title: False positive SQL Injection by ZAP in Spring MVC
body: <p>I have a spring-mvc web application which is "Active scanned" by ZAP tool. It has two High medium alert for SQL Injection which I believe is a false positive. </p>
  
  <ol>
  <li>The original URL is <code>/msg/showList?</code> which returns 200OK and json list of message. ZAP while running scan, adds a parameter <code>/deliverymsg/showList?query=query+AND+1%3D1+--+</code> which also returns 200 OK and json list of message. There is no change in response, the list is same. The application doesn't read the param "query" added by ZAP, so there is no actual SQL Injection here. 
  But ZAP alerts this as HIGH Medium.</li>
  <li>The original URL is <code>/filterlist?fromDate=&amp;toDate=&amp;_csrf=1534403682524</code> that returns 200Ok and list , ZAP is scanning and adds the condition for SQL injection <code>/filterlist?fromDate=&amp;toDate=&amp;_csrf=1534403682524+AND+1%3D1+--+</code>
  This parameter is csrf token added by spring-boot implicitly, again not actually read by application directly. But ZAP alerts this as High Medium again. </li>
  </ol>
  
  <p>I want to understand how ZAP is working here, and how to fix this false positive so ZAP doesn't alert. I have had cases in past, where I changed the application code to pass the test. But unable to think a clear solution for this. </p>
  
  <p>Am thinking of adding <code>HandlerInterceptor</code> and check request param for any "AND" word and return HTTP400, I do not want to do it, coz it will be just to fool ZAP in not alerting HIGH. 
  I understand I can also give evidence of false positive and release this without fixing, but I cannot do that due to internal policies. </p>
  
  <p>Am running ZAP in whatever default configuration it comes with. </p>
  
  <p>Update: </p>
  
  <p>I added <code>HandlerInterceptor</code> and rejected request having <code>AND</code> or <code>query</code> and so far re-running the ZAP for only the reported URL's didnt produce any alert. I wonder why is that? Because the URL's created by ZAP to attack has many more sql keywords like <code>UNION ALL</code> etc. I have only rejected request for two keywords.How could that solve the problem? </p>
  
  <p>Why does ZAP appends it's own parameter <code>query</code> which application will never read, I dont understand the logic behind attacking with <code>query</code>.</p>