Sync HTTP Response Code Errors script from zaproxy

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>

Author: kingthorin

CHANGELOG.md

@@ -17,12 +17,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Maintenance and documentation changes.
 - Active and passive READMEs to include lastest JS script examples.
 - Reduce usage of fully qualified objects in loops or main methods to address potential classloader performance issues, in JavaScript scripts (Issue 9187).
+- httpsender/Alert on HTTP Response Code Errors.js sync from zaproxy (Issue 9273).
 
 ### Fixed 
 - The following scripts were not being loaded as scan rules:
   - active/SSTI.js
   - passive/Mutliple Security Header Check.js
-- Updated Alert_on_HTTP_Response_Code_Errors.js to work with GraalVM JavaScript engine.
+- Updated Alert on HTTP Response Code Errors.js to work with GraalVM JavaScript engine.
 
 ### Removed
 - Links to videos which no longer exist.

httpsender/Alert on HTTP Response Code Errors.js

@@ -34,10 +34,12 @@ function responseReceived(msg, initiator, helper) {
     } else {
       var risk = 0; // Info
       var title = "A Client Error response code was returned by the server";
+      var alertRef = 1;
       if (code >= 500) {
         // Server error
         risk = 1; // Low
         title = "A Server Error response code was returned by the server";
+        alertRef = 2;
       }
       // CONFIDENCE_HIGH = 3 (we can be pretty sure we're right)
       var alert = new Alert(pluginid, risk, 3, title);
@@ -95,6 +97,7 @@ function responseReceived(msg, initiator, helper) {
           "Raised by the 'Alert on HTTP Response Code Error' script"
       );
       alert.setEvidence(code.toString());
+      alert.setAlertRef(pluginid + "-" + alertRef);
       alert.setCweId(388); // CWE CATEGORY: Error Handling
       alert.setWascId(20); // WASC  Improper Input Handling
       extensionAlert.alertFound(alert, ref);