ZAP flagging False Positive Sub resource Integrity missing

[Mustafizur Rahman]

Hi,

I have run ZAP on my websites and it flags the following SRI missing risk.

• <script src='https://www.google.com/recaptcha/api.js'></script>

Isn't it a False Positive as we can't add integrity attribute to these kind of dynamic scripts owned by Google?
Also, how do you manage these type of security flags for PCI compliance?

[Simon Bennetts]

As per https://www.zaproxy.org/docs/alerts/90003/

"The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content."

It is not a false positive as the integrity attribute really is missing :P

The fact that you cannot add an integrity attribute is a different problem.

A simple workaround is to define Google as a trusted domain: https://www.zaproxy.org/docs/desktop/ui/dialogs/options/ruleconfig/

I don't have to deal with PCI compliance, so can't answer that question :D

Cheers,

Simon

[Mustafizur Rahman]

Thank you for the response.

I will use the simple workaround then.