quickstart: Add Scan Policy option to Automated Scan panel by Adarshkumar0509 · Pull Request #7300 · zaproxy/zap-extensions

Adarshkumar0509 · 2026-04-21T19:47:20Z

Fixes zaproxy/zaproxy#9291

Added a Scan Policy dropdown to the Quick Start Automated Scan panel.

Changes:

AttackPanel.java: Added policy JComboBox populated from PolicyManager
AttackThread.java: Added scanPolicyName field and passes selected policy to active scanner
ExtensionQuickStart.java: Passes selected policy from panel to attack thread
Messages.properties: Added quickstart.label.policy label

github-actions · 2026-04-21T19:47:30Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

Adarshkumar0509 · 2026-04-21T19:51:22Z

I have read the CLA Document and I hereby sign the CLA

thc202 · 2026-04-21T19:51:23Z

Changelog will have to be updated.

psiinon · 2026-04-21T19:58:41Z

Checkmarx One – Scan Summary & Details – ac1f5546-5496-4454-9ad3-33b0beb36e24

Great job! No new security vulnerabilities introduced in this pull request

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Adarshkumar0509 · 2026-04-21T20:17:58Z

@Checkmarx rescan this PR.

Adarshkumar0509 · 2026-04-21T20:21:29Z

hii @thc202 and @psiinon , please take a look whenever you have time.

Accidental approval

Adarshkumar0509 · 2026-04-21T23:06:49Z

@Checkmarx rescan this PR.

Adarshkumar0509 · 2026-04-21T23:07:31Z

hii @kingthorin sir can you have a look at this.

kingthorin · 2026-04-21T23:25:14Z

@Checkmarx rescan this PR.

You don't need to worry about this, thanks for trying to be diligent 😉

Adarshkumar0509 · 2026-04-22T06:23:21Z

hii @kingthorin and @thc202 , please take a look whenever you have time. since this was my first contribution i want to contribute and learn more can you guide me some issues.

thc202 · 2026-04-22T07:08:14Z

It's not necessary to ping, we get notifications of comments/pushes.

psiinon

It works, which is always a good start 😁
A couple of chances would be good:

Initially default to "Dev Standard" (if present)
Save the last chosen policy in the options, and use that as the new default
Update the help

…update help

Adarshkumar0509 · 2026-04-22T10:28:22Z

i have made the changes , Take a look whenever you have time.

thc202 · 2026-04-22T10:48:40Z

+                }
+                if (savedPolicy != null && !savedPolicy.isEmpty()) {
+                    policyField.setSelectedItem(savedPolicy);
+                } else if (defaultPolicy != null) {


Use policyExists(…) again.

Preferable to inline in the if than declare variables upfront that might not be even used.

thc202 · 2026-04-22T10:52:30Z

+
+The scan policy to use when performing the active scan.
+The last chosen policy will be used by default.
+<br><br>


I believe this is still outstanding

thc202 · 2026-04-22T10:53:20Z

Be good to add some tests to cover the new behaviour.

Adarshkumar0509 · 2026-04-22T11:42:56Z

can you take a look at this.

thc202 · 2026-04-22T13:17:11Z

        attackThread.setURL(url);
        attackThread.setTraditionalSpider(traditionalSpider);
        attackThread.setPlugableSpider(plugableSpider);
+        attackThread.setScanPolicyName(getQuickStartPanel().getAttackPanel().getSelectedPolicy());


This will break in headless mode, see HeadlessQuickAttacker usage. Better add a package method which accepts a policy than access view classes directly.

Adarshkumar0509 · 2026-04-22T21:14:37Z

please take a look at this.

thc202 · 2026-04-24T10:44:13Z

Still pending review comments.

thc202 · 2026-04-24T10:44:18Z

+org.gradle.parallel=true
+org.gradle.jvmargs=-Xmx2g


This should be reverted.

Adarshkumar0509 · 2026-04-24T11:30:54Z

working on it.

… gradle.properties

Adarshkumar0509 · 2026-04-24T21:34:14Z

just take a look at this

kingthorin · 2026-04-24T21:57:10Z

There should be no changes to this file

For gradle.properties: reply i Reverted in latest commit.

kingthorin · 2026-04-24T21:57:25Z

+
+The scan policy to use when performing the active scan.
+The last chosen policy will be used by default.
+<br><br>


I believe this is still outstanding

Add Scan Policy option to Quick Start Automated Scan panel

dd04522

thc202 reviewed Apr 21, 2026

View reviewed changes

Comment thread addOns/quickstart/src/main/java/org/zaproxy/zap/extension/quickstart/AttackPanel.java Outdated

thc202 changed the title ~~Add Scan Policy option to Quick Start Automated Scan panel~~ quickstart: Add Scan Policy option to Automated Scan panel Apr 21, 2026

Address review feedback: use class reference and update changelog

7d31089

Remove redundant cast when getting ExtensionActiveScan

0d28a2e

kingthorin previously approved these changes Apr 21, 2026

View reviewed changes

Address review feedback from kingthorin

bb06386

Address remaining review feedback from kingthorin

fb17451

psiinon requested changes Apr 22, 2026

View reviewed changes

Adarshkumar0509 added 2 commits April 22, 2026 15:50

Address psiinon feedback: default to Dev Standard, save last policy, …

cf77ea6

…update help

Fix: apply Dev Standard default and saved policy selection

6790bb9

thc202 reviewed Apr 22, 2026

View reviewed changes

Adarshkumar0509 added 3 commits April 22, 2026 16:50

Address thc202 review feedback

caf689e

Simplify policy loading using forEach and fix static method call

bf90ec1

Add unit tests for QuickStartParam scan policy

6df912b

thc202 reviewed Apr 22, 2026

View reviewed changes

Fix headless mode and rework getDefaultScanPolicy to be called once

dc27728

thc202 reviewed Apr 24, 2026

View reviewed changes

Address remaining review feedback: inline variables, fix help, revert…

9dbc905

… gradle.properties

kingthorin reviewed Apr 24, 2026

View reviewed changes

		org.gradle.parallel=true
		org.gradle.jvmargs=-Xmx2g

Uh oh!

Conversation

Adarshkumar0509 commented Apr 21, 2026 • edited by thc202 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Adarshkumar0509 commented Apr 21, 2026

Uh oh!

thc202 commented Apr 21, 2026

Uh oh!

psiinon commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

Adarshkumar0509 commented Apr 21, 2026

Uh oh!

Adarshkumar0509 commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Adarshkumar0509 commented Apr 21, 2026

Uh oh!

Adarshkumar0509 commented Apr 21, 2026

Uh oh!

kingthorin commented Apr 21, 2026

Uh oh!

Adarshkumar0509 commented Apr 22, 2026

Uh oh!

thc202 commented Apr 22, 2026

Uh oh!

psiinon left a comment

Choose a reason for hiding this comment

Uh oh!

Adarshkumar0509 commented Apr 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thc202 commented Apr 22, 2026

Uh oh!

Adarshkumar0509 commented Apr 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Adarshkumar0509 commented Apr 22, 2026

Uh oh!

thc202 commented Apr 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Adarshkumar0509 commented Apr 24, 2026

Uh oh!

Adarshkumar0509 commented Apr 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Adarshkumar0509 commented Apr 21, 2026 •

edited by thc202

Loading

github-actions Bot commented Apr 21, 2026 •

edited

Loading

psiinon commented Apr 21, 2026 •

edited

Loading

Adarshkumar0509 commented Apr 21, 2026 •

edited

Loading