Zaproxy: Wappalyzer regexes being applied to the wrong elements

[lillesvin]

Wappalyzer add-on seems to apply regexes for detecting included JavaScript frameworks incorrectly.

To Reproduce
If you browse e.g. danfoss.com with ZAP + the Wappalyzer add-on then it identifies use of PrototypeJS (in https://www.danfoss.com/static/common.min.js) even though that's not correct. When right-clicking on "Prototype" in the Technology tab to see the evidence, then it shows this regex: (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js and clicking on the evidence takes you to a search that highlights most of https://www.danfoss.com/static/common.min.js). The regex seems to be applied to the contents of the file rather than the src attribute of the script tags.

Expected behavior
From https://www.wappalyzer.com/docs/dev/specification it seems that regexes specified in the "script" part of an apps.json entry should only be applied to the filenames/paths of included JavaScripts—not the contents of them. I suspect this is also the cause of a lot of other regexes from apps.json being applied too broadly, since they're meant to be applied to filenames/paths rather than JavaScript code.

Software versions

• ZAP: 2.9.0
• Add-on: Wappalyzer 20.0.0
• OS: Debian 10.4 and Windows 10
• Java (Debian): openjdk 11.0.7 2020-04-14; OpenJDK Runtime Environment (build 11.0.7+10-post-Debian-3deb10u1); OpenJDK 64-Bit Server VM (build 11.0.7+10-post-Debian-3deb10u1, mixed mode, sharing)
• Java (Windows): java version "1.8.0_251"; Java(TM) SE Runtime Environment (build 1.8.0_251-b08); Java HotSpot(TM) 64-Bit Server VM (build 25.251-b08, mixed mode)
• Browser: All

[thc202]

Indeed the check is not correct.

[lillesvin]

Wow, that was impressively fast!

Thank you! 😄

[thc202]

Released in version 20.1.0 of Wappalyzer add-on.