulls_url":"https://api.github.com/repos/zaproxy/community-scripts/pulls{/number}","milestones_url":"https://api.github.com/repos/zaproxy/community-scripts/milestones{/number}","notifications_url":"https://api.github.com/repos/zaproxy/community-scripts/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zaproxy/community-scripts/labels{/name}","releases_url":"https://api.github.com/repos/zaproxy/community-scripts/releases{/id}","deployments_url":"https://api.github.com/repos/zaproxy/community-scripts/deployments","created_at":"2015-01-02T13:39:26Z","updated_at":"2016-05-02T11:35:23Z","pushed_at":"2016-04-27T17:40:58Z","git_url":"git://github.com/zaproxy/community-scripts.git","ssh_url":"git@github.com:zaproxy/community-scripts.git","clone_url":"https://github.com/zaproxy/community-scripts.git","svn_url":"https://github.com/zaproxy/community-scripts","homepage":null,"size":145,"stargazers_count":115,"watchers_count":115,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":34,"mirror_url":null,"open_issues_count":8,"forks":34,"open_issues":8,"watchers":115,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36"},"html":{"href":"https://github.com/zaproxy/community-scripts/pull/36"},"issue":{"href":"https://api.github.com/repos/zaproxy/community-scripts/issues/36"},"comments":{"href":"https://api.github.com/repos/zaproxy/community-scripts/issues/36/comments"},"review_comments":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36/comments"},"review_comment":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zaproxy/community-scripts/pulls/36/commits"},"statuses":{"href":"https://api.github.com/repos/zaproxy/community-scripts/statuses/22a8d680c7a74a2a775c192628a11aa35258b791"}}}}