[psiinon]

No description provided.

[psiinon]

Checkmarx One – Scan Summary & Details – 0dc720a4-816c-4d42-8abf-e03a6a68ec7e

---

New Issues (4 out of 4)

Checkmarx found the following issues in this Pull Request

Severity: 2 Medium · 2 Low

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-110180	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and f... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
2		CVE-2026-110306	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 th... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2026-110095	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 th... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
4		CVE-2026-110725	Npm-fast-uri-3.1.7	details Recommended version: 3.1.9 Description: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 th... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package

---

Use @Checkmarx to take action directly from this PR:

• Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR

[Copilot]

🟡 Changes recommended

Unresolved cancellation, persistence, import preservation, and replay defects affect correctness and script data integrity.

8 open findings

• Commit shared script changes only after persistence succeeds · New
• Dispatch clicks for SVG elements without HTMLElement.click() · New
• Resolve named frames before falling back to frame index · New
• Use runtime messaging to refresh the existing Script Viewer · New
• Retain undo snapshots until saving succeeds · New
• Persist empty script titles when loading scripts · New
• Propagate cancellation to stop in-flight replay actions · New
• Preserve script metadata during import, persistence, and export · New

What changed in this PR

Adds a Script Viewer to both ZAP extension variants, extending recording with editing, file management, and replay.

Changes:

• Adds statement editing, undo, import, and export.
• Introduces replay and step-through controls with an on-page overlay.
• Adds shared translations, tests, build integration, and documentation.

File	Description
webpack.config.rec.js	Builds the recorder’s Script Viewer.
webpack.config.js	Builds the full extension’s Script Viewer.
views/​script.html	Adds viewer layout and controls.
views/​popup.html	Adds the viewer entry point.
views/​help.html	Documents editing and replay.
test/​Background/​zestSummary.test.ts	Tests statement summaries.
test/​Background/​zestScript.test.ts	Tests replacement and numbering.
test/​Background/​zestEdit.test.ts	Tests editing and import validation.
test/​Background/​tabs.test.ts	Tests extension-tab reuse.
test/​Background/​scriptView.test.ts	Tests viewer saving and controls.
test/​Background/​replayOverlay.test.ts	Tests overlay behavior.
test/​Background/​replayer.test.ts	Tests DOM actions and frame switching.
test/​Background/​player.test.ts	Tests replay orchestration and stepping.
test/​Background/​i18n.test.ts	Checks translation coverage.
source/​utils/​zestSummary.ts	Formats statement summaries.
source/​utils/​zestEdit.ts	Defines editable statements and validation.
source/​utils/​util.ts	Adds an asynchronous delay helper.
source/​utils/​tabs.ts	Reuses or creates extension tabs.
source/​utils/​i18n.ts	Centralizes and expands translations.
source/​utils/​constants.ts	Adds editing and replay message types.
source/​types/​zestScript/​ZestScript.ts	Supports statement replacement.
source/​types/​zestScript/​RawStatement.ts	Defines a generic statement type.
source/​ScriptView/​player.ts	Coordinates replay and stepping.
source/​ScriptView/​index.ts	Implements viewer interactions and persistence.
source/​ScriptView/​dialogs.ts	Implements editing and confirmation dialogs.
source/​Popup/​styles.scss	Styles the viewer icon.
source/​Popup/​index.tsx	Opens the viewer and shares translations.
source/​ContentScript/​replayOverlay.ts	Adds draggable replay status and controls.
source/​ContentScript/​replayer.ts	Executes statements against page elements.
source/​ContentScript/​index.ts	Handles replay messages.
source/​Background/​index.ts	Persists replacement statements.
source/​assets/​icons/​view.svg	Adds the viewer icon.
CHANGELOG.rec.md	Announces recorder viewer functionality.
CHANGELOG.md	Announces full-extension viewer functionality.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved mutation races, editing data loss, replay selection errors and keyboard accessibility issues need correction.

6 open findings

• Concurrent storage writes can overwrite newer script changes · New
• Replay selects the wrong option when values are duplicated · New
• Text inputs strip multiline Comment and Send keys content · New
• Undo does not restore the script name · New
• Failed New clears the existing script name · New
• View Script control is inaccessible to keyboard users · New

8 resolved since last review

• Preserve script metadata during import, persistence, and export
• Propagate cancellation to stop in-flight replay actions
• Persist empty script titles when loading scripts
• Retain undo snapshots until saving succeeds
• Use runtime messaging to refresh the existing Script Viewer
• Resolve named frames before falling back to frame index
• Dispatch clicks for SVG elements without HTMLElement.click()
• Commit shared script changes only after persistence succeeds

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Pending refreshes and non-cancellable waits can leave playback controls locked.

6 open findings

• Dispatch Mouse Events Using the Element's Realm · New
• Wait for Disabled Click Targets to Become Enabled · New
• Preserve Original Line Endings When Editing Text · New
• Prevent Conflicting Actions During Refresh and Handle Stale Responses · New
• Make Playback Waits Cancellable on Stop · New
• View Script control is inaccessible to keyboard users

5 resolved since last review

• Concurrent storage writes can overwrite newer script changes
• Failed New clears the existing script name
• Undo does not restore the script name
• Text inputs strip multiline Comment and Send keys content
• Replay selects the wrong option when values are duplicated

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Unresolved script-integrity and replay-control issues can alter unintended statements or actions.

9 open findings

• Invalidate dialogs when the recording script changes · New
• Avoid resending actions after response-channel closure · New
• Restrict replay messages to the active player tab · New
• Make Playback Waits Cancellable on Stop
• Prevent Conflicting Actions During Refresh and Handle Stale Responses
• Preserve Original Line Endings When Editing Text
• Wait for Disabled Click Targets to Become Enabled
• Dispatch Mouse Events Using the Element's Realm
• View Script control is inaccessible to keyboard users

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Unresolved failure handling can stall script operations or overwrite stored statements, and editing can corrupt imported locators.

7 open issues

• Storage read rejection permanently blocks the script queue · New
• Avoid resending actions after response-channel closure
• Invalidate dialogs when the recording script changes
• Unknown locator types are cleared when unrelated edits are saved · New
• Failed script loads re-enable mutations with stale statement data · New
• Restrict replay messages to the active player tab
• View Script control is inaccessible to keyboard users

5 resolved since last review

• Make Playback Waits Cancellable on Stop
• Prevent Conflicting Actions During Refresh and Handle Stale Responses
• Preserve Original Line Endings When Editing Text
• Wait for Disabled Click Targets to Become Enabled
• Dispatch Mouse Events Using the Element's Realm

_{Review effort: Balanced}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[thc202]

Thank you!