Incorporating review comments

Author: preetkaran20

src/main/java/org/zaproxy/zap/extension/jwt/attacks/SignatureAttack.java

@@ -53,6 +53,7 @@
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
+import java.text.MessageFormat;
 import java.text.ParseException;
 import java.util.Set;
 import org.apache.commons.lang3.StringUtils;
@@ -63,6 +64,7 @@
 import org.parosproxy.paros.core.scanner.Plugin.AttackStrength;
 import org.zaproxy.zap.extension.jwt.JWTConfiguration;
 import org.zaproxy.zap.extension.jwt.JWTHolder;
+import org.zaproxy.zap.extension.jwt.JWTI18n;
 import org.zaproxy.zap.extension.jwt.exception.JWTException;
 import org.zaproxy.zap.extension.jwt.utils.JWTConstants;
 import org.zaproxy.zap.extension.jwt.utils.JWTUtils;
@@ -128,16 +130,16 @@ private boolean executePubliclyWellKnownHMacSecretAttack() {
                                 VulnerabilityType.PUBLICLY_KNOWN_SECRETS,
                                 Alert.RISK_HIGH,
                                 Alert.CONFIDENCE_HIGH,
-                                "JWT token: "
-                                        + jwtHolder.getBase64EncodedToken()
-                                        + " is signed by: \""
-                                        + secret
-                                        + "\"",
+                                MessageFormat.format(
+                                        JWTI18n.getMessage(
+                                                "jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.param"),
+                                        jwtHolder.getBase64EncodedToken(),
+                                        secret),
                                 serverSideAttack);
                         return true;
                     }
                 } catch (JWTException e) {
-                    LOGGER.error("An error occurred while getting signed manipulated tokens", e);
+                    LOGGER.warn("An error occurred while getting signed manipulated tokens", e);
                 }
             }
         }

src/main/java/org/zaproxy/zap/extension/jwt/utils/JWTUtils.java

@@ -309,27 +309,17 @@ public static boolean isValidJson(String value) {
      */
     public static Set<String> readFileContentsFromResources(String fileName) {
         Set<String> values = new HashSet<>();
-        BufferedReader bufferedReader = null;
-        try {
-            bufferedReader =
-                    new BufferedReader(
-                            new InputStreamReader(JWTUtils.class.getResourceAsStream(fileName)));
+        try (BufferedReader bufferedReader =
+                new BufferedReader(
+                        new InputStreamReader(JWTUtils.class.getResourceAsStream(fileName)))) {
             String inputLine;
             while ((inputLine = bufferedReader.readLine()) != null) {
                 if (StringUtils.isNotBlank(inputLine)) {
                     values.add(inputLine);
                 }
             }
         } catch (Exception ex) {
-            LOGGER.info("Unable to read publicly known secrets from: " + fileName, ex);
-        } finally {
-            if (bufferedReader != null) {
-                try {
-                    bufferedReader.close();
-                } catch (Exception ex) {
-                    LOGGER.debug("Unable to close bufferedReader", ex);
-                }
-            }
+            LOGGER.warn("Unable to read publicly known secrets from: " + fileName, ex);
         }
         return values;
     }

src/main/resources/org/zaproxy/zap/extension/jwt/resources/Messages.properties

@@ -101,4 +101,6 @@ jwt.scanner.server.vulnerability.miscAttack.emptyTokens.soln=Tokens even if empt
 
 # JWT scanner references and solutions
 jwt.scanner.refs=https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html
-jwt.scanner.soln=See reference for further information. The solution depends on implementation details
+jwt.scanner.soln=See reference for further information. The solution depends on implementation details
+
+jwt.scanner.server.vulnerability.signatureAttack.publiclyKnownSecrets.param=JWT: {0} is signed by: \"{1}\"