OWASP ZAP流水线扫描中规则10049设为IGNORE仍告警的问题

问题描述 #

我在流水线中使用OWASP ZAP官方Docker镜像执行安全扫描，执行命令如下：

docker run --rm -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable:latest zap-full-scan.py \
  -t http://$(ip -f inet -o addr show docker0 | awk '{print $4}' | cut -d '/' -f 1): }} \
  -c zap.conf \
  -J report.json \
  -r report.html

我的zap.conf配置文件内容如下：

# zap-baseline rule configuration file
# Change WARN to IGNORE to ignore rule or FAIL to fail if rule matches
# Only the rule identifiers are used - the names are just for info
# You can add your own messages to each rule by appending them after a tab on each line.
10003   WARN    (Vulnerable JS Library (Powered by Retire.js))
10009   FAIL    (In Page Banner Information Leak)
10010   FAIL    (Cookie No HttpOnly Flag)
10011   FAIL    (Cookie Without Secure Flag)
10015   FAIL    (Re-examine Cache-control Directives)
10017   WARN    (Cross-Domain JavaScript Source File Inclusion)
10019   WARN    (Content-Type Header Missing)
10020   FAIL    (Anti-clickjacking Header)
10021   WARN    (X-Content-Type-Options Header Missing)
10023   WARN    (Information Disclosure - Debug Error Messages)
10024   FAIL    (Information Disclosure - Sensitive Information in URL)
10025   FAIL    (Information Disclosure - Sensitive Information in HTTP Referrer Header)
10026   WARN    (HTTP Parameter Override)
10027   WARN    (Information Disclosure - Suspicious Comments)
10028   FAIL    (Open Redirect)
10029   WARN    (Cookie Poisoning)
10030   WARN    (User Controllable Charset)
10031   FAIL    (User Controllable HTML Element Attribute (Potential XSS))
10032   WARN    (Viewstate)
10033   WARN    (Directory Browsing)
10034   WARN    (Heartbleed OpenSSL Vulnerability (Indicative))
10035   FAIL    (Strict-Transport-Security Header)
10036   WARN    (HTTP Server Response Header)
10037   WARN    (Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s))
10038   WARN    (Content Security Policy (CSP) Header Not Set)
10039   WARN    (X-Backend-Server Header Information Leak)
10040   FAIL    (Secure Pages Include Mixed Content)
10041   FAIL    (HTTP to HTTPS Insecure Transition in Form Post)
10042   FAIL    (HTTPS to HTTP Insecure Transition in Form Post)
10043   FAIL    (User Controllable JavaScript Event (XSS))
10044   FAIL    (Big Redirect Detected (Potential Sensitive Information Leak))
10049   IGNORE  (Content Cacheability)
10050   WARN    (Retrieved from Cache)
10052   WARN    (X-ChromeLogger-Data (XCOLD) Header Information Leak)
10054   WARN    (Cookie without SameSite Attribute)
10055   WARN    (CSP)
10056   WARN    (X-Debug-Token Information Leak)
10057   WARN    (Username Hash Found)
10061   WARN    (X-AspNet-Version Response Header)
10062   FAIL    (PII Disclosure)
10063   WARN    (Permissions Policy Header Not Set)
10096   WARN    (Timestamp Disclosure)
10097   WARN    (Hash Disclosure)
10098   WARN    (Cross-Domain Misconfiguration)
10099   WARN    (Source Code Disclosure)
10105   WARN    (Weak Authentication Method)
10108   FAIL    (Reverse Tabnabbing)
10109   WARN    (Modern Web Application)
10110   WARN    (Dangerous JS Functions)
10111   WARN    (Authentication Request Identified)
10112   WARN    (Session Management Response Identified)
10113   WARN    (Verification Request Identified)
10202   WARN    (Absence of Anti-CSRF Tokens)
2   WARN    (Private IP Disclosure)
3   WARN    (Session ID in URL Rewrite)
50001   WARN    (Script Passive Scan Rules)
90001   WARN    (Insecure JSF ViewState)
90002   WARN    (Java Serialization Object)
90003   WARN    (Sub Resource Integrity Attribute Missing)
90004   WARN    (Insufficient Site Isolation Against Spectre Vulnerability)
90011   WARN    (Charset Mismatch)
90022   WARN    (Application Error Disclosure)
90030   WARN    (WSDL File Detection)
90033   WARN    (Loosely Scoped Cookie)
10038   OUTOFSCOPE  .*\/(es|en|zh)\/kit_requests
10038   OUTOFSCOPE  .*/sitemap.xml

尽管我已将规则10049标记为IGNORE，但扫描结果仍显示该规则的信息性告警，请问我哪里操作有误？

问题原因及解决方法 #

核心原因 #

1. 子规则未被覆盖：你看到的告警是10049-3，而配置中仅忽略了主规则ID10049。ZAP部分规则会根据检测场景生成带后缀的子规则，主规则的IGNORE指令不会自动覆盖所有子规则实例。
2. 配置格式可能有误：zap.conf要求规则行的三个字段（ID、动作、描述）必须用**制表符（Tab）**分隔，若使用空格分隔，ZAP可能无法正确解析IGNORE指令。

解决步骤 #

1. 明确忽略子规则：在zap.conf中添加对目标子规则的IGNORE配置，或使用通配符覆盖所有子规则：

   # 方式1：忽略特定子规则
   10049-3   IGNORE    (Content Cacheability - Specific Instance)
   # 方式2：忽略主规则及所有子规则
   10049.*   IGNORE    (All Content Cacheability related alerts)
   

2. 验证配置格式：用文本编辑器的「显示不可见字符」功能，确认规则行的字段间是制表符而非空格。
3. 清理缓存重扫：流水线中每次扫描前清理ZAP缓存，避免旧配置残留影响结果。

内容的提问来源于stack exchange，提问作者Annio