reports: Allow zipping at generation by kingthorin · Pull Request #7456 · zaproxy/zap-extensions

kingthorin · 2026-06-15T14:32:09Z

Overview

Add an option in the GUI, API, and AF to allow users to ZIP the output at generation (generated resources are copied to ZIP, then removed).

Related Issues

Fixes Allow to ZIP the report for download through the API zaproxy#7821

psiinon · 2026-06-15T14:45:38Z

Checkmarx One – Scan Summary & Details – 7bd6def4-ef8a-4480-a79c-ee0e984cc93c

Great job! No new security vulnerabilities introduced in this pull request

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Copilot

Pull request overview

Adds support to generate reports as a .zip archive (containing the main report file plus any template resources), exposed through the Reports add-on GUI, API, and Automation Framework job configuration.

Changes:

Add zip / zipReport option plumbed through GUI dialog, API action, and automation job parameters into ReportData.
Implement ZIP creation + cleanup of original generated files in ExtensionReports.generateReport(...), and adjust display behavior accordingly.
Add/extend unit tests and update help + changelog entries.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
addOns/reports/src/test/java/org/zaproxy/addon/reports/ReportApiUnitTest.java	Adds API unit coverage for the zip param and returned generated path.
addOns/reports/src/test/java/org/zaproxy/addon/reports/ExtensionReportsUnitTest.java	Adds integration-style tests validating zipped outputs and resource handling/cleanup.
addOns/reports/src/test/java/org/zaproxy/addon/reports/automation/ReportJobUnitTest.java	Extends automation job unit tests for `zipReport` parameter plumbing.
addOns/reports/src/main/resources/org/zaproxy/addon/reports/resources/report-max.yaml	Documents `zipReport` in the max example config.
addOns/reports/src/main/resources/org/zaproxy/addon/reports/resources/Messages.properties	Adds UI/API strings for the new zip option.
addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/reports.html	Documents the new GUI “Zip Report Output” behavior.
addOns/reports/src/main/javahelp/org/zaproxy/addon/reports/resources/help/contents/automation.html	Documents `zipReport` in automation job help.
addOns/reports/src/main/java/org/zaproxy/addon/reports/ReportDialog.java	Adds GUI checkbox and passes value into `ReportData`.
addOns/reports/src/main/java/org/zaproxy/addon/reports/ReportData.java	Adds `zipReport` flag to the report generation data model.
addOns/reports/src/main/java/org/zaproxy/addon/reports/ReportApi.java	Adds `zip` param and returns the actual generated file path.
addOns/reports/src/main/java/org/zaproxy/addon/reports/ExtensionReports.java	Implements zipping of generated output + cleanup and adjusts display behavior.
addOns/reports/src/main/java/org/zaproxy/addon/reports/automation/ReportJobDialog.java	Adds automation job dialog checkbox and persists it to parameters.
addOns/reports/src/main/java/org/zaproxy/addon/reports/automation/ReportJob.java	Adds `zipReport` parameter and propagates it into `ReportData` at runtime.
addOns/reports/CHANGELOG.md	Changelog entry for ZIP generation support.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

thc202 · 2026-06-15T17:19:39Z

+                addDirectoryToZip(zos, resourcesSubDir, resourcesSubDir.getName() + "/");
+            }
+        }
+        LOGGER.info("Report zipped to: {}", zipFile.getAbsolutePath());


This was resolved without justification, I'm also wondering why we are logging as info.

It seemed like a fair thing to log, yes a user might generate multiple reports but I wouldn't expect it to actually be "noisey"

It's not about the noise (for me) but the need to inform the user that the report was generated in the directory they chose to?

thc202 · 2026-06-15T16:55:10Z

                } else {
-                    Desktop desktop = Desktop.getDesktop();
-                    desktop.open(file);
+                    Desktop.getDesktop().open(file);


The options should be mutually exclusive (or simply note the display does not work for the ZIP).

thc202 · 2026-06-15T16:55:16Z

+        }
+    }
+
+    private void cleanupOriginalFiles(File mainFile, File resourcesSubDir) throws IOException {


It should zip directly to the ZIP file.

thc202 · 2026-06-15T16:55:30Z

    private List<String> sections = new ArrayList<>();
    private String theme;

+    @Getter @Setter private boolean zipReport = false;


It's false by default.

thc202 · 2026-06-15T16:55:45Z

      reportTitle:                     # String: The report title
      reportDescription:               # String: The report description
      displayReport:                   # Boolean: Display the report when generated, default: false
+      zipReport: true                  # Boolean: Zip the report output, default: false


Here and throughout "ZIP".

thc202 · 2026-06-15T16:56:40Z

 	alerts. Select this check box if you do want to generate a report with
 	no alerts.

+	<H3>Zip Report Output</H3>


It should be simply "ZIP Report", that the reports have several files does not make it a report output.

thc202 · 2026-06-15T17:15:15Z

+        withZipWorkDir(
+                workDir -> {
+                    // Given
+                    // zipReport enabled; traditional-html-plus template with resources


The test case already says it (this applies to other tests).

thc202 · 2026-06-15T17:15:22Z

+        assertThat(Files.exists(workDir.resolve(reportFileName)), is(true));
+    }
+
+    private static void assertZipContains(File zipFile, String... expectedEntries)


Why not pass the matchers and avoid duplicating?

thc202 · 2026-06-15T17:15:24Z

+        }
+    }
+
+    private static String reportFilePath(Path workDir, String fileName) {


Do we really need a method?

thc202 · 2026-06-15T17:16:56Z

+    @Test
+    void shouldReturnGeneratedReportPath() throws Exception {
+        // Given
+        String reportDirectory = System.getProperty("java.io.tmpdir");


It should use a JUnit temp dir instead.

thc202 · 2026-06-15T17:18:24Z

+                () -> assertThat(response.getValue(), is(not(htmlReportPath))));
+    }
+
+    private ReportData captureReportDataFromGenerate() throws Exception {


kingthorin · 2026-06-15T20:57:03Z

Got all those.

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>

kingthorin requested a review from Copilot June 15, 2026 15:15

Copilot started reviewing on behalf of kingthorin June 15, 2026 15:16 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

kingthorin force-pushed the reports-zip branch from eb98bfc to 52c68f0 Compare June 15, 2026 15:27

thc202 reviewed Jun 15, 2026

View reviewed changes

kingthorin force-pushed the reports-zip branch 3 times, most recently from 326d960 to 17a8448 Compare June 15, 2026 20:51

reports: Allow zipping at generation

271b643

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>

kingthorin force-pushed the reports-zip branch from 17a8448 to 271b643 Compare June 15, 2026 21:07

Uh oh!

Uh oh!

Conversation

kingthorin commented Jun 15, 2026

Overview

Related Issues

Uh oh!

psiinon commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thc202 Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kingthorin commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

psiinon commented Jun 15, 2026 •

edited

Loading

thc202 Jun 15, 2026 •

edited

Loading