Skip to content

Various changes to address some performance issues - #9302

Draft
time4tea wants to merge 5 commits into
zaproxy:mainfrom
time4tea:bit-faster-maybe
Draft

time4tea wants to merge 5 commits into
zaproxy:mainfrom
time4tea:bit-faster-maybe

Conversation

@time4tea

Copy link
Copy Markdown

Hi -

Related to #9277 #9278 #9280

Here are a set of changes that addressed, for me, the serious performance issues I found trying to use ZAP to spider a website.

This, and the associated PR that I'll raise in a second in the extensions project - transformed the system from a very slow thing with an unresponsive GUI to something that was very fast, and GUI was responsive throughout.

I appreciate that this PR is probably not something that can be merged in. However, I'm sorry that I don't have the time to split it, and shepherd it through a review process. However, it is offered as-is if it is useful.

The main changes are:

  • ParosTable* -> these classes were very poorly performing as they were used by many threads at one time, but were synchronized at the class level, meaning very heavy contention. Additionally, each write was followed by a read from an hsql database - which was quite slow. Certain of them have been replaced by an InMemory* version - these appear to have the same behaviour as the existing classes, but have not been verified extensively. It is possible that in some uses cases they are no longer suitable.

  • Some methods in ParosTable* which appeared to be unused were removed. This was to understand which methods needed to be implemented in the InMemory* versions - these deletions had no effect in my use of the system. it is possible they are used from scripts?

@github-actions

github-actions Bot commented Apr 18, 2026 •

Copy link
Copy Markdown

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@psiinon

psiinon commented Apr 18, 2026

Copy link
Copy Markdown
Member

Logo
Checkmarx One – Scan Summary & Details – 87fb6422-895a-44bc-b861-12c46a83bcc2


New Issues (6) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/PostBasedAuthenticationMethodType.java: 364
detailsMethod at line 364 of /zap/src/main/java/org/zaproxy/zap/authentication/PostBasedAuthenticationMethodType.java sends user information outside the...
Attack Vector
2 MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/PostBasedAuthenticationMethodType.java: 364
detailsMethod at line 364 of /zap/src/main/java/org/zaproxy/zap/authentication/PostBasedAuthenticationMethodType.java sends user information outside the...
Attack Vector
3 MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/model/SessionStructure.java: 554
detailsMethod at line 554 of /zap/src/main/java/org/zaproxy/zap/model/SessionStructure.java sends user information outside the application. This may co...
Attack Vector
4 MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/model/SessionStructure.java: 554
detailsMethod at line 554 of /zap/src/main/java/org/zaproxy/zap/model/SessionStructure.java sends user information outside the application. This may co...
Attack Vector
5 MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/AuthenticationMethod.java: 416
detailsMethod at line 416 of /zap/src/main/java/org/zaproxy/zap/authentication/AuthenticationMethod.java sends user information outside the application...
Attack Vector
6 MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/AuthenticationMethod.java: 416
detailsMethod at line 416 of /zap/src/main/java/org/zaproxy/zap/authentication/AuthenticationMethod.java sends user information outside the application...
Attack Vector

Fixed Issues (6) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/AuthenticationMethod.java: 415
MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/AuthenticationMethod.java: 415
MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/PostBasedAuthenticationMethodType.java: 363
MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/authentication/PostBasedAuthenticationMethodType.java: 363
MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/model/SessionStructure.java: 553
MEDIUM Privacy_Violation zap/src/main/java/org/zaproxy/zap/model/SessionStructure.java: 553

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@time4tea

Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@thc202
thc202 marked this pull request as draft April 18, 2026 09:13
@thc202

thc202 commented Apr 20, 2026

Copy link
Copy Markdown
Member

This is not addressing performance issues but replacing them with OOME. Might be fine for your use case but with some sites this will OOME in no time. The zap-extensions PR is also introducing issues.

@time4tea

Copy link
Copy Markdown
Author

hiya - thanks for taking a look - i tried it on a site with approx 100k pages and didn't experience any OOM - although my dev box has 128GB RAM - but absolutely agree that i don't have a good view on how client machines are configured and what sort of sites are used.

i also agree I don't have a good view on scripting and other usage patterns, and hence 'probably not something that can be merged in' - however, maybe it can be useful in identifying some common performance bottlenecks and looking at possible strategies to remove.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

3 participants