Add "policy" related tags to passive scan rules

[kingthorin]

Overview

• CHANGELOGs > Added notes.
• Rules > Added/Updated Alert Tags.
• UnitTests > Added/updated tests asserting the tag set.
• Build files > Updated commonlib dependency version.

Related Issues

N/A

Checklist

• Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

[psiinon]

Checkmarx One – Scan Summary & Details – c8c9d6c0-2577-4f37-8dd0-c159a45e87b4

Great job, no security vulnerabilities found in this Pull Request

[kingthorin]

Deconflicted.

Double checked using the shared sheet and:

Stand Alone Script

extPscan = control
  .getExtensionLoader()
  .getExtension(org.zaproxy.addon.pscan.ExtensionPassiveScan2.NAME);

plugins = extPscan.getPassiveScannersManager().getScanRules();

for (var i = 0; i < plugins.length; i++) {
  try {
    var tags;
        if (plugins[i].getAlertTags() == null) {
            tags = "[]";
        } else {
             tags = plugins[i].getAlertTags().keySet();
        }
    print(
      plugins[i].getPluginId() +
        "\t" +
        plugins[i].getName() +
        "\t" +
        plugins[i].getStatus() +
        "\t" +
        plugins[i].getClass().getSimpleName() +
        "\t" + tags
    );
  } catch (e) {
    print(e);
  }
}

Regex removal in Notepad++:
WSTG-v\d\d-\w\w\w\w-\d\d,? ?
OWASP_20\d\d_A\d\d,? ?

[kingthorin]

Got all those.

[thc202]

Thank you!