ascanrules: Path Traversal add details for dir match Alerts & reduce FPs

[kingthorin]

Overview

• CHANGELOG > Added change note.
• Message.properties > Added key/value pair supporting the new Alert details.
• PathTraversalScanRule > Updated to include Other Info on Alerts when applicable, and pre-check the original message response to reduce false positives.
• PathTraversalScanRuleUnitTest > Updated to assert Other Info or lack thereof where applicable, also assure appropriate skipping due to pre-conditions.

Related Issues

• Fixes False Positive - Path Traversal zaproxy#8379

Checklist

• [na] Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

[thc202]

This does not seem to address the FP reported in the referenced issue.

[kingthorin]

No it simply provides further context. IMHO it will be rare for all 5 of the nix matches to happen.

Do you want me to also exclude JS/CSS/Binary'ish because that's an option too which I could add to this PR.

[thc202]

Not sure how rare is since JS chunks/libs tend to have lot of data, but we should not close the issue if it does not address it.

That would be better to address the issue (though the evidence match done beforehand should have caught the reported case, if actually static content).

[kingthorin]

Okay I'll make further changes.

[kingthorin]

This rule doesn't seem to pre-check the response. I'll tackle that as well.

[kingthorin]

Addressed review, further pre-checks as discussed still coming 😁

[kingthorin]

Now w/ pre-checks.