zap-cli
zap-cli copied to clipboard
Trouble excluding results from a quick scan
I have a bash script in which I run the following:
docker run -i owasp/zap2docker-weekly zap-cli quick-scan \
--self-contained \
--start-options '-config api.disablekey=true' \
-s all \
-e /*\.js$/i \
--spider \
--ajax-spider \
-r \
$STACK
Notice the -e /*\.js$/i
bit -- I'm trying to eliminate the following false-positives which (I'm fairly certain) are the result of my JavaScript files being obfuscated:
[INFO] Running a quick scan for https://xx.yyy.io
[INFO] Issues found: 3
+----------------------------------------+--------+----------+--------------------------------------------------------------+
| Alert | Risk | CWE ID | URL |
+========================================+========+==========+==============================================================+
| Hash Disclosure - Mac OSX salted SHA-1 | High | 200 | https://xx.yyy.io/static/dll/76c7a32f60c9b2ab5d0f.js |
+----------------------------------------+--------+----------+--------------------------------------------------------------+
| Hash Disclosure - Mac OSX salted SHA-1 | High | 200 | https://xx.yyy.io/static/dll/76c7a32f60c9b2ab5d0f.js |
+----------------------------------------+--------+----------+--------------------------------------------------------------+
| Anti CSRF Tokens Scanner | High | 352 | https://xx.yyy.io/static/dll/353fb1927e899732c1fc.js |
+----------------------------------------+--------+----------+--------------------------------------------------------------+
I'd actually prefer to simply ignore the CWE ID
s directly (rather than exclude files)... but I don't think there are any flags which enable me to do that.
Am I using the -e
flag incorrectly? It's clearly not excluding my JS files. Or is there another way I can configure this scan to ignore those two CWE IDs?