pscanrules: Update CSRF countermeasures rule to consider only html files

[gustavocovas]

Overview

Updated the passive scan CRSF countermeasures rule to consider only HTML files, as discussed in zaproxy/zaproxy#7890

I know that it is currently assigned for @FiveOFive, but I saw this as an opportunity for my first contribution (hope that it is ok)

Related Issues

zaproxy/zaproxy#7890

Checklist

• Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

For more details, please refer to the developer rules and guidelines.

[thc202]

There should be a test showing that non-HTML does not raise an alert. The help should be updated to mention that non-HTML content will not be checked.

It's better to ask first in the issue when it's already assigned to avoid duplicating efforts.

[kingthorin]

I'm not sure this is the right approach because csrf on image, pdf, csv, Excel, etc is a potential DoS issue. I'd rather it simply exclude js and css.

[gustavocovas]

I'm not sure this is the right approach because csrf on image, pdf, csv, Excel, etc is a potential DoS issue. I'd rather it simply exclude js and css.

My understanding is that the rule is specific for HTML forms, so the concern here would be about embedded HTML forms in those types of responses? If so, should we make the same change to the active CSRF rule?

[kingthorin]

You're right. I was thinking "response" but it's the response to the POST (or whatever) that I'm concerned about not the actual response that contains the form in question. So yes you're correct. Sorry.

[gustavocovas]

No worries. And thanks to both of you for the quick reviews and responses. What an awesome project and team 😄
I will now work on the changes requested

[kingthorin]

To address the DCO requirement you'll need to sign-off the commit(s):

• https://github.com/zaproxy/zaproxy/blob/main/CONTRIBUTING.md#developer-certificate-of-origin
• https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---signoff

[gustavocovas]

Folks, I believe I addressed all the comments. Should I squash the commits?

[thc202]

This needs to be rebased and the changelog entry added to the latest Unreleased section.

[kingthorin]

To address the DCO requirement you'll need to sign-off the commit(s):

• https://github.com/zaproxy/zaproxy/blob/main/CONTRIBUTING.md#developer-certificate-of-origin
• https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---signoff

[thc202]

Thank you!

[kingthorin]

Thanks!

[thc202]

@gustavocovas how would you like to be credited (e.g. name, handle)?
https://www.zaproxy.org/docs/desktop/credits/#zap-extended-team

[gustavocovas]

It can be "Gustavo Covas (@gustavocovas)"
Thanks

[kingthorin]

Thanks, I'll tackle that Monday morning.