AJAX Spider fails to start browser with ClassCastException

[Ben G]

Hi,

I run the ZAP stable Docker image (2.17.0, digest: sha256:8770b23f9e8b49038f413cb2b10c58c901e5b6717be221a22b1bcab5c9771b8a) in a Gitlab CI environment (Amazon Linux EC2 instance running Docker).

When I use the command `./zap-baseline.py -t <BASE_URL> -d -j -r zap_report.html -J zap_report.json -z "-config ajaxSpider.numberOfBrowsers=2"` the AJAX spider regularly fails with:

1) [Guice/ErrorInCustomProvider]: ClassCastException: class Boolean cannot be cast to class String (Boolean and String are in module java.base of loader 'bootstrap')

at ConfigurationModule.configure(ConfigurationModule.java:47)

\_ installed by: CoreModule -> ConfigurationModule

at CrawlerContext.<init>(CrawlerContext.java:33)

\_ for 1st parameter

at Crawler.<init>(Crawler.java:76)

\_ for 1st parameter

at CrawlTaskConsumer.<init>(CrawlTaskConsumer.java:27)

\_ for 3rd parameter

while locating CrawlTaskConsumer

This doesn't always seem to fail this way, but it is more common than not. After this point, sometimes the job will succeed regardless (with the AJAX spider finding 0 URL's), but often it causes the job to hang as it appears that the Crawljax threads are not stopped.

I do not provide a zap.yaml, so everything is default other than the command arguments.

I can provide a zap.log, but I don't seem to be able to attach it to this message. so please let me know how I can add it.

If anyone has any thoughts I would be super grateful

[Ben G]

This may or may not be related, but I have noticed that my `-z -config ajaxSpider.numberOfBrowsers=2` option doesn't actually seem to work while using the automation framework. I haven't deeply looked into it, but it seems like the AJAX Spider automation ignores my -config value and uses its own default if it's not specified in the automation plan.

[Simon Bennetts]

Strange, I have not seen that before.

You should not be using the config command line option for setting the number of browsers.

You should set them via the spiderAjax job: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/automation/

That will always take precedence.

Cheers,

Simon

[Ben G]

Thank you Simon,

Understood - I think I had made the (incorrect) assumption that if the generated zap.yaml did not have an option for numberOfBrowsers, that I could set it using `-config`.

RE: The strange ClassCastException, it seems to have improved by reducing the number of browsers. I can't say for sure that it's entirely gone because it was always intermittent, but I have not seen it on ~ 20 runs since reducing the number of browsers. My current theories are that it was either some sort of resource contention in the container causing the browser to misbehave, or a specific page which is no longer being reached by the spider due to having less instances.

Thanks again for your reply, it's very much appreciated

Ben