New dast repo breaks --auth-submit-field support

Summary

The new DAST repo takes xpath as priority over the name/id, so when you configure the submit button it doesn't do anything since the xpath is provided

New DAST code:

https://gitlab.com/gitlab-org/security-products/dast/blob/2e0c054ea9f753d9cc7c2fd874c2f74fa3de9262/src/zap_webdriver.py#L168-186

Old DAST code:

https://gitlab.com/gitlab-org/security-products/zaproxy/blob/08ecc443eff10ef3eb1007df8318a985a5b088db/build/docker/zap-baseline.py#L405-418

Steps to reproduce

docker run --rm -i -v $(pwd)/wrk:/zap/wrk/:rw dast /analyze \
  -t http://mysite.localhost/users/sign_in \
  --auth-url http://mysite.localhost/users/sign_in \
  --auth-username someone \
  --auth-password p@ssw0rd \
  --auth-username-field "user[login]" \
  --auth-password-field "user[password]" \
  --auth-submit-field "user[submit]"

What is the current bug behavior?

it doesn't seem to take the submit button id or name into account.

What is the expected correct behavior?

It would find the submit button by id or name before using the default configured xpath

Assignee Loading
Time tracking Loading