For a Java Applet the proxy details can be set via the Java Control Panel.
Configure Proxies through the Java Control Panel
In the Java Control Panel, under the General tab, click on Network Settings.
Select the Use Browser Settings checkbox.
Click OK to save your changes.
Network Settings for the ...
We will be deprecating that passive scan rule shortly.
Here's the issue: https://github.com/zaproxy/zaproxy/issues/5849
Here are the related PRs:
You should really have CSP in place, as for whether or not it matters for those files it depends if they exist, ...
In theory, sitemap.xml could be an issue. There are lots of nasty tricks you can do with xml. In reality, it would be a very, very difficult attack to pull off (especially given the likely scenario that this is a static file).
It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive.
If you're seeing it a lot you could go into the Scan Policy and disable that one scan rule.
You could also grab the Alert Filters addon and use it to tweak things.
Lastly ZAP is Open Source so you could always check the source of the ...