New dast repo breaks --auth-submit-field support
Summary
The new DAST repo takes xpath as priority over the name/id, so when you configure the submit button it doesn't do anything since the xpath is provided
New DAST code:
Old DAST code:
Steps to reproduce
docker run --rm -i -v $(pwd)/wrk:/zap/wrk/:rw dast /analyze \
-t http://mysite.localhost/users/sign_in \
--auth-url http://mysite.localhost/users/sign_in \
--auth-username someone \
--auth-password p@ssw0rd \
--auth-username-field "user[login]" \
--auth-password-field "user[password]" \
--auth-submit-field "user[submit]"
What is the current bug behavior?
it doesn't seem to take the submit button id or name into account.
What is the expected correct behavior?
It would find the submit button by id or name before using the default configured xpath