Merge pull request #476 from ricekot/ssti-js-missing-var

Add missing variable declaration in active/SSTI.js
zaproxy · Dec 31, 2024 · 6e762aa · 6e762aa
2 parents f1abd14 + 5e3ebae
commit 6e762aa
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,12 +8,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Standalone script 'PrivateMethodAccess.js'
 - Variant script 'AddUrlParams.js'
 - Extender script 'ScanMonitor.js'
+
 ### Changed
 - Add cautionary note to help and readme.
 - Maintenance and documentation changes.
 
 ### Fixed 
-- Bug in 'Mutliple Security Header Check.js'.
+- The following scripts were not being loaded as scan rules:
+  - active/SSTI.js
+  - passive/Mutliple Security Header Check.js
 
 ## [19] - 2024-07-01
 ### Added

diff --git a/active/SSTI.js b/active/SSTI.js
@@ -14,6 +14,7 @@ var log = LoggerManager.getLogger("SSTI");
 var ScanRuleMetadata = Java.type(
   "org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata"
 );
+var CommonAlertTag = Java.type("org.zaproxy.addon.commonlib.CommonAlertTag");
 
 function getMetadata() {
   return ScanRuleMetadata.fromYaml(`