Incomplete report generation

Describe the bug Generating a report with the default report/template fails with a OGNL error.

To Reproduce Steps to reproduce the behavior:

1. Proxy some traffic.
2. Let passive scan queue empty.
3. Attempt to generate a report, with default settings.
4. An warning dialog is displayed, looking at the report the generation seems incomplete.

Expected behavior No error, complete report generation.

Screenshots

Software versions

• ZAP: Up-to-date dev
• Add-on: Report 0.9.1
• OS: Win 10
• Java:

openjdk version "11.0.6" 2020-01-14
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.6+10)
OpenJDK 64-Bit Server VM AdoptOpenJDK (build 11.0.6+10, mixed mode)

Errors from the zap.log file

513358 [AWT-EventQueue-0] ERROR org.zaproxy.addon.reports.ReportDialog - Failed to generate a report using template org.zaproxy.addon.reports.Template@7a1da1ba
org.thymeleaf.exceptions.TemplateProcessingException: Exception evaluating OGNL expression: "userObject.tags.isEmpty()" (template: "C:\Users\redact\OWASP ZAP_D\reports\risk-confidence-html\report.html" - line 589, col 6)
	at org.thymeleaf.standard.expression.OGNLVariableExpressionEvaluator.evaluate(OGNLVariableExpressionEvaluator.java:191) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.OGNLVariableExpressionEvaluator.evaluate(OGNLVariableExpressionEvaluator.java:95) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.VariableExpression.executeVariableExpression(VariableExpression.java:166) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.SimpleExpression.executeSimple(SimpleExpression.java:66) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.Expression.execute(Expression.java:109) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.Expression.execute(Expression.java:138) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.Expression.execute(Expression.java:125) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.processor.StandardUnlessTagProcessor.isVisible(StandardUnlessTagProcessor.java:58) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.processor.AbstractStandardConditionalVisibilityTagProcessor.doProcess(AbstractStandardConditionalVisibilityTagProcessor.java:61) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.processor.element.AbstractAttributeTagProcessor.doProcess(AbstractAttributeTagProcessor.java:74) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.processor.element.AbstractElementTagProcessor.process(AbstractElementTagProcessor.java:95) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.util.ProcessorConfigurationUtils$ElementTagProcessorWrapper.process(ProcessorConfigurationUtils.java:633) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleOpenElement(ProcessorTemplateHandler.java:1314) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.OpenElementTag.beHandled(OpenElementTag.java:205) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:282) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleOpenElement(ProcessorTemplateHandler.java:1587) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.OpenElementTag.beHandled(OpenElementTag.java:205) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:282) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:290) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.processIterationModel(IteratedGatheringModelProcessable.java:367) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.process(IteratedGatheringModelProcessable.java:221) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleCloseElement(ProcessorTemplateHandler.java:1640) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.CloseElementTag.beHandled(CloseElementTag.java:139) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:282) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:290) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.processIterationModel(IteratedGatheringModelProcessable.java:367) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.process(IteratedGatheringModelProcessable.java:221) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleCloseElement(ProcessorTemplateHandler.java:1640) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.CloseElementTag.beHandled(CloseElementTag.java:139) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:282) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:290) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.processIterationModel(IteratedGatheringModelProcessable.java:367) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.process(IteratedGatheringModelProcessable.java:293) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleCloseElement(ProcessorTemplateHandler.java:1640) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.CloseElementTag.beHandled(CloseElementTag.java:139) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:282) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:290) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.processIterationModel(IteratedGatheringModelProcessable.java:367) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.process(IteratedGatheringModelProcessable.java:293) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleCloseElement(ProcessorTemplateHandler.java:1640) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.CloseElementTag.beHandled(CloseElementTag.java:139) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:282) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.Model.process(Model.java:290) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.processIterationModel(IteratedGatheringModelProcessable.java:367) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.IteratedGatheringModelProcessable.process(IteratedGatheringModelProcessable.java:221) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.ProcessorTemplateHandler.handleCloseElement(ProcessorTemplateHandler.java:1640) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.CloseElementTag.beHandled(CloseElementTag.java:139) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.TemplateModel.process(TemplateModel.java:136) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.engine.TemplateManager.parseAndProcess(TemplateManager.java:661) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.TemplateEngine.process(TemplateEngine.java:1098) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.TemplateEngine.process(TemplateEngine.java:1067) ~[reports-release-0.9.1.zap:?]
	at org.zaproxy.addon.reports.ExtensionReports.generateReport(ExtensionReports.java:429) ~[reports-release-0.9.1.zap:?]
	at org.zaproxy.addon.reports.ReportDialog.save(ReportDialog.java:500) [reports-release-0.9.1.zap:?]
	at org.zaproxy.zap.view.StandardFieldsDialog.savePressed(StandardFieldsDialog.java:427) [main/:?]
	at org.zaproxy.zap.view.StandardFieldsDialog.access$1(StandardFieldsDialog.java:417) [main/:?]
	at org.zaproxy.zap.view.StandardFieldsDialog$3.actionPerformed(StandardFieldsDialog.java:410) [main/:?]
	at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1967) [?:?]
	at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2308) [?:?]
	at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:405) [?:?]
	at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:262) [?:?]
	at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:279) [?:?]
	at java.awt.Component.processMouseEvent(Component.java:6632) [?:?]
	at javax.swing.JComponent.processMouseEvent(JComponent.java:3342) [?:?]
	at java.awt.Component.processEvent(Component.java:6397) [?:?]
	at java.awt.Container.processEvent(Container.java:2263) [?:?]
	at java.awt.Component.dispatchEventImpl(Component.java:5008) [?:?]
	at java.awt.Container.dispatchEventImpl(Container.java:2321) [?:?]
	at java.awt.Component.dispatchEvent(Component.java:4840) [?:?]
	at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4918) [?:?]
	at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4547) [?:?]
	at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4488) [?:?]
	at java.awt.Container.dispatchEventImpl(Container.java:2307) [?:?]
	at java.awt.Window.dispatchEventImpl(Window.java:2772) [?:?]
	at java.awt.Component.dispatchEvent(Component.java:4840) [?:?]
	at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:772) [?:?]
	at java.awt.EventQueue$4.run(EventQueue.java:721) [?:?]
	at java.awt.EventQueue$4.run(EventQueue.java:715) [?:?]
	at java.security.AccessController.doPrivileged(Native Method) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85) [?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:95) [?:?]
	at java.awt.EventQueue$5.run(EventQueue.java:745) [?:?]
	at java.awt.EventQueue$5.run(EventQueue.java:743) [?:?]
	at java.security.AccessController.doPrivileged(Native Method) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85) [?:?]
	at java.awt.EventQueue.dispatchEvent(EventQueue.java:742) [?:?]
	at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203) [?:?]
	at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124) [?:?]
	at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113) [?:?]
	at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109) [?:?]
	at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) [?:?]
	at java.awt.EventDispatchThread.run(EventDispatchThread.java:90) [?:?]
Caused by: ognl.NoSuchPropertyException: org.parosproxy.paros.core.scanner.Alert.tags
	at ognl.ObjectPropertyAccessor.getProperty(ObjectPropertyAccessor.java:151) ~[reports-release-0.9.1.zap:?]
	at ognl.OgnlRuntime.getProperty(OgnlRuntime.java:3236) ~[reports-release-0.9.1.zap:?]
	at ognl.ASTProperty.getValueBody(ASTProperty.java:114) ~[reports-release-0.9.1.zap:?]
	at ognl.SimpleNode.evaluateGetValueBody(SimpleNode.java:212) ~[reports-release-0.9.1.zap:?]
	at ognl.SimpleNode.getValue(SimpleNode.java:258) ~[reports-release-0.9.1.zap:?]
	at ognl.ASTChain.getValueBody(ASTChain.java:141) ~[reports-release-0.9.1.zap:?]
	at ognl.SimpleNode.evaluateGetValueBody(SimpleNode.java:212) ~[reports-release-0.9.1.zap:?]
	at ognl.SimpleNode.getValue(SimpleNode.java:258) ~[reports-release-0.9.1.zap:?]
	at ognl.Ognl.getValue(Ognl.java:537) ~[reports-release-0.9.1.zap:?]
	at ognl.Ognl.getValue(Ognl.java:501) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.OGNLVariableExpressionEvaluator.executeExpression(OGNLVariableExpressionEvaluator.java:328) ~[reports-release-0.9.1.zap:?]
	at org.thymeleaf.standard.expression.OGNLVariableExpressionEvaluator.evaluate(OGNLVariableExpressionEvaluator.java:170) ~[reports-release-0.9.1.zap:?]
	... 90 more

[thc202]

It’s not necessary.

[globeone]

Not 100% sure if this is the same issue. On OWASP_ZAP_D-2022-04-25 am getting the following error when doing the following.

• Ran a Spider and Active scan
• Report
• Generate Report
• Filled in the Report Title
• Choose the path to save the report
• Selected Default Context
• Selected the URL’s that are in scope for the report
• Traditional HTML Report with Requests and Responses
• Turned off Passing Rules
• Filtered the Informational, Low Confidence, and False Positives from the report
• Pressed Generate Report
• Error message in OGNL with Wapalyzer.
• Disabled the Wapalyzer Add On
• Am able to generate a report now

I really like the Wapalyzer add-on so hopefully this can be fixed as the info is very useful in the report.