Describe the bug

Job spider is reporting always 3 or more even when there is no URLs that can be found, like the following:

"Job spider found 3 URLs"

The logs above came from Automation Framework's messages but the issue seems to exist in the spider addon itself (e.g. https://github.com/zaproxy/zap-extensions/blob/420d2e9d24c44f6a54089c54ad432531cf336b9c/addOns/spider/src/main/java/org/zaproxy/addon/spider/SpiderController.java#L193)

I assume the URLs are including the user-suppiled URL (e.g. a default target URL) plus robots.txt and sitemap.xml which Spider sends automatically.

The root cause might be, increasing the counts regardless of the return status (e.g. 404).

Steps to reproduce the behavior

It can be reproduced using any web apps. Just a simple example can be:

1. create an empty dir
2. python3 -m http.server 5000
3. run spider with automation framework

Expected behavior

It should report counts of existing pages only.

Software versions

ZAP 2.12.0

Screenshots

No response

Errors from the zap.log file

No response

Additional context

No response

Would you like to help fix this issue?

• Yes

Edit:

In the end the resolution of this issue will be an "enhancement" excluding the seeds from the "found" count.

Though ignoring the seeds would probably be more accurate since those are technically not found while spidering.