{"action":"created","comment":{"url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments/55816356","id":55816356,"diff_hunk":"@@ -0,0 +1,156 @@\n+/*\n+ * Zed Attack Proxy (ZAP) and its related class files.\n+ *\n+ * ZAP is an HTTP/HTTPS proxy for assessing web application security.\n+ * \n+ * Copyright 2014 The ZAP Development Team\n+ *  \n+ * Licensed under the Apache License, Version 2.0 (the \"License\");\n+ * you may not use this file except in compliance with the License.\n+ * You may obtain a copy of the License at\n+ *\n+ *   http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing, software\n+ * distributed under the License is distributed on an \"AS IS\" BASIS,\n+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+ * See the License for the specific language governing permissions and\n+ * limitations under the License.\n+ */\n+package org.zaproxy.zap.extension.ascanrulesAlpha;\n+\n+import org.apache.commons.httpclient.URIException;\n+import org.apache.log4j.Logger;\n+import org.parosproxy.paros.core.scanner.AbstractHostPlugin;\n+import org.parosproxy.paros.core.scanner.Alert;\n+import org.parosproxy.paros.core.scanner.Category;\n+import org.parosproxy.paros.network.HttpMessage;\n+import org.parosproxy.paros.network.HttpStatusCode;\n+import org.parosproxy.paros.Constant;\n+\n+import java.io.IOException;\n+\n+/**\n+ * Active scan rule which raises an alert if a site accessed via HTTP is also available under HTTPS \n+ * https://github.com/zaproxy/zaproxy/issues/2207\n+ * @author sanchitlucknow@gmail.com\n+ */\n+public class HttpOnlySite extends AbstractHostPlugin {\n+\n+\t/**\n+\t * Prefix for internationalised messages used by this rule\n+\t */\n+\tprivate static final String MESSAGE_PREFIX = \"ascanalpha.httponlysite.\";\n+\tprivate static final int PLUGIN_ID = 10147;","path":"src/org/zaproxy/zap/extension/ascanrulesAlpha/HttpOnlySite.java","position":44,"original_position":44,"commit_id":"3ade6da7c1342a7c57719ed063df37000adca520","original_commit_id":"3ade6da7c1342a7c57719ed063df37000adca520","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"body":"You'll need to reserve a unique plugin ID in alerts.xml\r\nhttps://github.com/zaproxy/zaproxy/blob/c05f6130fd889f3df9e734f33166b375adbef539/src/doc/alerts.xml#L96\r\nI suggest 10053.","created_at":"2016-03-11T10:59:05Z","updated_at":"2016-03-11T10:59:05Z","html_url":"https://github.com/zaproxy/zap-extensions/pull/277#discussion_r55816356","pull_request_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277","_links":{"self":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments/55816356"},"html":{"href":"https://github.com/zaproxy/zap-extensions/pull/277#discussion_r55816356"},"pull_request":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277"}}},"pull_request":{"url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277","id":62519334,"html_url":"https://github.com/zaproxy/zap-extensions/pull/277","diff_url":"https://github.com/zaproxy/zap-extensions/pull/277.diff","patch_url":"https://github.com/zaproxy/zap-extensions/pull/277.patch","issue_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/277","number":277,"state":"open","locked":false,"title":"A new Active Scan rule HttpOnlySite.","user":{"login":"DarkPrince304","id":9005407,"avatar_url":"https://avatars.githubusercontent.com/u/9005407?v=3","gravatar_id":"","url":"https://api.github.com/users/DarkPrince304","html_url":"https://github.com/DarkPrince304","followers_url":"https://api.github.com/users/DarkPrince304/followers","following_url":"https://api.github.com/users/DarkPrince304/following{/other_user}","gists_url":"https://api.github.com/users/DarkPrince304/gists{/gist_id}","starred_url":"https://api.github.com/users/DarkPrince304/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DarkPrince304/subscriptions","organizations_url":"https://api.github.com/users/DarkPrince304/orgs","repos_url":"https://api.github.com/users/DarkPrince304/repos","events_url":"https://api.github.com/users/DarkPrince304/events{/privacy}","received_events_url":"https://api.github.com/users/DarkPrince304/received_events","type":"User","site_admin":false},"body":"Hello,\r\n\r\nAccording to the issue zaproxy/zaproxy#2207 the original idea of this issue was to raise alerts on all http sites whether or not https was available\r\nBut the other rule already raises alerts if http versions of https sites are available\r\nSo we thought that it might make sense to just raise alerts if https is _not_ available.\r\nI have implemented this Active Scan rule which raises an alert if a site is only served under HTTP and not HTTPS. The work is still under progress so I would like to hear your feedback @thc202 , @kingthorin , @psiinon . Here is the TODO:\r\n\r\n- PLUGIN_ID\r\n- CATEGORY\r\n- RISK\r\n- CONFIDENCE\r\n- CWE\r\n- WASC\r\n- Attack Parameter in the Alert\r\n- Description\r\n- References\r\n- Solution\r\n- Testing any other case if needed.\r\n\r\nWhen all is done I'll remove the unneeded statements (like System.out.println) and make it ready to get merged.\r\n\r\nThanks :smile: ","created_at":"2016-03-11T09:48:54Z","updated_at":"2016-03-11T10:59:05Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5be484d621e96fb0fd824b73a668464a515eb4e3","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277/commits","review_comments_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277/comments","review_comment_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/277/comments","statuses_url":"https://api.github.com/repos/zaproxy/zap-extensions/statuses/3ade6da7c1342a7c57719ed063df37000adca520","head":{"label":"DarkPrince304:HttpOnlySite","ref":"HttpOnlySite","sha":"3ade6da7c1342a7c57719ed063df37000adca520","user":{"login":"DarkPrince304","id":9005407,"avatar_url":"https://avatars.githubusercontent.com/u/9005407?v=3","gravatar_id":"","url":"https://api.github.com/users/DarkPrince304","html_url":"https://github.com/DarkPrince304","followers_url":"https://api.github.com/users/DarkPrince304/followers","following_url":"https://api.github.com/users/DarkPrince304/following{/other_user}","gists_url":"https://api.github.com/users/DarkPrince304/gists{/gist_id}","starred_url":"https://api.github.com/users/DarkPrince304/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DarkPrince304/subscriptions","organizations_url":"https://api.github.com/users/DarkPrince304/orgs","repos_url":"https://api.github.com/users/DarkPrince304/repos","events_url":"https://api.github.com/users/DarkPrince304/events{/privacy}","received_events_url":"https://api.github.com/users/DarkPrince304/received_events","type":"User","site_admin":false},"repo":{"id":53202061,"name":"zap-extensions","full_name":"DarkPrince304/zap-extensions","owner":{"login":"DarkPrince304","id":9005407,"avatar_url":"https://avatars.githubusercontent.com/u/9005407?v=3","gravatar_id":"","url":"https://api.github.com/users/DarkPrince304","html_url":"https://github.com/DarkPrince304","followers_url":"https://api.github.com/users/DarkPrince304/followers","following_url":"https://api.github.com/users/DarkPrince304/following{/other_user}","gists_url":"https://api.github.com/users/DarkPrince304/gists{/gist_id}","starred_url":"https://api.github.com/users/DarkPrince304/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DarkPrince304/subscriptions","organizations_url":"https://api.github.com/users/DarkPrince304/orgs","repos_url":"https://api.github.com/users/DarkPrince304/repos","events_url":"https://api.github.com/users/DarkPrince304/events{/privacy}","received_events_url":"https://api.github.com/users/DarkPrince304/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/DarkPrince304/zap-extensions","description":"OWASP ZAP Add-ons","fork":true,"url":"https://api.github.com/repos/DarkPrince304/zap-extensions","forks_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/forks","keys_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/teams","hooks_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/hooks","issue_events_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/issues/events{/number}","events_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/events","assignees_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/assignees{/user}","branches_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/branches{/branch}","tags_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/tags","blobs_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/git/refs{/sha}","trees_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/statuses/{sha}","languages_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/languages","stargazers_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/stargazers","contributors_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/contributors","subscribers_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/subscribers","subscription_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/subscription","commits_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/commits{/sha}","git_commits_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/git/commits{/sha}","comments_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/comments{/number}","issue_comment_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/issues/comments{/number}","contents_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/contents/{+path}","compare_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/merges","archive_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/downloads","issues_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/issues{/number}","pulls_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/pulls{/number}","milestones_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/milestones{/number}","notifications_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/labels{/name}","releases_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/releases{/id}","deployments_url":"https://api.github.com/repos/DarkPrince304/zap-extensions/deployments","created_at":"2016-03-05T13:15:28Z","updated_at":"2016-03-05T13:15:39Z","pushed_at":"2016-03-11T09:53:41Z","git_url":"git://github.com/DarkPrince304/zap-extensions.git","ssh_url":"git@github.com:DarkPrince304/zap-extensions.git","clone_url":"https://github.com/DarkPrince304/zap-extensions.git","svn_url":"https://github.com/DarkPrince304/zap-extensions","homepage":"","size":617775,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zaproxy:alpha","ref":"alpha","sha":"cea515f151b6a5a003a3dc70b174d339405d573e","user":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"repo":{"id":35210580,"name":"zap-extensions","full_name":"zaproxy/zap-extensions","owner":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zaproxy/zap-extensions","description":"OWASP ZAP Add-ons","fork":false,"url":"https://api.github.com/repos/zaproxy/zap-extensions","forks_url":"https://api.github.com/repos/zaproxy/zap-extensions/forks","keys_url":"https://api.github.com/repos/zaproxy/zap-extensions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zaproxy/zap-extensions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zaproxy/zap-extensions/teams","hooks_url":"https://api.github.com/repos/zaproxy/zap-extensions/hooks","issue_events_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/events{/number}","events_url":"https://api.github.com/repos/zaproxy/zap-extensions/events","assignees_url":"https://api.github.com/repos/zaproxy/zap-extensions/assignees{/user}","branches_url":"https://api.github.com/repos/zaproxy/zap-extensions/branches{/branch}","tags_url":"https://api.github.com/repos/zaproxy/zap-extensions/tags","blobs_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/refs{/sha}","trees_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zaproxy/zap-extensions/statuses/{sha}","languages_url":"https://api.github.com/repos/zaproxy/zap-extensions/languages","stargazers_url":"https://api.github.com/repos/zaproxy/zap-extensions/stargazers","contributors_url":"https://api.github.com/repos/zaproxy/zap-extensions/contributors","subscribers_url":"https://api.github.com/repos/zaproxy/zap-extensions/subscribers","subscription_url":"https://api.github.com/repos/zaproxy/zap-extensions/subscription","commits_url":"https://api.github.com/repos/zaproxy/zap-extensions/commits{/sha}","git_commits_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/commits{/sha}","comments_url":"https://api.github.com/repos/zaproxy/zap-extensions/comments{/number}","issue_comment_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/comments{/number}","contents_url":"https://api.github.com/repos/zaproxy/zap-extensions/contents/{+path}","compare_url":"https://api.github.com/repos/zaproxy/zap-extensions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zaproxy/zap-extensions/merges","archive_url":"https://api.github.com/repos/zaproxy/zap-extensions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zaproxy/zap-extensions/downloads","issues_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues{/number}","pulls_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls{/number}","milestones_url":"https://api.github.com/repos/zaproxy/zap-extensions/milestones{/number}","notifications_url":"https://api.github.com/repos/zaproxy/zap-extensions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zaproxy/zap-extensions/labels{/name}","releases_url":"https://api.github.com/repos/zaproxy/zap-extensions/releases{/id}","deployments_url":"https://api.github.com/repos/zaproxy/zap-extensions/deployments","created_at":"2015-05-07T09:17:13Z","updated_at":"2016-02-25T16:09:13Z","pushed_at":"2016-03-11T09:53:41Z","git_url":"git://github.com/zaproxy/zap-extensions.git","ssh_url":"git@github.com:zaproxy/zap-extensions.git","clone_url":"https://github.com/zaproxy/zap-extensions.git","svn_url":"https://github.com/zaproxy/zap-extensions","homepage":"","size":637408,"stargazers_count":50,"watchers_count":50,"language":"HTML","has_issues":false,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":68,"mirror_url":null,"open_issues_count":5,"forks":68,"open_issues":5,"watchers":50,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277"},"html":{"href":"https://github.com/zaproxy/zap-extensions/pull/277"},"issue":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/issues/277"},"comments":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/issues/277/comments"},"review_comments":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277/comments"},"review_comment":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/277/commits"},"statuses":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/statuses/3ade6da7c1342a7c57719ed063df37000adca520"}}}}