{"action":"closed","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1594","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1594/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1594/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/1594/events","html_url":"https://github.com/zaproxy/zaproxy/issues/1594","id":85210666,"number":1594,"title":"TestInfoSessionIdURL - Referer expose session ID - False Positive","user":{"login":"zapbot","id":12745184,"avatar_url":"https://avatars.githubusercontent.com/u/12745184?v=3","gravatar_id":"","url":"https://api.github.com/users/zapbot","html_url":"https://github.com/zapbot","followers_url":"https://api.github.com/users/zapbot/followers","following_url":"https://api.github.com/users/zapbot/following{/other_user}","gists_url":"https://api.github.com/users/zapbot/gists{/gist_id}","starred_url":"https://api.github.com/users/zapbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zapbot/subscriptions","organizations_url":"https://api.github.com/users/zapbot/orgs","repos_url":"https://api.github.com/users/zapbot/repos","events_url":"https://api.github.com/users/zapbot/events{/privacy}","received_events_url":"https://api.github.com/users/zapbot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/add-on","name":"add-on","color":"006b75"},{"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/FalsePositive","name":"FalsePositive","color":"ededed"}],"state":"closed","locked":false,"assignee":{"login":"kingthorin","id":7570458,"avatar_url":"https://avatars.githubusercontent.com/u/7570458?v=3","gravatar_id":"","url":"https://api.github.com/users/kingthorin","html_url":"https://github.com/kingthorin","followers_url":"https://api.github.com/users/kingthorin/followers","following_url":"https://api.github.com/users/kingthorin/following{/other_user}","gists_url":"https://api.github.com/users/kingthorin/gists{/gist_id}","starred_url":"https://api.github.com/users/kingthorin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kingthorin/subscriptions","organizations_url":"https://api.github.com/users/kingthorin/orgs","repos_url":"https://api.github.com/users/kingthorin/repos","events_url":"https://api.github.com/users/kingthorin/events{/privacy}","received_events_url":"https://api.github.com/users/kingthorin/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2015-06-04T18:07:51Z","updated_at":"2015-09-30T08:06:29Z","closed_at":"2015-09-30T08:06:29Z","body":"```\nThe following URL is flagged as a \"Referer expose session ID\"\r\n\r\nhttps://domain.com/Account/LogOn?ReturnUrl=/BusinessTeam/GetSiteAdmins?businessId=0&businessId=0\r\n\r\nThe reason is that the word \"businessId\" matches the regex search for the key \"sid\",\nas the last three letters of \"businessId\" are \"sid\", and the regex isn't case sensitive.\n\r\n\r\nThe code that handles this is TestInfoSessionIdURL.java\r\n\r\nPlease provide any additional information below.\n\r\nThe regex should ensure that the parameter starts after either an '&' or a '?' to avoid\nsimilar false positives with any word that ends with the letters \"sid\".\r\n\n```\n\nOriginal issue reported on code.google.com by `kingthorin` on 2015-04-09 19:51:04"}}