Address potential classloader performance issues in JS scripts

[kingthorin]

No description provided.

[kingthorin]

Note I used const in all the changes but didn't change/reduce other use of var. I can I just wasn't sure if it should be the same PR.

[psiinon]

Checkmarx One – Scan Summary & Details – d5fe9c10-d896-49f1-8201-4caa77808066

---

New Issues (6)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Last User Is 'root'	/docker-wrapper: 10	details Leaving the last user as root can cause security risks. Change to another user after running the commands that need privileges
2		CVE-2026-34479	Maven-org.apache.logging.log4j:log4j-1.2-api-2.24.2	details Recommended version: 2.25.4 Description: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		MAINTAINER Instruction Being Used	/docker-wrapper: 3	details The MAINTAINER instruction sets the Author field of the generated images. The LABEL instruction is a much more flexible version of this and you sh...
4		Unpinned Actions Full Length Commit SHA	/codeql.yml: 31	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
5		Unpinned Actions Full Length Commit SHA	/codeql.yml: 34	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
6		Unpinned Actions Full Length Commit SHA	/codeql.yml: 35	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

[kingthorin]

The CX failure is unrelated to the changes.

[kingthorin]

Think I got all those.

[thc202]

Not all scripts were updated (some still left in the changed scripts), was that on purpose?

[kingthorin]

I thought I copied the full content from zaproxy/docker will check.

[thc202]

I'm referring to scripts that are just here (e.g. Telerik Using Poor Crypto.js with Base64 and Alert, Capture and Replace Anti CSRF Token.js with ScriptVars).

[kingthorin]

My search must have missed them, thanks for clarifying.

[kingthorin]

I just remembered there were a few I left on purpose like in the extender scripts cause they're only used on install and uninstall or register and unregister, but I guess I should change them all to be consistent.

[kingthorin]

Done & done. (If the var -> const change is too broad let me know and I can roll it back)

[thc202]

It's not an if, it is. How does that address potential classloader performance issues.

[kingthorin]

We had agreed to update them as we were switching the fully qualified class usage to Java.types/extends. I was debating if consistency or minimal change was more important.

I'll roll it back.

[thc202]

Minimal changes are more important if the other changes are not done consistently, there are other var that should be const (and we should drop the var as well) throughout (e.g. why in the first script it was not changed LOG_DEBUG_MESSAGES).

[kingthorin]

Because my instruction had been to change it with Java.type and Java.extends. It's okay, I'll go back to minimal change, that's probably best for this case. Other stuff can be done in other passes or PRs.

[kingthorin]

Should be back on track.

[thc202]

Except the random change, e.g. https://github.com/zaproxy/community-scripts/compare/164e4a965d79e840440f7ce42f48c323b8f0cb2b..1ea2a059c734ca71753ce874da49461a7a69b95c#diff-0d7726c989fbffa009518591a5f03900cc4bc48862a617953c902402a953569aL16-R34

[kingthorin]

That was a restoration to the original state (check the change tab, it doesn't show there). Unless it was something we had discussed and I lost track?

Edit: Disregard I was looking at the wrong sender/Alert on*

[thc202]

It can also be squashed (would make diffs easier IMO).

[kingthorin]

Removed unrelated changes in httpsender/Alert on * and squashed.

[Copilot]

Pull request overview

This PR reduces repeated fully qualified Java class access in community JavaScript scripts by hoisting Java classes into top-level Java.type(...) bindings, aligning scripts with existing ZAP scripting conventions and addressing classloader performance concerns.

Changes:

• Replaced inline fully qualified Java references with reusable Java.type(...) bindings across active, passive, HTTP sender, targeted, standalone, extender, and session scripts.
• Updated static/enum references to use the new bindings.
• Added a changelog entry for Issue 9187.

Reviewed changes

Copilot reviewed 42 out of 42 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CHANGELOG.md	Documents the classloader performance cleanup.
active/OpenModelContextProtocolServer.js	Hoists Apache URI class binding.
authentication/DjangoAuthentication.js	Moves authentication Java class imports to module scope.
extender/ZAP onEvent Handler.js	Hoists ZAP event bus class binding.
extender/arpSyndicateSubdomainDiscovery.js	Hoists ZAP event bus class binding.
httpfuzzerprocessor/addCacheBusting.js	Hoists HTML parameter class/type bindings.
httpfuzzerprocessor/add_msgs_sites_tree.js	Hoists history reference and event queue bindings.
httpsender/Alert on HTTP Response Code Errors.js	Hoists alert/history/integer bindings and updates evidence handling.
httpsender/Alert on Unexpected Content Types.js	Hoists alert/history/integer bindings.
httpsender/Capture and Replace Anti CSRF Token.js	Hoists ScriptVars and parameter type bindings.
httpsender/greenbone-maintain-auth.js	Hoists HTML parameter type binding.
httpsender/inject_js_in_html_page.js	Hoists file/string Java class bindings.
httpsender/keep-cookies-going.js	Hoists HTML parameter type binding.
httpsender/maintain-jwt.js	Hoists HTML parameter type binding.
other/af-plans/juiceshop-selenium-auth/JuiceShopAuthentication.js	Hoists Selenium extension binding.
other/af-plans/juiceshop-selenium-auth/JuiceShopReset.js	Hoists user management extension binding.
other/af-plans/juiceshop-selenium-auth/JuiceShopSession.js	Hoists HTML parameter type binding.
passive/Report non static sites.js	Hoists passive scanner class binding and updates example comment.
passive/Telerik Using Poor Crypto.js	Hoists Base64 and Alert bindings.
passive/f5_bigip_cookie_internal_ip.js	Hoists integer and address bindings.
selenium/FillOTPInMFA.js	Hoists Selenium and thread bindings.
session/Juice Shop Session Management.js	Hoists HTML parameter type binding.
standalone/Active scan rule list.js	Hoists active scan extension binding.
standalone/Juice shop authentication by form.js	Hoists Selenium extension binding.
standalone/Juice shop authentication by google.js	Hoists Selenium extension binding.
standalone/Loop through alerts.js	Hoists alert extension and alert bindings.
standalone/Loop through history table.js	Hoists history extension binding.
standalone/alertAndPluginDetails.js	Hoists alert/passive scan/plugin bindings.
standalone/domainFinder.js	Hoists InetAddress binding.
standalone/historySourceTagger.js	Hoists ScriptVars and history extension bindings.
standalone/load_function_example.js	Hoists system property binding.
standalone/scan_rule_list.js	Hoists active/passive scan extension bindings.
targeted/Remove 302s.js	Hoists purge sites binding.
targeted/SQLMapCommandGenerator.js	Hoists clipboard-related bindings.
targeted/Search www.xssposed.org for known XSS.js	Hoists DesktopUtils binding.
targeted/curl_command_generator.js	Hoists clipboard-related bindings.
targeted/cve-2021-22214.js	Hoists Alert binding.
targeted/cve-2021-41773-apache-path-trav.js	Hoists Alert binding.
targeted/json_csrf_poc_generator.js	Hoists header and clipboard bindings.
targeted/request_to_xml.js	Hoists HTTP header binding.
targeted/search cvedetails using target server header.js	Hoists DesktopUtils binding.
variant/CompoundCookies.js	Hoists HTML parameter type binding.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[thc202]

Thank you!