Filtering on alertRef is not working
Author: alexkiroCreated Sep 22, 2026Updated Sep 25, 2026
Labelsbug
Describe the bug:
According to the docs for alert filters here the ruleId parameter can accept the "the scan rule ID or the alert reference". However if you specify the alertRef the entire alert is filtered. Which can be confusing and potentially dangerous.
Steps to reproduce the behavior:
- Configure alert filter like (https://www.zaproxy.org/docs/alerts/10055/)
- ruleId: "10055-6"
ruleName: 'CSP: style-src unsafe-inline'
newRisk: Info- Run the scans against a site that has CSP with style-src unsafe-inline AND other CSP issue. E.g. like script-src unsafe-inline
- Notice that both alerts are moved to Info instead of just the style-src one.
Expected behavior:
Only the matching alertRef should be filtered instead of all of them.
Software Versions:
zap@09cf1f8275a8:/zap$ zap.sh -suppinfo
Found Java version 17.0.20
Available memory: 15894 MB
Using JVM args: -Xmx3973m
ZAP
Version: 2.17.0
Installed Add-ons: [[id=alertFilters, version=27.0.0], [id=ascanrules, version=83.0.0], [id=ascanrulesBeta, version=66.0.0], [id=authhelper, version=0.42.0], [id=automation, version=0.60.0], [id=bruteforce, version=21.0.0], [id=callhome, version=0.23.0], [id=client, version=0.31.0], [id=commonlib, version=1.44.0], [id=database, version=0.9.0], [id=diff, version=18.0.0], [id=directorylistv1, version=9.0.0], [id=domxss, version=24.0.0], [id=encoder, version=1.9.0], [id=exim, version=0.22.0], [id=formhandler, version=6.8.0], [id=fuzz, version=13.17.0], [id=gettingStarted, version=20.0.0], [id=graaljs, version=0.14.0], [id=graphql, version=0.34.0], [id=help, version=22.0.0], [id=hud, version=0.19.0], [id=insights, version=0.5.0], [id=invoke, version=17.0.0], [id=network, version=0.29.0], [id=oast, version=0.26.0], [id=onlineMenu, version=15.0.0], [id=openapi, version=58.0.0], [id=postman, version=0.10.0], [id=pscan, version=0.6.0], [id=pscanrules, version=75.0.0], [id=pscanrulesBeta, version=50.0.0], [id=quickstart, version=59.0.0], [id=replacer, version=22.0.0], [id=reports, version=0.46.0], [id=requester, version=7.10.0], [id=retest, version=0.11.0], [id=retire, version=0.66.0], [id=reveal, version=10.0.0], [id=scanpolicies, version=0.8.0], [id=scripts, version=45.20.0], [id=selenium, version=15.56.0], [id=sequence, version=10.0.0], [id=soap, version=32.0.0], [id=spider, version=0.20.0], [id=spiderAjax, version=23.32.0], [id=tips, version=16.0.0], [id=webdriverlinux, version=223.0.0], [id=websocket, version=38.0.0], [id=zest, version=48.14.0]]
Operating System: Linux
Architecture: amd64
CPU Cores: 6
Max Memory: 3 GB
Java Version: Debian 17.0.20
System's Locale: en
Display Locale: en_GB
Format Locale: en_GB
Default Charset: UTF-8
ZAP Home Directory: /home/zap/.ZAP/
ZAP Installation Directory: /zap/./
Look and Feel: Metal (javax.swing.plaf.metal.MetalLookAndFeel)Screenshots:
No response
Errors from the zap.log file:
No response
Additional context:
If this is an intentional limitation I would suggest not allowing alertRef in the first place for this, as this can lead to unknowingly hidding potential dangeours other issues. As you would expect for only the alertRef matched to be hidden.
A filter on name or other info or a separate alertRef filter can also provide a solution to this.
Would you like to help fix this issue?
- Yes
Source: zaproxy/zaproxy