diff --git a/site/content/docs/alerts/90005-1.md b/site/content/docs/alerts/90005-1.md new file mode 100644 index 000000000..c5219704b --- /dev/null +++ b/site/content/docs/alerts/90005-1.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-Site Header is Missing" +alertid: 90005-1 +alertindex: 9000501 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Ensure that Sec-Fetch-Site header is included in request headers." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Specifies the relationship between request initiator's origin and target's origin. diff --git a/site/content/docs/alerts/90005-2.md b/site/content/docs/alerts/90005-2.md new file mode 100644 index 000000000..f5f117b4c --- /dev/null +++ b/site/content/docs/alerts/90005-2.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-Mode Header is Missing" +alertid: 90005-2 +alertindex: 9000502 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Ensure that Sec-Fetch-Mode header is included in request headers." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc. diff --git a/site/content/docs/alerts/90005-3.md b/site/content/docs/alerts/90005-3.md new file mode 100644 index 000000000..ec2e7bdd2 --- /dev/null +++ b/site/content/docs/alerts/90005-3.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-Dest Header is Missing" +alertid: 90005-3 +alertindex: 9000503 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Ensure that Sec-Fetch-Dest header is included in request headers." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource. diff --git a/site/content/docs/alerts/90005-4.md b/site/content/docs/alerts/90005-4.md new file mode 100644 index 000000000..195c71ec5 --- /dev/null +++ b/site/content/docs/alerts/90005-4.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-User Header is Missing" +alertid: 90005-4 +alertindex: 9000504 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Ensure that Sec-Fetch-User header is included in user initiated requests." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Specifies if a navigation request was initiated by a user. diff --git a/site/content/docs/alerts/90005-5.md b/site/content/docs/alerts/90005-5.md new file mode 100644 index 000000000..eaad6e021 --- /dev/null +++ b/site/content/docs/alerts/90005-5.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-Site Header Has an Invalid Value" +alertid: 90005-5 +alertindex: 9000505 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Sec-Fetch-Site header must have one of the following values: same-origin, same-site, cross-origin, or none." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Specifies the relationship between request initiator's origin and target's origin. diff --git a/site/content/docs/alerts/90005-6.md b/site/content/docs/alerts/90005-6.md new file mode 100644 index 000000000..dde83539e --- /dev/null +++ b/site/content/docs/alerts/90005-6.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-Mode Header Has an Invalid Value" +alertid: 90005-6 +alertindex: 9000506 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Sec-Fetch-Mode header must have one of the following values: cors, no-cors, navigate, same-origin, or websocket." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc. diff --git a/site/content/docs/alerts/90005-7.md b/site/content/docs/alerts/90005-7.md new file mode 100644 index 000000000..e35ee0a9c --- /dev/null +++ b/site/content/docs/alerts/90005-7.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-Dest Header Has an Invalid Value" +alertid: 90005-7 +alertindex: 9000507 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Sec-Fetch-Dest header must have one of the following values: audio, audioworklet, document, embed, empty, font, frame, iframe, image, manifest, object, paintworklet, report, script, serviceworker, sharedworker, style, track, video, worker, xslt." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource. diff --git a/site/content/docs/alerts/90005-8.md b/site/content/docs/alerts/90005-8.md new file mode 100644 index 000000000..f07c8df0f --- /dev/null +++ b/site/content/docs/alerts/90005-8.md @@ -0,0 +1,20 @@ +--- +title: "Sec-Fetch-User Header Has an Invalid Value" +alertid: 90005-8 +alertindex: 9000508 +alerttype: "Passive" +alertcount: 8 +status: alpha +type: alert +risk: Informational +solution: "Sec-Fetch-User header must have the value set to ?1." +references: + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User +cwe: 352 +wasc: 9 +alerttags: + - WSTG-v42-SESS-05 +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +--- +Specifies if a navigation request was initiated by a user. diff --git a/site/content/docs/alerts/90005.md b/site/content/docs/alerts/90005.md new file mode 100644 index 000000000..1e6e8e0b6 --- /dev/null +++ b/site/content/docs/alerts/90005.md @@ -0,0 +1,35 @@ +--- +title: "Fetch Metadata Request Headers" +alertid: 90005 +alertindex: 9000500 +alerttype: "Passive" +status: alpha +type: alertset +alerts: + 90005-1: + alertid: 90005-1 + name: "Sec-Fetch-Site Header is Missing" + 90005-2: + alertid: 90005-2 + name: "Sec-Fetch-Mode Header is Missing" + 90005-3: + alertid: 90005-3 + name: "Sec-Fetch-Dest Header is Missing" + 90005-4: + alertid: 90005-4 + name: "Sec-Fetch-User Header is Missing" + 90005-5: + alertid: 90005-5 + name: "Sec-Fetch-Site Header Has an Invalid Value" + 90005-6: + alertid: 90005-6 + name: "Sec-Fetch-Mode Header Has an Invalid Value" + 90005-7: + alertid: 90005-7 + name: "Sec-Fetch-Dest Header Has an Invalid Value" + 90005-8: + alertid: 90005-8 + name: "Sec-Fetch-User Header Has an Invalid Value" +code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrulesAlpha/src/main/java/org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java +linktext: "org/zaproxy/zap/extension/pscanrulesAlpha/FetchMetadataRequestHeadersScanRule.java" +---