DOMParser() undefined while running JS own scripts

[KHUSHBOO KUMARI]

Hi everyone, Does ZAP support DOMParser() and require('fs') in javascript proxy scripting? I am getting error as DOMParser() undefined. I need it for parsing string containing serialised XML response i.e of format text/xml. How can I make it work in ZAP?

[Simon Bennetts]

ZAP Proxy scripts run in ZAP rather than in a browser. This means that browser features such as DOMParser are not available.

However you do have access to all of the functionality available within ZAP, and that includes an XML parser :)

Theres an example in the core here: https://github.com/zaproxy/zaproxy/blob/main/zap/src/main/java/org/zaproxy/zap/spider/parser/SpiderSitemapXMLParser.java

And lots of examples of JavaScript calling java code in https://github.com/zaproxy/community-scripts

[KHUSHBOO KUMARI]

I don't exactly know how can I use java code like this https://github.com/zaproxy/zaproxy/blob/main/zap/src/main/java/org/zaproxy/zap/spider/parser/SpiderSitemapXMLParser.java in JavaScript proxy scripts. I explored other scripts but that just use public java function which is available in that script context.

[KHUSHBOO KUMARI]

Also, How can I add my own java file to use with Javascript file in ZAP? Because later after parsing text/xml I need to add/replicate some tag to the httpmessage response which is in form of text/xml. Please help if it can be done.

[thc...@gmail.com]

Hi.

You can use the Java classes directly from the script (refer to syntax
of the engine used).

Best regards.