spelling

* against
* aggregated
* decimal
* delimiters
* detected
* encoding
* expires
* multiple
* programmatically
* relevant
* reports
* response
* responseHas
* servlet
* should
* state
* threshold
* tighter
* unknown
* unused
* value
* verify
* without

Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>

Author: jsoref

addOns/pscanrules/CHANGELOG.md

@@ -154,7 +154,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ## [32] - 2021-01-20
 ### Changed
 - The Suspicious Comments scan rule will include the offending line as evidence.
-- The Suspicious Comments scan rule will raise one alert per finding, instead of one aggeregated alert per HTTP message.
+- The Suspicious Comments scan rule will raise one alert per finding, instead of one aggregated alert per HTTP message.
 
 ## [31] - 2020-12-15
 ### Changed

addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java

@@ -193,7 +193,7 @@ public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
             }
         } else if (isResponseXML(msg, source)) { // Check XML response charset
             // We're interested in the 'encoding' attribute defined in the XML
-            // declaration tag (<?xml enconding=".."?>
+            // declaration tag (<?xml encoding=".."?>
             //
             // TODO: could there be more than one XML declaration tag for a single XML file?
             List<StartTag> xmlDeclarationTags =
@@ -257,7 +257,7 @@ private void raiseAlert(
                                 + " "
                                 + getVariant(
                                         currentMismatch)) // Compound name (to account for variant
-                // designations, and muitiple alerts on single URI)
+                // designations, and multiple  alerts on single URI)
                 .setRisk(getRisk())
                 .setConfidence(Alert.CONFIDENCE_LOW)
                 .setDescription(getDescription())

addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CookieLooselyScopedScanRule.java

@@ -83,7 +83,7 @@ public void scanHttpResponseReceive(HttpMessage msg, int id, Source source) {
 
     /*
      * Determines whether the specified cookie is loosely scoped by
-     * checking it's Domain attribute value agains the host
+     * checking it's Domain attribute value against the host
      */
     private boolean isLooselyScopedCookie(HttpCookie cookie, String host) {
         // preconditions

addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/InsecureAuthenticationScanRule.java

@@ -56,7 +56,7 @@ public class InsecureAuthenticationScanRule extends PluginPassiveScanner {
     public void scanHttpRequestSend(HttpMessage msg, int id) {
 
         String uri = null, method = null;
-        String extraInfo = null; // valeu depends on which method is being used.
+        String extraInfo = null; // value depends on which method is being used.
         String digestInfo = null;
 
         if (msg.getRequestHeader().isSecure()) {

addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/UserControlledHTMLAttributesScanRule.java

@@ -167,7 +167,7 @@ private void checkHtmlAttribute(
             // Special handling of meta tag.
             // If I were just looking to see if the meta tag 'contains' the user input,
             // we'd wind up with lots of false positives.
-            // To avoid this, I  parse the meta tag values based on a set of delimeters,
+            // To avoid this, I  parse the meta tag values based on a set of delimiters,
             // such as ; =  and ,.  This is similar to what the Cookie poisoning
             // check does.
             if (htmlElement.getName().equalsIgnoreCase(HTMLElementName.META)

addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/ViewstateScanRule.java

@@ -286,7 +286,7 @@ private static enum ViewstateAnalyzerPattern {
         // serialized objects which also trigger this filter
         // Example: Microsoft.SharePoint.WebControls.SPControlMode, Microsoft.SharePoint,
         // Version=12.0.0.0, Culture=neutral,
-        // TODO: maybe replace this regex by a tigher rule, avoiding detecting 999.999.999.999
+        // TODO: maybe replace this regex by a tighter rule, avoiding detecting 999.999.999.999
         IPADDRESS(
                 Pattern.compile("\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"),
                 Constant.messages.getString(MESSAGE_PREFIX + "content.ip.name"),

addOns/pscanrules/src/main/javahelp/org/zaproxy/zap/extension/pscanrules/resources/help/contents/pscanrules.html

@@ -273,7 +273,7 @@ <H2>Open Redirect</H2>
 <H2>PII Disclosure</H2>
 PII is information like credit card number, SSN etc. This check currently reports only numbers which match credit card numbers and pass Luhn checksum, which gives high confidence, that this is a credit card number (images and CSS are ignored).
 <br>
-At MEDIUM and HIGH threshold it attempts to use three characters of context on each side of potential matches to exclude matches within deicmal like content.
+At MEDIUM and HIGH threshold it attempts to use three characters of context on each side of potential matches to exclude matches within decimal like content.
 At LOW threshold, alerts will be raised for such matches.
 <p>
 Note: In the case of suspected credit card values, the potential credit card numbers are looked up against a Bank Identification Number List 

addOns/pscanrules/src/test/java/org/zaproxy/zap/extension/pscanrules/ContentTypeMissingScanRuleUnitTest.java

@@ -80,7 +80,7 @@ void shouldReturnExpectedMappings() {
     }
 
     @Test
-    void shoudNotAlertIfResponseBodyIsEmpty() throws HttpMalformedHeaderException {
+    void shouldNotAlertIfResponseBodyIsEmpty() throws HttpMalformedHeaderException {
         // Given
         HttpMessage msg = createMessage();
         msg.getResponseHeader().setHeader(HttpResponseHeader.CONTENT_TYPE, "");
@@ -104,7 +104,7 @@ void shoudNotAlertIfContentTypePresentInResponse() throws HttpMalformedHeaderExc
     }
 
     @Test
-    void shoudAlertIfContentTypePresentButEmptyInResponse() throws HttpMalformedHeaderException {
+    void shouldAlertIfContentTypePresentButEmptyInResponse() throws HttpMalformedHeaderException {
         // Given
         HttpMessage msg = createMessage();
         msg.getResponseHeader().setHeader(HttpResponseHeader.CONTENT_TYPE, "");
@@ -118,7 +118,7 @@ void shoudAlertIfContentTypePresentButEmptyInResponse() throws HttpMalformedHead
     }
 
     @Test
-    void shoudAlertIfContentTypeNotPresentInResponse() throws HttpMalformedHeaderException {
+    void shouldAlertIfContentTypeNotPresentInResponse() throws HttpMalformedHeaderException {
         // Given
         HttpMessage msg = createMessage();
         // When

addOns/pscanrules/src/test/java/org/zaproxy/zap/extension/pscanrules/InformationDisclosureDebugErrorsScanRuleUnitTest.java

@@ -290,7 +290,7 @@ void changeDebugErrorsFile() throws HttpMalformedHeaderException {
         int expectedAlerts = 0;
         List<String> alternativeDebugErrors =
                 Arrays.asList(
-                        "Alternative Error", "This should also be dected as debug error message");
+                        "Alternative Error", "This should also be detected as debug error message");
 
         // Should raise alert with default error messages loaded
         HttpMessage msg =

addOns/pscanrules/src/test/java/org/zaproxy/zap/extension/pscanrules/InsecureAuthenticationScanRuleUnitTest.java

@@ -190,10 +190,10 @@ void shouldRaiseAlertIfBasicAuthenticationResponseWithNoSsl()
                         new URI("http://www.example.com", true),
                         HttpRequestHeader.HTTP11);
         msg.setRequestHeader(requestHeader);
-        HttpResponseHeader responsHeader = new HttpResponseHeader();
-        responsHeader.addHeader(
+        HttpResponseHeader responseHeader = new HttpResponseHeader();
+        responseHeader.addHeader(
                 HttpHeader.WWW_AUTHENTICATE, AUTHORIZATION_BASIC + " realm=\"Private\"");
-        msg.setResponseHeader(responsHeader);
+        msg.setResponseHeader(responseHeader);
         // When
         scanHttpResponseReceive(msg);
         // Then