Skip to content

Signal configuration and do not set default in SW - #370

Merged
kingthorin merged 1 commit into
zaproxy:mainfrom
thc202:config
Aug 13, 2026
Merged

Signal configuration and do not set default in SW#370
kingthorin merged 1 commit into
zaproxy:mainfrom
thc202:config

Conversation

@thc202

@thc202 thc202 commented Aug 13, 2026

Copy link
Copy Markdown
Member

Allow to programmatically tell if the browser extension was configured and do not set defaults in the ServiceWorker which would reset the configuration.

@psiinon

psiinon commented Aug 13, 2026

Copy link
Copy Markdown
Member

Logo
Checkmarx One – Scan Summary & Details610b57ee-9a34-464f-8305-894a4e6cc816


New Issues (2)

High: 2

Checkmarx found the following issues in this Pull Request

# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2026-73088 Npm-browserslist-4.28.6
detailsRecommended version: 4.28.7
Description: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, "normalizeStats()" ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2026-73089 Npm-browserslist-4.28.6
detailsRecommended version: 4.28.7
Description: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains ev...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@thc202 thc202 changed the title Signal configuration and do set defaults in SW Signal configuration and do not set default in SW Aug 13, 2026
@thc202
thc202 requested a lite review from Copilot and removed request for Copilot August 13, 2026 14:45

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a way to detect when the extension has been auto-configured and prevents the background service worker from overwriting an existing configuration by removing the install-time default writes.

Changes:

  • Add a new localStorage key constant to signal that auto-configuration completed.
  • Update the content script configuration flow to await sync-storage writes and set a “configured” flag.
  • Remove on-install default zapurl/zapkey writes from the background script and document the fix in the changelog.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File Description
source/utils/constants.ts Adds a constant for the “configured” signal key.
source/ContentScript/index.ts Makes configuration async, awaits sync writes, and sets a configured flag.
source/Background/index.ts Removes install-time sync-storage defaults to avoid resetting configuration.
CHANGELOG.md Adds a 0.2.2 entry describing the fix.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread source/ContentScript/index.ts
Comment thread source/utils/constants.ts Outdated
Comment thread CHANGELOG.md Outdated
@thc202
thc202 marked this pull request as ready for review August 13, 2026 15:32
@psiinon
psiinon requested a review from kingthorin August 13, 2026 15:43
Allow to programmatically tell if the browser extension was configured
and do not set defaults in the ServiceWorker which would reset the
configuration.

Signed-off-by: thc202 <thc202@gmail.com>
@kingthorin
kingthorin enabled auto-merge August 13, 2026 15:51
@kingthorin
kingthorin merged commit 26b0493 into zaproxy:main Aug 13, 2026
7 of 10 checks passed
@thc202
thc202 deleted the config branch August 13, 2026 19:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants