{"action":"created","comment":{"url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments/81543318","pull_request_review_id":2515207,"id":81543318,"diff_hunk":"@@ -183,6 +183,10 @@ pscanalpha.contentsecuritypolicymissing.refs=https://developer.mozilla.org/en-US\n pscanalpha.contentsecuritypolicymissing.soln=Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: \"Content-Security-Policy\" for Chrome 25+, Firefox 23+ and Safari 7+, \"X-Content-Security-Policy\" for Firefox 4.0+ and Internet Explorer 10+, and \"X-WebKit-CSP\" for Chrome 14+ and Safari 6+.\n pscanalpha.contentsecuritypolicymissing.exploit=\n pscanalpha.contentsecuritypolicymissing.extrainfo=\n+pscanalpha.contentsecuritypolicymissing.ro.name=Content Security Policy (CSP) Report-Only Header Found\n+pscanalpha.contentsecuritypolicymissing.ro.desc=The response contained a Content-Security-Policy-Report-Only header, this may indicate a work-in-progress implementation, or an oversight in promoting pre-Prod to Prod, etc.\\n\\nContent Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page \\u2014 covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.\n+pscanalpha.contentsecuritypolicymissing.ro.refs=https://www.w3.org/TR/CSP2/\\nhttps://w3c.github.io/webappsec-csp/\\nhttp://caniuse.com/#feat=contentsecuritypolicy\\nhttp://content-security-policy.com/\n+pscanalpha.contentsecuritypolicymissing.ro.soln=Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: \"Content-Security-Policy\" for Chrome 25+, Firefox 23+ and Safari 7+, \"X-Content-Security-Policy\" for Firefox 4.0+ and Internet Explorer 10+, and \"X-WebKit-CSP\" for Chrome 14+ and Safari 6+.","path":"src/org/zaproxy/zap/extension/pscanrulesAlpha/resources/Messages.properties","position":7,"original_position":7,"commit_id":"a8ae6aaecf07cb67454ad532b9ecd3bc3dac54b0","original_commit_id":"a8ae6aaecf07cb67454ad532b9ecd3bc3dac54b0","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"body":"Done","created_at":"2016-10-03T12:50:52Z","updated_at":"2016-10-03T12:50:52Z","html_url":"https://github.com/zaproxy/zap-extensions/pull/553#discussion_r81543318","pull_request_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553","_links":{"self":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments/81543318"},"html":{"href":"https://github.com/zaproxy/zap-extensions/pull/553#discussion_r81543318"},"pull_request":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553"}}},"pull_request":{"url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553","id":85898750,"html_url":"https://github.com/zaproxy/zap-extensions/pull/553","diff_url":"https://github.com/zaproxy/zap-extensions/pull/553.diff","patch_url":"https://github.com/zaproxy/zap-extensions/pull/553.patch","issue_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/553","number":553,"state":"open","locked":false,"title":"CSP Passive Scanner Add Report-Only Support","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"body":"Add support to the existing CSP passive scanner for the\r\nContent-Security-Policy-Report-Only header. As discussed here\r\nhttps://github.com/zaproxy/zaproxy/issues/527#issuecomment-246662015\r\n\r\nInclude updated Messages.properties and help entries to support the new\r\ncheck.","created_at":"2016-09-20T01:51:42Z","updated_at":"2016-10-03T12:50:52Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e253f61da294c9bc0404728a78ee90e47288f0ce","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553/commits","review_comments_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553/comments","review_comment_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments{/number}","comments_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/553/comments","statuses_url":"https://api.github.com/repos/zaproxy/zap-extensions/statuses/a8ae6aaecf07cb67454ad532b9ecd3bc3dac54b0","head":{"label":"kingthorin:csp-scanner-cspro-support","ref":"csp-scanner-cspro-support","sha":"a8ae6aaecf07cb67454ad532b9ecd3bc3dac54b0","user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"repo":{"id":39949063,"name":"zap-extensions","full_name":"kingthorin/zap-extensions","owner":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kingthorin/zap-extensions","description":"OWASP ZAP Add-ons","fork":true,"url":"https://api.github.com/repos/kingthorin/zap-extensions","forks_url":"https://api.github.com/repos/kingthorin/zap-extensions/forks","keys_url":"https://api.github.com/repos/kingthorin/zap-extensions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kingthorin/zap-extensions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kingthorin/zap-extensions/teams","hooks_url":"https://api.github.com/repos/kingthorin/zap-extensions/hooks","issue_events_url":"https://api.github.com/repos/kingthorin/zap-extensions/issues/events{/number}","events_url":"https://api.github.com/repos/kingthorin/zap-extensions/events","assignees_url":"https://api.github.com/repos/kingthorin/zap-extensions/assignees{/user}","branches_url":"https://api.github.com/repos/kingthorin/zap-extensions/branches{/branch}","tags_url":"https://api.github.com/repos/kingthorin/zap-extensions/tags","blobs_url":"https://api.github.com/repos/kingthorin/zap-extensions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kingthorin/zap-extensions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kingthorin/zap-extensions/git/refs{/sha}","trees_url":"https://api.github.com/repos/kingthorin/zap-extensions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kingthorin/zap-extensions/statuses/{sha}","languages_url":"https://api.github.com/repos/kingthorin/zap-extensions/languages","stargazers_url":"https://api.github.com/repos/kingthorin/zap-extensions/stargazers","contributors_url":"https://api.github.com/repos/kingthorin/zap-extensions/contributors","subscribers_url":"https://api.github.com/repos/kingthorin/zap-extensions/subscribers","subscription_url":"https://api.github.com/repos/kingthorin/zap-extensions/subscription","commits_url":"https://api.github.com/repos/kingthorin/zap-extensions/commits{/sha}","git_commits_url":"https://api.github.com/repos/kingthorin/zap-extensions/git/commits{/sha}","comments_url":"https://api.github.com/repos/kingthorin/zap-extensions/comments{/number}","issue_comment_url":"https://api.github.com/repos/kingthorin/zap-extensions/issues/comments{/number}","contents_url":"https://api.github.com/repos/kingthorin/zap-extensions/contents/{+path}","compare_url":"https://api.github.com/repos/kingthorin/zap-extensions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kingthorin/zap-extensions/merges","archive_url":"https://api.github.com/repos/kingthorin/zap-extensions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kingthorin/zap-extensions/downloads","issues_url":"https://api.github.com/repos/kingthorin/zap-extensions/issues{/number}","pulls_url":"https://api.github.com/repos/kingthorin/zap-extensions/pulls{/number}","milestones_url":"https://api.github.com/repos/kingthorin/zap-extensions/milestones{/number}","notifications_url":"https://api.github.com/repos/kingthorin/zap-extensions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kingthorin/zap-extensions/labels{/name}","releases_url":"https://api.github.com/repos/kingthorin/zap-extensions/releases{/id}","deployments_url":"https://api.github.com/repos/kingthorin/zap-extensions/deployments","created_at":"2015-07-30T12:21:23Z","updated_at":"2016-01-11T13:07:02Z","pushed_at":"2016-09-26T10:37:31Z","git_url":"git://github.com/kingthorin/zap-extensions.git","ssh_url":"git@github.com:kingthorin/zap-extensions.git","clone_url":"https://github.com/kingthorin/zap-extensions.git","svn_url":"https://github.com/kingthorin/zap-extensions","homepage":"","size":691941,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"zaproxy:alpha","ref":"alpha","sha":"0727f3127be9be1e382f638aef033a9b4d0c16de","user":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"repo":{"id":35210580,"name":"zap-extensions","full_name":"zaproxy/zap-extensions","owner":{"login":"zaproxy","id":6716868,"avatar_url":"https://avatars.githubusercontent.com/u/6716868?v=3","gravatar_id":"","url":"https://api.github.com/users/zaproxy","html_url":"https://github.com/zaproxy","followers_url":"https://api.github.com/users/zaproxy/followers","following_url":"https://api.github.com/users/zaproxy/following{/other_user}","gists_url":"https://api.github.com/users/zaproxy/gists{/gist_id}","starred_url":"https://api.github.com/users/zaproxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zaproxy/subscriptions","organizations_url":"https://api.github.com/users/zaproxy/orgs","repos_url":"https://api.github.com/users/zaproxy/repos","events_url":"https://api.github.com/users/zaproxy/events{/privacy}","received_events_url":"https://api.github.com/users/zaproxy/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/zaproxy/zap-extensions","description":"OWASP ZAP Add-ons","fork":false,"url":"https://api.github.com/repos/zaproxy/zap-extensions","forks_url":"https://api.github.com/repos/zaproxy/zap-extensions/forks","keys_url":"https://api.github.com/repos/zaproxy/zap-extensions/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zaproxy/zap-extensions/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zaproxy/zap-extensions/teams","hooks_url":"https://api.github.com/repos/zaproxy/zap-extensions/hooks","issue_events_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/events{/number}","events_url":"https://api.github.com/repos/zaproxy/zap-extensions/events","assignees_url":"https://api.github.com/repos/zaproxy/zap-extensions/assignees{/user}","branches_url":"https://api.github.com/repos/zaproxy/zap-extensions/branches{/branch}","tags_url":"https://api.github.com/repos/zaproxy/zap-extensions/tags","blobs_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/refs{/sha}","trees_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zaproxy/zap-extensions/statuses/{sha}","languages_url":"https://api.github.com/repos/zaproxy/zap-extensions/languages","stargazers_url":"https://api.github.com/repos/zaproxy/zap-extensions/stargazers","contributors_url":"https://api.github.com/repos/zaproxy/zap-extensions/contributors","subscribers_url":"https://api.github.com/repos/zaproxy/zap-extensions/subscribers","subscription_url":"https://api.github.com/repos/zaproxy/zap-extensions/subscription","commits_url":"https://api.github.com/repos/zaproxy/zap-extensions/commits{/sha}","git_commits_url":"https://api.github.com/repos/zaproxy/zap-extensions/git/commits{/sha}","comments_url":"https://api.github.com/repos/zaproxy/zap-extensions/comments{/number}","issue_comment_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues/comments{/number}","contents_url":"https://api.github.com/repos/zaproxy/zap-extensions/contents/{+path}","compare_url":"https://api.github.com/repos/zaproxy/zap-extensions/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zaproxy/zap-extensions/merges","archive_url":"https://api.github.com/repos/zaproxy/zap-extensions/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zaproxy/zap-extensions/downloads","issues_url":"https://api.github.com/repos/zaproxy/zap-extensions/issues{/number}","pulls_url":"https://api.github.com/repos/zaproxy/zap-extensions/pulls{/number}","milestones_url":"https://api.github.com/repos/zaproxy/zap-extensions/milestones{/number}","notifications_url":"https://api.github.com/repos/zaproxy/zap-extensions/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zaproxy/zap-extensions/labels{/name}","releases_url":"https://api.github.com/repos/zaproxy/zap-extensions/releases{/id}","deployments_url":"https://api.github.com/repos/zaproxy/zap-extensions/deployments","created_at":"2015-05-07T09:17:13Z","updated_at":"2016-10-03T08:03:07Z","pushed_at":"2016-10-03T09:34:52Z","git_url":"git://github.com/zaproxy/zap-extensions.git","ssh_url":"git@github.com:zaproxy/zap-extensions.git","clone_url":"https://github.com/zaproxy/zap-extensions.git","svn_url":"https://github.com/zaproxy/zap-extensions","homepage":"","size":712442,"stargazers_count":90,"watchers_count":90,"language":"HTML","has_issues":false,"has_downloads":false,"has_wiki":true,"has_pages":false,"forks_count":112,"mirror_url":null,"open_issues_count":14,"forks":112,"open_issues":14,"watchers":90,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553"},"html":{"href":"https://github.com/zaproxy/zap-extensions/pull/553"},"issue":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/issues/553"},"comments":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/issues/553/comments"},"review_comments":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553/comments"},"review_comment":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/pulls/553/commits"},"statuses":{"href":"https://api.github.com/repos/zaproxy/zap-extensions/statuses/a8ae6aaecf07cb67454ad532b9ecd3bc3dac54b0"}}}}
{"actor":{"display_login":"kingthorin"}}