Merge pull request zaproxy#9347 from kingthorin/docker-scripts

docker: Fetch httpsender scripts from community-scripts

Author: thc202

docker/CHANGELOG.md

@@ -1,6 +1,9 @@
 # Changelog
 All notable changes to the docker containers will be documented in this file.
 
+### 2026-06-19
+- Fetch packaged scan HTTP Sender scripts from [community-scripts](https://github.com/zaproxy/community-scripts/tree/main/httpsender) instead of keeping local copies. NOTE: The names of the script files have changed.
+
 ### 2026-05-08
 - Fixed bug in baseline scan which could result in a python error when running the packaged scan without a mapped drive.
 

docker/Dockerfile-live

@@ -34,6 +34,13 @@ RUN --mount=type=secret,id=webswing_url \
 	# Remove Webswing bundled examples
 	rm -Rf webswing/apps/
 
+# Fetch packaged scan HttpSender scripts from community-scripts
+RUN mkdir -p /httpsender-scripts && \
+	curl -fsSL "https://raw.githubusercontent.com/zaproxy/community-scripts/main/httpsender/AlertOnHttpResponseCodeErrors.js" \
+		-o "/httpsender-scripts/AlertOnHttpResponseCodeErrors.js" && \
+	curl -fsSL "https://raw.githubusercontent.com/zaproxy/community-scripts/main/httpsender/AlertOnUnexpectedContentTypes.js" \
+		-o "/httpsender-scripts/AlertOnUnexpectedContentTypes.js"
+
 FROM debian:trixie-slim AS final
 LABEL maintainer="psiinon@gmail.com"
 
@@ -101,7 +108,7 @@ COPY --link --chown=1000:1000 webswing.config /zap/webswing/
 COPY --link --chown=1000:1000 webswing.properties /zap/webswing/
 COPY --link --chown=1000:1000 policies /home/zap/.ZAP_D/policies/
 COPY --link --chown=1000:1000 policies /root/.ZAP_D/policies/
-COPY --link --chown=1000:1000 scripts /home/zap/.ZAP_D/scripts/
+COPY --link --from=builder --chown=1000:1000 /httpsender-scripts/ /home/zap/.ZAP_D/scripts/scripts/httpsender/
 COPY --link --chown=1000:1000 .xinitrc /home/zap/
 COPY --link --chown=1000:1000 firefox /home/zap/.mozilla/firefox/
 

docker/Dockerfile-stable

@@ -34,6 +34,13 @@ RUN --mount=type=secret,id=webswing_url \
 	# Remove Webswing bundled examples
 	rm -Rf webswing/apps/
 
+# Fetch packaged scan HttpSender scripts from community-scripts
+RUN mkdir -p /httpsender-scripts && \
+	curl -fsSL "https://raw.githubusercontent.com/zaproxy/community-scripts/main/httpsender/AlertOnHttpResponseCodeErrors.js" \
+		-o "/httpsender-scripts/AlertOnHttpResponseCodeErrors.js" && \
+	curl -fsSL "https://raw.githubusercontent.com/zaproxy/community-scripts/main/httpsender/AlertOnUnexpectedContentTypes.js" \
+		-o "/httpsender-scripts/AlertOnUnexpectedContentTypes.js"
+
 FROM debian:bookworm-slim AS final
 LABEL maintainer="psiinon@gmail.com"
 
@@ -105,7 +112,7 @@ COPY --link --chown=1000:1000 webswing.properties /zap/webswing/
 COPY --link --chown=1000:1000 policies /home/zap/.ZAP/policies/
 COPY --link --chown=1000:1000 policies /root/.ZAP/policies/
 # The scan script loads the scripts from dev home dir.
-COPY --link --chown=1000:1000 scripts /home/zap/.ZAP_D/scripts/
+COPY --link --from=builder --chown=1000:1000 /httpsender-scripts/ /home/zap/.ZAP_D/scripts/scripts/httpsender/
 COPY --link --chown=1000:1000 .xinitrc /home/zap/
 COPY --link --chown=1000:1000 firefox /home/zap/.mozilla/firefox/
 

docker/Dockerfile-weekly

@@ -21,6 +21,13 @@ RUN --mount=type=secret,id=webswing_url \
 	# Remove Webswing bundled examples
 	rm -Rf webswing/apps/
 
+# Fetch packaged scan HttpSender scripts from community-scripts
+RUN mkdir -p /httpsender-scripts && \
+	curl -fsSL "https://raw.githubusercontent.com/zaproxy/community-scripts/main/httpsender/AlertOnHttpResponseCodeErrors.js" \
+		-o "/httpsender-scripts/AlertOnHttpResponseCodeErrors.js" && \
+	curl -fsSL "https://raw.githubusercontent.com/zaproxy/community-scripts/main/httpsender/AlertOnUnexpectedContentTypes.js" \
+		-o "/httpsender-scripts/AlertOnUnexpectedContentTypes.js"
+
 FROM debian:trixie-slim AS final
 LABEL maintainer="psiinon@gmail.com"
 
@@ -84,7 +91,7 @@ COPY --link --chown=1000:1000 webswing.config /zap/webswing/
 COPY --link --chown=1000:1000 webswing.properties /zap/webswing/
 COPY --link --chown=1000:1000 policies /home/zap/.ZAP_D/policies/
 COPY --link --chown=1000:1000 policies /root/.ZAP_D/policies/
-COPY --link --chown=1000:1000 scripts /home/zap/.ZAP_D/scripts/
+COPY --link --from=builder --chown=1000:1000 /httpsender-scripts/ /home/zap/.ZAP_D/scripts/scripts/httpsender/
 COPY --link --chown=1000:1000 .xinitrc /home/zap/
 COPY --link --chown=1000:1000 firefox /home/zap/.mozilla/firefox/
 

docker/scripts/scripts/httpsender/Alert_on_HTTP_Response_Code_Errors.js

@@ -385,9 +385,6 @@ def main(argv):
 
             # Copy across the files that may not be in all of the docker images
             try:
-                subprocess.check_output(['docker', 'exec', '-t', cid, 'mkdir', '-p', '/home/zap/.ZAP_D/scripts/scripts/httpsender/'])
-                cp_to_docker(cid, 'scripts/scripts/httpsender/Alert_on_HTTP_Response_Code_Errors.js', '/home/zap/.ZAP_D/')
-                cp_to_docker(cid, 'scripts/scripts/httpsender/Alert_on_Unexpected_Content_Types.js', '/home/zap/.ZAP_D/')
                 cp_to_docker(cid, 'policies/API-Minimal.policy', '/home/zap/.ZAP_D/')
                 if target_file:
                     cp_to_docker(cid, target_file, '/zap/')
@@ -418,10 +415,10 @@ def main(argv):
 
         # Enable scripts
         script_engine = get_script_engine(zap, ['Oracle Nashorn', 'Graal.js'])
-        zap.script.load('Alert_on_HTTP_Response_Code_Errors.js', 'httpsender', script_engine, '/home/zap/.ZAP_D/scripts/scripts/httpsender/Alert_on_HTTP_Response_Code_Errors.js')
-        zap.script.enable('Alert_on_HTTP_Response_Code_Errors.js')
-        zap.script.load('Alert_on_Unexpected_Content_Types.js', 'httpsender', script_engine, '/home/zap/.ZAP_D/scripts/scripts/httpsender/Alert_on_Unexpected_Content_Types.js')
-        zap.script.enable('Alert_on_Unexpected_Content_Types.js')
+        zap.script.load('AlertOnHttpResponseCodeErrors.js', 'httpsender', script_engine, '/home/zap/.ZAP_D/scripts/scripts/httpsender/AlertOnHttpResponseCodeErrors.js')
+        zap.script.enable('AlertOnHttpResponseCodeErrors.js')
+        zap.script.load('AlertOnUnexpectedContentTypes.js', 'httpsender', script_engine, '/home/zap/.ZAP_D/scripts/scripts/httpsender/AlertOnUnexpectedContentTypes.js')
+        zap.script.enable('AlertOnUnexpectedContentTypes.js')
 
         # Import the API defn
         if format == 'openapi':