pscanrulesAlpha: Add scan rule for Same Origin Method Execution (SOME)

[karthikuj]

Overview

This PR adds a passive scanner rule for Same Origin Method Execution (SOME). It is based on Ben Hayak's research, LinkedIn security team's burp add-on (sometime) and some new checks by me to make it better.

Related Issues

Fixes: zaproxy/zaproxy#7125

Checklist

• Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

For more details, please refer to the developer rules and guidelines.

[karthikuj]

Hey team, this is still a work in progress I had a couple queries before I can continue my work.

1. As mentioned by @psiinon here ZAP does not capture URL fragment so I have no way to parse and check those.
2. I thought we could solve this by directly attacking the JSONP request as I mentioned here but the alert that I raise will also be for just that request and not the request from which the JSONP request originated. One way I can think of is raising an alert on the original URL using the value from the Referer header but that still won't show the URL fragment.

Let me know what I can do in this situation so that I can continue building this aweSOME rule.

[kingthorin]

Should be added to help, and changelog. Unit tests should be created as well.

[karthikuj]

Should be added to help, and changelog. Unit tests should be created as well.

I will be adding the test cases after completing the scan rule, I have updated the help and changelog.

Also, please let me know what should I do here.

[karthikuj]

@kingthorin any more changes needed? if not I'll start with the tests :)

[karthikuj]

Hi devs, I have made the necessary changes let me know if this is good and I will start working on the tests 😄

Also, what should we do about this?

[karthikuj]

@kingthorin I have made all the necessary changes for the scanner rule, please let me know if it requires any more changes, if not then I will start working on the tests. 😄

[kingthorin]

I don't see anything outstanding other than tests. Either way further tweaks shouldn't be a major blocker.

[karthikuj]

I don't see anything outstanding other than tests. Either way further tweaks shouldn't be a major blocker.

Done ✅

Please review and let me know if any changes are needed.

[karthikuj]

@kingthorin ping :)

[karthikuj]

Thank you @kingthorin

Another approval needed.
@thc202 @psiinon

[karthikuj]

Ping @psiinon & @thc202

I will be on vacation from 8th December 2023 - 17th December 2023 🏖️