Active Rules scripts don't work :(

[Denis D]

Hi guys!

Is it a known bug or just my issue? I'm trying to create a script with some extra rules for active scanning, but it doesn't work. I tried JS, Python and even Zest, but the result is the same.

Passive rules scripts work well as well as the others, but Active rules scripts don't want to print any log info or change any data...

What I do wrong?

Thank you!

[Simon Bennetts]

I'm not aware of any problems with them.
Have a look in the Options / Active Scan Input Vectors screen - the "Enable Script Input Vectors" option needs be checked.
Thats probably the problem - let us know either way.

Cheers,

Simon

[Denis D]

Yes, it was checked, but no result, unfortunately :(

[Simon Bennetts]

Oh :(
You've enabled the individual scripts?
Any errors logged in the zap.log file?

[Denis D]

In Zest 2.3.1 I see following error message when UI is loading:

8723 [main] ERROR org.parosproxy.paros.extension.ExtensionLoader  - 

java.lang.NullPointerException

at org.zaproxy.zap.extension.script.ExtensionScript.loadTemplates(Unknown Source)

at org.zaproxy.zap.extension.script.ExtensionScript.loadTemplates(Unknown Source)

at org.zaproxy.zap.extension.script.ExtensionScript.optionsLoaded(Unknown Source)

at org.parosproxy.paros.extension.ExtensionLoader.hookAllExtension(Unknown Source)

at org.parosproxy.paros.extension.ExtensionLoader.startLifeCycle(Unknown Source)

at org.parosproxy.paros.control.AbstractControl.loadExtension(Unknown Source)

at org.parosproxy.paros.control.Control.init(Unknown Source)

at org.parosproxy.paros.control.Control.initSingletonWithView(Unknown Source)

at org.zaproxy.zap.ZAP.runGUI(Unknown Source)

at org.zaproxy.zap.ZAP.run(Unknown Source)

at org.zaproxy.zap.ZAP.main(Unknown Source)

9021 [main] ERROR org.parosproxy.paros.extension.ExtensionLoader  - 

java.lang.NullPointerException

at org.zaproxy.zap.extension.script.ExtensionScript.loadTemplates(Unknown Source)

at org.zaproxy.zap.extension.script.ExtensionScript.registerScriptEngineWrapper(Unknown Source)

at org.zaproxy.zap.extension.zest.ExtensionZest.hook(ExtensionZest.java:186)

at org.parosproxy.paros.extension.ExtensionLoader.hookAllExtension(Unknown Source)

at org.parosproxy.paros.extension.ExtensionLoader.startLifeCycle(Unknown Source)

at org.parosproxy.paros.control.AbstractControl.loadExtension(Unknown Source)

at org.parosproxy.paros.control.Control.init(Unknown Source)

at org.parosproxy.paros.control.Control.initSingletonWithView(Unknown Source)

at org.zaproxy.zap.ZAP.runGUI(Unknown Source)

at org.zaproxy.zap.ZAP.run(Unknown Source)

at org.zaproxy.zap.ZAP.main(Unknown Source)

9395 [main] ERROR org.parosproxy.paros.extension.ExtensionLoader  - 

java.lang.NullPointerException

at org.zaproxy.zap.extension.script.ExtensionScript.loadTemplates(Unknown Source)

at org.zaproxy.zap.extension.script.ExtensionScript.registerScriptEngineWrapper(Unknown Source)

at org.zaproxy.zap.extension.jython.ExtensionJython.hook(ExtensionJython.java:75)

at org.parosproxy.paros.extension.ExtensionLoader.hookAllExtension(Unknown Source)

at org.parosproxy.paros.extension.ExtensionLoader.startLifeCycle(Unknown Source)

at org.parosproxy.paros.control.AbstractControl.loadExtension(Unknown Source)

at org.parosproxy.paros.control.Control.init(Unknown Source)

at org.parosproxy.paros.control.Control.initSingletonWithView(Unknown Source)

at org.zaproxy.zap.ZAP.runGUI(Unknown Source)

at org.zaproxy.zap.ZAP.run(Unknown Source)

at org.zaproxy.zap.ZAP.main(Unknown Source)

In Zap Weekly, there is no errors when the UI is loading, but when I'm trying to save the script I get following:

467331 [AWT-EventQueue-0] ERROR org.zaproxy.zap.ZAP$UncaughtExceptionLogger  - Exception in thread "AWT-EventQueue-0"

java.lang.NullPointerException

at org.zaproxy.zap.extension.script.ScriptParam.saveScripts(ScriptParam.java:141)

at org.zaproxy.zap.extension.script.ExtensionScript.addScript(ExtensionScript.java:512)

at org.zaproxy.zap.extension.script.ExtensionScript.addScript(ExtensionScript.java:494)

at org.zaproxy.zap.extension.scripts.dialogs.NewScriptDialog.save(NewScriptDialog.java:214)

at org.zaproxy.zap.view.StandardFieldsDialog$2.actionPerformed(StandardFieldsDialog.java:304)

at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:2018)

at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2341)

at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:402)

at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:259)

at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:252)

at java.awt.Component.processMouseEvent(Component.java:6516)

at javax.swing.JComponent.processMouseEvent(JComponent.java:3312)

at java.awt.Component.processEvent(Component.java:6281)

at java.awt.Container.processEvent(Container.java:2229)

at java.awt.Component.dispatchEventImpl(Component.java:4872)

at java.awt.Container.dispatchEventImpl(Container.java:2287)

at java.awt.Component.dispatchEvent(Component.java:4698)

at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4832)

at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4492)

at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4422)

at java.awt.Container.dispatchEventImpl(Container.java:2273)

at java.awt.Window.dispatchEventImpl(Window.java:2719)

at java.awt.Component.dispatchEvent(Component.java:4698)

at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:740)

at java.awt.EventQueue.access$300(EventQueue.java:103)

at java.awt.EventQueue$3.run(EventQueue.java:699)

at java.awt.EventQueue$3.run(EventQueue.java:697)

at java.security.AccessController.doPrivileged(Native Method)

at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:76)

at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:87)

at java.awt.EventQueue$4.run(EventQueue.java:713)

at java.awt.EventQueue$4.run(EventQueue.java:711)

at java.security.AccessController.doPrivileged(Native Method)

at java.security.ProtectionDomain$1.doIntersectionPrivilege(ProtectionDomain.java:76)

at java.awt.EventQueue.dispatchEvent(EventQueue.java:710)

at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:242)

at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:161)

at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:150)

at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:146)

at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:138)

at java.awt.EventDispatchThread.run(EventDispatchThread.java:91)

[Simon Bennetts]

Can you try this with the latest weekly release?
I _think_ it should be fixed.
If not then we'll look at it asap.

Cheers,

Simon