How do I get OWASP ZAP ajax scan to run in Github Workflow?

user_1773592 0
Viewed 142

I have an OWASP Zap workflow which runs and I am trying to add the ajax scan by adding "-j", thus:

  uses: zaproxy/action-full-scan@v0.2.0
  with:
    target: "https://example.com/"
    cmd_options:
       # use the Ajax spider in addition to the traditional one
       "-j"

This runs, but I assumed there would be an additional report created (there isn't) and the only mention of ajax in the logs is:

WARNING: Illegal reflective access by com.google.inject.internal.cglib.core.$ReflectUtils$2 
(file:/root/.ZAP/plugin/spiderAjax-release-23.3.0.zap) to method 
java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int,java.security.ProtectionDomain)

Looks like a permission issue but I do not know how to get around it, or even if it is the problem.

zap owasp github-actions
1 Answers

Thats just a warning - you can ignore it. We are planning to fix that in due course.

ZAP will not generate an additional report if you use the Ajax Spider, but it is likely to include more info if the Ajax Spider finds more URLs.

user_15098340
Related