Retire JS Plugin Scanning text/html Files

Describe the bug

In the ZAP logs I sometimes see warnings about slow passive scans for the Vulnerable JS Library rule of text/html files. For example:

321894452 [ZAP-PassiveScanner] WARN  org.zaproxy.zap.extension.pscan.PassiveScanThread - Passive Scan rule Vulnerable JS Library took 384 seconds to scan https://<redacted url>/ text/html; charset=UTF-8 989229

I see in the RetireScanRule code where image files and css files are excluded ( https://github.com/zaproxy/zap-extensions/blob/main/addOns/retire/src/main/java/org/zaproxy/addon/retire/RetireScanRule.java#L66). Is there a reason to be scanning text/html files? It seems like only the JS files are relevant to the scan code (https://github.com/zaproxy/zap-extensions/blob/7b1a80707177aed4c495953b961185382127bdda/addOns/retire/src/main/java/org/zaproxy/addon/retire/model/Repo.java#L84-L89). But I could have missed something.

Thanks!

Expected behavior Expected behavior is for the Vulnerable JS / Retire JS rule to efficiently scan only the relevant file types.

Would you like to help fix this issue? Yes

[FiveOFive]

Yeah, it would be nice to make some optimizations, as it can be pretty slow sometimes. I can try to look into that.

[FiveOFive]

Looking into this more, I think we actually do need to scan text/html content because of included vulnerable javascript libraries in script tags of the text/html e.g. <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"/>

Also, filtering more strictly on Content-Type would skip responses with incorrect or no Content-Type headers. Currently these would be scanned.