Update alert pages

site/content/docs/alerts/90011-1.md

@@ -0,0 +1,27 @@
+---
+title: "Charset Mismatch (Header Versus Meta Content-Type Charset)"
+alertid: 90011-1
+alertindex: 9001101
+alerttype: "Passive"
+alertcount: 4
+status: release
+type: alert
+risk: Informational
+solution: "Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML."
+references:
+   - https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
+other: "There was a charset mismatch between the HTTP Header and the META content-type encoding declarations: [UTF-8] and [ISO-123] do not match."
+cwe: 436
+wasc: 15
+alerttags: 
+  - CWE-436
+  - POLICY_PENTEST
+  - POLICY_QA_STD
+  - SYSTEMIC
+code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java
+linktext: "org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java"
+help: https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/#id-90011
+---
+This check identifies responses where the HTTP Content-Type header declares a charset different from the charset defined by the body of the HTML or XML. When there's a charset mismatch between the HTTP header and content body Web browsers can be forced into an undesirable content-sniffing mode to determine the content's correct character set.
+
+An attacker could manipulate content on the page to be interpreted in an encoding of their choice. For example, if an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.

site/content/docs/alerts/90011-2.md

@@ -0,0 +1,27 @@
+---
+title: "Charset Mismatch (Header Versus Meta Charset)"
+alertid: 90011-2
+alertindex: 9001102
+alerttype: "Passive"
+alertcount: 4
+status: release
+type: alert
+risk: Informational
+solution: "Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML."
+references:
+   - https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
+other: "There was a charset mismatch between the HTTP Header and the META charset encoding declaration: [UTF-8] and [ISO-123] do not match."
+cwe: 436
+wasc: 15
+alerttags: 
+  - CWE-436
+  - POLICY_PENTEST
+  - POLICY_QA_STD
+  - SYSTEMIC
+code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java
+linktext: "org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java"
+help: https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/#id-90011
+---
+This check identifies responses where the HTTP Content-Type header declares a charset different from the charset defined by the body of the HTML or XML. When there's a charset mismatch between the HTTP header and content body Web browsers can be forced into an undesirable content-sniffing mode to determine the content's correct character set.
+
+An attacker could manipulate content on the page to be interpreted in an encoding of their choice. For example, if an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.

site/content/docs/alerts/90011-3.md

@@ -0,0 +1,27 @@
+---
+title: "Charset Mismatch (Meta Charset Versus Meta Content-Type Charset)"
+alertid: 90011-3
+alertindex: 9001103
+alerttype: "Passive"
+alertcount: 4
+status: release
+type: alert
+risk: Informational
+solution: "Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML."
+references:
+   - https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
+other: "There was a charset mismatch between the META charset and the META content-type encoding declaration: [UTF-8] and [ISO-123] do not match."
+cwe: 436
+wasc: 15
+alerttags: 
+  - CWE-436
+  - POLICY_PENTEST
+  - POLICY_QA_STD
+  - SYSTEMIC
+code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java
+linktext: "org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java"
+help: https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/#id-90011
+---
+This check identifies responses where the HTTP Content-Type header declares a charset different from the charset defined by the body of the HTML or XML. When there's a charset mismatch between the HTTP header and content body Web browsers can be forced into an undesirable content-sniffing mode to determine the content's correct character set.
+
+An attacker could manipulate content on the page to be interpreted in an encoding of their choice. For example, if an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.

site/content/docs/alerts/90011-4.md

@@ -0,0 +1,27 @@
+---
+title: "Charset Mismatch"
+alertid: 90011-4
+alertindex: 9001104
+alerttype: "Passive"
+alertcount: 4
+status: release
+type: alert
+risk: Informational
+solution: "Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML."
+references:
+   - https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
+other: "There was a charset mismatch between the HTTP Header and the XML encoding declaration: [UTF-8] and [ISO-123] do not match."
+cwe: 436
+wasc: 15
+alerttags: 
+  - CWE-436
+  - POLICY_PENTEST
+  - POLICY_QA_STD
+  - SYSTEMIC
+code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java
+linktext: "org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java"
+help: https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/#id-90011
+---
+This check identifies responses where the HTTP Content-Type header declares a charset different from the charset defined by the body of the HTML or XML. When there's a charset mismatch between the HTTP header and content body Web browsers can be forced into an undesirable content-sniffing mode to determine the content's correct character set.
+
+An attacker could manipulate content on the page to be interpreted in an encoding of their choice. For example, if an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.

site/content/docs/alerts/90011.md

@@ -3,24 +3,21 @@ title: "Charset Mismatch"
 alertid: 90011
 alertindex: 9001100
 alerttype: "Passive"
-alertcount: 1
 status: release
-type: alert
-risk: Informational
-solution: "Force UTF-8 for all text content in both the HTTP header and meta tags in HTML or encoding declarations in XML."
-references:
-   - https://code.google.com/p/browsersec/wiki/Part2#Character_set_handling_and_detection
-other: ""
-cwe: 436
-wasc: 15
-alerttags: 
-  - POLICY_PENTEST
-  - POLICY_QA_STD
-  - SYSTEMIC
+type: alertset
+alerts:
+   90011-1:
+      alertid: 90011-1
+      name: "Charset Mismatch (Header Versus Meta Content-Type Charset)"
+   90011-2:
+      alertid: 90011-2
+      name: "Charset Mismatch (Header Versus Meta Charset)"
+   90011-3:
+      alertid: 90011-3
+      name: "Charset Mismatch (Meta Charset Versus Meta Content-Type Charset)"
+   90011-4:
+      alertid: 90011-4
+      name: "Charset Mismatch"
 code: https://github.com/zaproxy/zap-extensions/blob/main/addOns/pscanrules/src/main/java/org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java
 linktext: "org/zaproxy/zap/extension/pscanrules/CharsetMismatchScanRule.java"
-help: https://www.zaproxy.org/docs/desktop/addons/passive-scan-rules/#id-90011
 ---
-This check identifies responses where the HTTP Content-Type header declares a charset different from the charset defined by the body of the HTML or XML. When there's a charset mismatch between the HTTP header and content body Web browsers can be forced into an undesirable content-sniffing mode to determine the content's correct character set.
-
-An attacker could manipulate content on the page to be interpreted in an encoding of their choice. For example, if an attacker can control content at the beginning of the page, they could inject script using UTF-7 encoded text and manipulate some browsers into interpreting that text.

site/data/alerttags.yml

@@ -133,6 +133,9 @@ CWE-425:
 CWE-434:
   link: https://cwe.mitre.org/data/definitions/434.html
 
+CWE-436:
+  link: https://cwe.mitre.org/data/definitions/436.html
+
 CWE-472:
   link: https://cwe.mitre.org/data/definitions/472.html