I applied JavaScript validation inputs for the username input on the registration form, which is
function username_validation(){
var username = document.getElementByname("username1").value.length;
if (username < 4){
return false;
}
}
The code works correctly when I'm trying to register, but the ZAP scanner passes this validation, and it successfully registers with the ZAP username, which is three characters!!! My question is, how does ZAP pass the validation?? Thanks.
function username_validation(){
var username = document.getElementByname("username1")
if (username.length < 4){
return False;
}
}
You need to check the string length, not compare as if it were a number input; try the above.
JavaScript is only client side. ZAP manipulates things between the client and server. Always double check server side, never trust solely to client side (client controllable) controls. (You can't assume all clients are nice.)