{"action":"created","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4161","repository_url":"https://api.github.com/repos/zaproxy/zaproxy","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4161/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4161/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4161/events","html_url":"https://github.com/zaproxy/zaproxy/issues/4161","id":282712239,"number":4161,"title":"Are these false positives?","user":{"login":"quartilesoftware","id":26272200,"avatar_url":"https://avatars0.githubusercontent.com/u/26272200?v=4","gravatar_id":"","url":"https://api.github.com/users/quartilesoftware","html_url":"https://github.com/quartilesoftware","followers_url":"https://api.github.com/users/quartilesoftware/followers","following_url":"https://api.github.com/users/quartilesoftware/following{/other_user}","gists_url":"https://api.github.com/users/quartilesoftware/gists{/gist_id}","starred_url":"https://api.github.com/users/quartilesoftware/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quartilesoftware/subscriptions","organizations_url":"https://api.github.com/users/quartilesoftware/orgs","repos_url":"https://api.github.com/users/quartilesoftware/repos","events_url":"https://api.github.com/users/quartilesoftware/events{/privacy}","received_events_url":"https://api.github.com/users/quartilesoftware/received_events","type":"User","site_admin":false},"labels":[{"id":220063779,"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-12-17T18:14:46Z","updated_at":"2017-12-18T15:01:29Z","closed_at":"2017-12-18T15:01:29Z","author_association":"NONE","body":"Hi,\r\n\r\nI have a .Net Core1.1 App running on Azure. I’ve run ZAP and have received a report which contains two items I think are false positives. \r\n\r\nI’m hoping to get some help or guidance here to confirm what I think, or otherwise suggest what I may be overlooking.\r\n\r\nI’ve listed below what the ZAP alert title says about each of the issues, together with what I have already coded or configured in the App which directly addresses the alert, and which therefore leads me to think the alerts must be false positives:\r\n\r\n1.Web Browser XSS Protection Not Enabled.\r\n\r\nIn Startup.cs for the application. I have included this:\r\n\r\n   app.Use(async (context, next) =>\r\n   {\r\n     context.Response.Headers.Add(\"X-XSS-Protection\", \"1; mode=block\");\r\n      ….\r\n\r\n      await next();\r\n   );\r\n\r\n\r\n2.Path traversal.\r\n\r\nThe URL which the alert relates to is a method which accepts a single string parameter. \r\nIn the first line of the method I ensure that only standard alphabetic characters a-z are permitted. \r\nSpecial characters which might permit path traversal are not permitted.\r\n\r\n\r\nCan anyone please let me know if I am correct to conclude these ZAP alerts are false positives, or otherwise what I may be overlooking?\r\n\r\nRegards.\r\n\r\nQSL\r\n"},"comment":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/comments/352449912","html_url":"https://github.com/zaproxy/zaproxy/issues/4161#issuecomment-352449912","issue_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/4161","id":352449912,"user":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars0.githubusercontent.com/u/7570458?v=4","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"created_at":"2017-12-18T15:01:29Z","updated_at":"2017-12-18T15:01:29Z","author_association":"MEMBER","body":"Thanks for letting us know."}}
{"actor":{"display_login":"kingthorin"}}