From f7df8453b300cdf33d0a2b5de65441e9c6918750 Mon Sep 17 00:00:00 2001 From: thc202 Date: Wed, 8 Jul 2026 23:00:53 +0100 Subject: [PATCH 1/3] Fix concurrency issue with script types Use a concurrent map to allow iteration and modifications at the same time. Signed-off-by: thc202 --- .../zap/extension/script/ExtensionScript.java | 4 ++-- .../extension/script/ExtensionScriptUnitTest.java | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/zap/src/main/java/org/zaproxy/zap/extension/script/ExtensionScript.java b/zap/src/main/java/org/zaproxy/zap/extension/script/ExtensionScript.java index 51ecf7f98ea..5b006917429 100644 --- a/zap/src/main/java/org/zaproxy/zap/extension/script/ExtensionScript.java +++ b/zap/src/main/java/org/zaproxy/zap/extension/script/ExtensionScript.java @@ -35,10 +35,10 @@ import java.util.Collection; import java.util.Collections; import java.util.Enumeration; -import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.Objects; +import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.CopyOnWriteArrayList; import javax.script.Invocable; import javax.script.ScriptContext; @@ -126,7 +126,7 @@ public class ExtensionScript extends ExtensionAdaptor implements CommandLineList private ScriptTreeModel treeModel = null; private List engineWrappers = new ArrayList<>(); - private Map typeMap = new HashMap<>(); + private Map typeMap = new ConcurrentHashMap<>(); private ProxyListenerScript proxyListener = null; private HttpSenderScriptListener httpSenderScriptListener; diff --git a/zap/src/test/java/org/zaproxy/zap/extension/script/ExtensionScriptUnitTest.java b/zap/src/test/java/org/zaproxy/zap/extension/script/ExtensionScriptUnitTest.java index c9794656b65..f8e8f25fb53 100644 --- a/zap/src/test/java/org/zaproxy/zap/extension/script/ExtensionScriptUnitTest.java +++ b/zap/src/test/java/org/zaproxy/zap/extension/script/ExtensionScriptUnitTest.java @@ -23,6 +23,7 @@ import static org.hamcrest.Matchers.is; import static org.hamcrest.Matchers.not; import static org.hamcrest.Matchers.nullValue; +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.spy; @@ -30,6 +31,7 @@ import static org.mockito.Mockito.when; import java.security.InvalidParameterException; +import java.util.Iterator; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; @@ -50,6 +52,18 @@ void cleanUp() { Constant.messages = null; } + @Test + void shouldReturnThreadSafeScriptTypesCollection() { + // Given + ExtensionScript extensionScript = new ExtensionScript(); + extensionScript.hook(mock()); + Iterator it = extensionScript.getScriptTypes().iterator(); + extensionScript.registerScriptType(new ScriptType("type", "i18n.type", null, true)); + + // When / Then + assertDoesNotThrow(it::next); + } + @Test void shouldCreateScriptsCache() { // Given From 710963a4e204062d2ec3792a127dc47ab81a9dbf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 07:33:58 +0000 Subject: [PATCH 2/3] Bump the gradle group with 6 updates Bumps the gradle group with 6 updates: | Package | From | To | | --- | --- | --- | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.10` | `1.18.11` | | org.apache.logging.log4j:log4j-api | `2.26.0` | `2.26.1` | | org.apache.logging.log4j:log4j-1.2-api | `2.26.0` | `2.26.1` | | org.apache.logging.log4j:log4j-core | `2.26.0` | `2.26.1` | | org.apache.logging.log4j:log4j-jul | `2.26.0` | `2.26.1` | | org.apache.logging.log4j:log4j-slf4j-impl | `2.26.0` | `2.26.1` | Updates `net.bytebuddy:byte-buddy` from 1.18.10 to 1.18.11 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.10...byte-buddy-1.18.11) Updates `org.apache.logging.log4j:log4j-api` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-1.2-api` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-core` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-jul` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-1.2-api` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-core` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-jul` from 2.26.0 to 2.26.1 Updates `org.apache.logging.log4j:log4j-slf4j-impl` from 2.26.0 to 2.26.1 --- updated-dependencies: - dependency-name: net.bytebuddy:byte-buddy dependency-version: 1.18.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-api dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-1.2-api dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-core dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-jul dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-slf4j-impl dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-1.2-api dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-core dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-jul dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: org.apache.logging.log4j:log4j-slf4j-impl dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 902b28b6ba4..0bb29406ce3 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,11 +1,11 @@ [versions] errorprone = "2.42.0" flatlaf = "3.7.1" -log4j = "2.26.0" +log4j = "2.26.1" [libraries] bndAnnotation = "biz.aQute.bnd:biz.aQute.bnd.annotation:7.3.0" -bytebuddy = "net.bytebuddy:byte-buddy:1.18.10" +bytebuddy = "net.bytebuddy:byte-buddy:1.18.11" commons-beanutils = "commons-beanutils:commons-beanutils:1.11.0" commons-codec = "commons-codec:commons-codec:1.22.0" commons-collections = "commons-collections:commons-collections:3.2.2" From 47e5dc9b72fd37680d20c32cef2721f362ad0947 Mon Sep 17 00:00:00 2001 From: thc202 Date: Thu, 9 Jul 2026 08:41:27 +0100 Subject: [PATCH 3/3] Refresh LEGALNOTICE Refresh LEGALNOTICE.md with latest version. Signed-off-by: thc202 --- LEGALNOTICE.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/LEGALNOTICE.md b/LEGALNOTICE.md index 31544221b0a..6f6c9d9518b 100644 --- a/LEGALNOTICE.md +++ b/LEGALNOTICE.md @@ -54,10 +54,10 @@ and subject to their respective licenses. | jfreechart-1.5.6.jar | LGPL | | jgrapht-core-0.9.2.jar | LGPL 2.1 | | json-lib-2.4-jdk15.jar | MIT + "Good, Not Evil" | -| log4j-1.2-api-2.26.0.jar | Apache 2.0 | -| log4j-api-2.26.0.jar | Apache 2.0 | -| log4j-core-2.26.0.jar | Apache 2.0 | -| log4j-jul-2.26.0.jar | Apache 2.0 | +| log4j-1.2-api-2.26.1.jar | Apache 2.0 | +| log4j-api-2.26.1.jar | Apache 2.0 | +| log4j-core-2.26.1.jar | Apache 2.0 | +| log4j-jul-2.26.1.jar | Apache 2.0 | | rsyntaxtextarea-3.6.3.jar | BSD-3 clause | | swingx-all-1.6.5-1.jar | LGPL 2.1 | | xom-1.4.6.jar | LGPL |