{"action":"created","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4846","repository_url":"https://api.github.com/repos/zaproxy/zaproxy","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4846/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4846/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4846/events","html_url":"https://github.com/zaproxy/zaproxy/issues/4846","id":341552667,"node_id":"MDU6SXNzdWUzNDE1NTI2Njc=","number":4846,"title":"User-Agent changes from configured value","user":{"login":"leoppp","id":23527218,"node_id":"MDQ6VXNlcjIzNTI3MjE4","avatar_url":"https://avatars0.githubusercontent.com/u/23527218?v=4","gravatar_id":"","url":"https://api.github.com/users/leoppp","html_url":"https://github.com/leoppp","followers_url":"https://api.github.com/users/leoppp/followers","following_url":"https://api.github.com/users/leoppp/following{/other_user}","gists_url":"https://api.github.com/users/leoppp/gists{/gist_id}","starred_url":"https://api.github.com/users/leoppp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leoppp/subscriptions","organizations_url":"https://api.github.com/users/leoppp/orgs","repos_url":"https://api.github.com/users/leoppp/repos","events_url":"https://api.github.com/users/leoppp/events{/privacy}","received_events_url":"https://api.github.com/users/leoppp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-07-16T14:53:17Z","updated_at":"2018-08-01T23:48:47Z","closed_at":null,"author_association":"NONE","body":"When using the ZAP gui I found that in certain circumstances the default user agent defined in tools-options-connection was not used. Instead an older user agent was used.\r\n\r\nTo reproduce, set value to 'Firefox 39.0 Win8.1 64-bit' and attack a URL.\r\n\r\nExpected behaviour is that all pages will be attacked with the same user agent that has been set as above.\r\n\r\nRequest for alert \"Content-Security-Policy (CSP) Header Not Set\":\r\n![image](https://user-images.githubusercontent.com/23527218/42765149-4558f92c-890f-11e8-8ab3-dfb3c156193e.png)\r\n\r\nResponse - note CSP is set. I believe the X-CSP header is set as a result of the IE6 user agent as it normally appears as CSP without the X:\r\n![image](https://user-images.githubusercontent.com/23527218/42765449-fa1dd9c2-890f-11e8-8d61-3403080c50a4.png)\r\n\r\n\r\nRequest for alert \"Timestamp Disclosure - Unix\":\r\n![image](https://user-images.githubusercontent.com/23527218/42765254-806c528e-890f-11e8-9e38-3115e3cff149.png)\r\n\r\nOWASP ZAP Version 2.7.0 on Linux (Kali) and Windows 10 64-bit\r\n"},"comment":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/comments/409760908","html_url":"https://github.com/zaproxy/zaproxy/issues/4846#issuecomment-409760908","issue_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4846","id":409760908,"node_id":"MDEyOklzc3VlQ29tbWVudDQwOTc2MDkwOA==","user":{"login":"thc202","id":4639210,"node_id":"MDQ6VXNlcjQ2MzkyMTA=","avatar_url":"https://avatars0.githubusercontent.com/u/4639210?v=4","gravatar_id":"","url":"https://api.github.com/users/thc202","html_url":"https://github.com/thc202","followers_url":"https://api.github.com/users/thc202/followers","following_url":"https://api.github.com/users/thc202/following{/other_user}","gists_url":"https://api.github.com/users/thc202/gists{/gist_id}","starred_url":"https://api.github.com/users/thc202/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thc202/subscriptions","organizations_url":"https://api.github.com/users/thc202/orgs","repos_url":"https://api.github.com/users/thc202/repos","events_url":"https://api.github.com/users/thc202/events{/privacy}","received_events_url":"https://api.github.com/users/thc202/received_events","type":"User","site_admin":false},"created_at":"2018-08-01T23:48:47Z","updated_at":"2018-08-01T23:48:47Z","author_association":"MEMBER","body":"Yes, seems to be a bug, in theory all components should be already using the configured user agent when creating default messages. Do you still have the session around? It would be great to know the type of that message."}}
{"actor":{"display_login":"thc202"}}