ascanrules: SQLi Hypersonic rename scan rule (all timing based)

Signed-off-by: kingthorin <[email protected]>

Author: kingthorin

addOns/ascanrules/CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Changed
 - Maintenance changes.
 - Depends on an updated version of the Common Library add-on.
+- The SQL Injection - Hypersonic scan rule and alerts have been renamed to clarify that they're time based (Issue 7341).
 
 ### Added
 - Rules (as applicable) have been tagged in relation to HIPAA and PCI DSS.

addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionHypersonicScanRule.java renamed to addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionHypersonicTimingScanRule.java

@@ -46,7 +46,7 @@
 /**
  * TODO: maybe implement a more specific UNION based check for Hypersonic (with table names)
  *
- * <p>The SqlInjectionHypersonicScanRule identifies Hypersonic specific SQL Injection
+ * <p>The SqlInjectionHypersonicTimingScanRule identifies Hypersonic specific SQL Injection
  * vulnerabilities using Hypersonic specific syntax. If it doesn't use Hypersonic specific syntax,
  * it belongs in the generic SQLInjection class! Note the ordering of checks, for efficiency is : 1)
  * Error based (N/A) 2) Boolean Based (N/A - uses standard syntax) 3) UNION based (TODO) 4) Stacked
@@ -68,7 +68,7 @@
  *
  * @author 70pointer
  */
-public class SqlInjectionHypersonicScanRule extends AbstractAppParamPlugin
+public class SqlInjectionHypersonicTimingScanRule extends AbstractAppParamPlugin
         implements CommonActiveScanRuleInfo {
 
     /** Hypersonic one-line comment */
@@ -212,7 +212,8 @@ public class SqlInjectionHypersonicScanRule extends AbstractAppParamPlugin
     }
 
     /** for logging. */
-    private static final Logger LOGGER = LogManager.getLogger(SqlInjectionHypersonicScanRule.class);
+    private static final Logger LOGGER =
+            LogManager.getLogger(SqlInjectionHypersonicTimingScanRule.class);
 
     /** The number of seconds used in time-based attacks (i.e. sleep commands). */
     private int timeSleepSeconds = DEFAULT_SLEEP_TIME;

addOns/ascanrules/src/main/javahelp/org/zaproxy/zap/extension/ascanrules/resources/help/contents/ascanrules.html

@@ -361,7 +361,7 @@ <H2 id="id-40020">SQL Injection - Hypersonic (Time Based)</H2>
 <br>
 Post 2.5.0 you can change the length of time used for the attack by changing the <code>rules.common.sleep</code> parameter via the Options 'Rule configuration' panel.
 <p>
-Latest code: <a href="https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionHypersonicScanRule.java">SqlInjectionHypersonicScanRule.java</a>
+Latest code: <a href="https://github.com/zaproxy/zap-extensions/blob/main/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionHypersonicTimingScanRule.java">SqlInjectionHypersonicScanRule.java</a>
 <br>
 Alert ID: <a href="https://www.zaproxy.org/docs/alerts/40020/">40020</a>.
 

addOns/ascanrules/src/main/resources/org/zaproxy/zap/extension/ascanrules/resources/Messages.properties

@@ -180,7 +180,7 @@ ascanrules.sqlinjection.alert.unionbased.extrainfo = RDBMS [{0}] likely, given U
 ascanrules.sqlinjection.authbypass.desc = SQL injection may be possible on a login page, potentially allowing the application's authentication mechanism to be bypassed
 ascanrules.sqlinjection.authbypass.name = SQL Injection - Authentication Bypass
 ascanrules.sqlinjection.desc = SQL injection may be possible.
-ascanrules.sqlinjection.hypersonic.name = SQL Injection - Hypersonic SQL
+ascanrules.sqlinjection.hypersonic.name = SQL Injection - Hypersonic SQL (Time Based)
 ascanrules.sqlinjection.mssql.alert.timebased.extrainfo = The query time is controllable using parameter value [{0}], which caused the request to take [{1}] milliseconds, when the original unmodified query with value [{2}] took [{3}] milliseconds.
 ascanrules.sqlinjection.mssql.name = SQL Injection - MsSQL
 ascanrules.sqlinjection.mysql.name = SQL Injection - MySQL

addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionHypersonicScanRuleUnitTest.java renamed to addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionHypersonicTimingScanRuleUnitTest.java

@@ -38,13 +38,13 @@
 import org.zaproxy.zap.model.TechSet;
 import org.zaproxy.zap.testutils.NanoServerHandler;
 
-/** Unit test for {@link SqlInjectionHypersonicScanRule}. */
-class SqlInjectionHypersonicScanRuleUnitTest
-        extends ActiveScannerTest<SqlInjectionHypersonicScanRule> {
+/** Unit test for {@link SqlInjectionHypersonicTimingScanRule}. */
+class SqlInjectionHypersonicTimingScanRuleUnitTest
+        extends ActiveScannerTest<SqlInjectionHypersonicTimingScanRule> {
 
     @Override
-    protected SqlInjectionHypersonicScanRule createScanner() {
-        return new SqlInjectionHypersonicScanRule();
+    protected SqlInjectionHypersonicTimingScanRule createScanner() {
+        return new SqlInjectionHypersonicTimingScanRule();
     }
 
     @Test