Index-less arrays in the ZAP config file

[Jernej Rus]

Hello. ZAP config file allows me to define arrays, like so:

selenium.chromeArgs(0).arg.argument=--test-type

selenium.chromeArgs(1).arg.argument=--ignore-certificate-errors

selenium.chromeArgs(2).arg.argument=--start-maximized

selenium.chromeArgs(3).arg.argument=--silent-debugger-extension-api

selenium.chromeArgs(4).arg.argument=--no-default-browser-check

However, if I want to remove an in-between line e.g. --start-maximized, I have to correct the other indexes:

selenium.chromeArgs(0).arg.argument=--test-type

selenium.chromeArgs(1).arg.argument=--ignore-certificate-errors

selenium.chromeArgs(2).arg.argument=--silent-debugger-extension-api

selenium.chromeArgs(3).arg.argument=--no-default-browser-check

This can be cumbersome. Does ZAP config file allow omitting the indexes e.g. something like:

selenium.chromeArgs().arg.argument=--test-type

selenium.chromeArgs().arg.argument=--ignore-certificate-errors

selenium.chromeArgs().arg.argument=--silent-debugger-extension-api

selenium.chromeArgs().arg.argument=--no-default-browser-check

I played around with the config syntax, but I could not get it to work.

[Simon Bennetts]

Hiya,

Confession time - the config file option was a quick hack :/

It is not well documented, is hard to get right and gives no feedback if you get it wrong.

Its proved to be very problematic and we dont really recommend it any more.

What do we recommend?

The Automation Framework (AF) :D

https://www.zaproxy.org/docs/automate/automation-framework/

That is well documented and does (usually) give feedback when you get it wrong.

You will notice that it does not support all of the options that ZAP does.

Thats because we've focussed on the options that we think most people will want.

So if you find you ned to use an option that the AF does not yet support then let us know!

Cheers,

Simon

[Jernej Rus]

Thank you for your reply. I already use both Automation Framework and the config file. I try to minimize my usage of the config file, but some options are not available elsewhere: network.connection.timeoutInSecs, selenium.chromeArgs. Regarding my original question - what is the format of the config file? Because formats like PropertiesConfiguration support index-less arrays e.g. colors.pie = #FF0000, #00FF00, #0000FF. Like I said, I tried various syntaxes, but I could not get them to work.

[Simon Bennetts]

Thanks for the feedback - those look good ones for us to add.

Re your question, see https://www.zaproxy.org/faq/how-do-you-find-out-what-key-to-use-to-set-a-config-value-on-the-command-line/

[thc202]

Some more info, the version we are using of Commons Configuration is 1.x
not yet 2.x, we are also using XML/Hierarchical configuration.
https://commons.apache.org/proper/commons-configuration/userguide_v1.10/howto_xml.html#Hierarchical_properties

Best regards.

On 15/10/2025 09:39, Jernej Rus wrote:
> Thank you for your reply. I already use both Automation Framework and the
> config file. I try to minimize my usage of the config file, but some
> options are not available elsewhere: network.connection.timeoutInSecs,
> selenium.chromeArgs. Regarding my original question - what is the format of
> the config file? Because formats like PropertiesConfiguration

> <https://commons.apache.org/proper/commons-configuration/userguide/howto_properties.html> support

[Jernej Rus]

https://github.com/zaproxy/zaproxy/blob/fd57d29306a0c6433532d1397fbe68ef2e4dd9ed/zap/src/main/java/org/parosproxy/paros/CommandLine.java#L470

Looking at your source code, it unmarshals the config file to java.util.Properties, which does not permit duplicate keys, so the following cannot be done:

selenium.chromeArgs.arg.argument=--test-type

selenium.chromeArgs.arg.argument=--ignore-certificate-errors

selenium.chromeArgs.arg.argument=--silent-debugger-extension-api

selenium.chromeArgs.arg.argument=--no-default-browser-check

So maybe the syntax uses a delimiter like selenium.chromeArgs.arg.argument= --test-type, --ignore-certificate-errors, --silent-debugger-extension-api, --no-default-browser-check

But https://github.com/zaproxy/zaproxy/blob/fd57d29306a0c6433532d1397fbe68ef2e4dd9ed/zap/src/main/java/org/zaproxy/zap/utils/ZapXmlConfiguration.java#L57 disables delimiter parsing. I assume that the config is used to make config.xml?