ascanrules: XPath Injection add Custom Payloads support

[kingthorin]

Overview

ascanrules

• CHANGELOG > Add change note.
• ExtensionPayloader > Add appropriate hooks etc.
• ExtensionPayloaderUnitTest > Assert hook/unload behavior, add functional tests.
• ascanrules.html > Update help entry.
• XpathInjectionScanRule > Update functionality to support Custom Payloads.

custompayloads:

• CHANGELOG > Add note.
• PayloadCategory > Add support for adding payloads which are initially disabled.

Related Issues

• Fixes zaproxy/zaproxy#8958 - Confirmed working given the PoC in the ticket.
• Related to zaproxy/zaproxy#5708

Checklist

• [x] Update help
• [x] Update changelog
• [x] Run ./gradlew spotlessApply for code formatting
• [x] Write tests
• [x] Check code coverage
• [x] Sign-off commits
• [x] Squash commits
• [x] Use a descriptive title

[psiinon]

Checkmarx One – Scan Summary & Details – 7136a8b1-645a-43b8-b127-fa0574004ce7

Great job! No new security vulnerabilities introduced in this pull request

[kingthorin]

Fixed two items, still needs tests.

[kingthorin]

Added tests, and custom payloads alert tag.

[kingthorin]

Done and done, rebased, and deconflicted.

[thc202]

This is still pending https://github.com/zaproxy/zap-extensions/pull/6465#discussion_r2238802710

[kingthorin]

Okay, changelog re-fixed, and other/earlier comment addressed.

[thc202]

Thank you!

[kingthorin]

Yay, thanks!