ascanrules: sqli heuristic to fix 3xx redirect false positives

[FiveOFive]

Overview

Fix the sql injection false positive case described in zaproxy/zaproxy#8651. The short summary is that the expression based test sends 3 requests: normal, modified, and confirm. A sql injection is suspected if normal and modified return the same response, but confirm returns a different response. The response comparison logic looks only at the response body. In the case of 3xx redirects the bodies can be exactly the same when the location headers are different. This change adds a heuristic for checking the location headers and treating different 3xx redirects as different responses, even when the bodies are the same.

This change is built on top of #5974. Once that one is done I'll rebase, squash, and sign-off the resulting commit.

Related Issues

Fix zaproxy/zaproxy#8651.

Checklist

• Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

For more details, please refer to the developer rules and guidelines.

[thc202]

Thank you both!