diff --git a/src/lib/CMakeLists.txt b/src/lib/CMakeLists.txt
index ed974b65..3e3ef5e1 100644
--- a/src/lib/CMakeLists.txt
+++ b/src/lib/CMakeLists.txt
@@ -36,6 +36,7 @@ add_library(cs STATIC
     parser-json-sarif.cc
     parser-json-shchk.cc
     parser-json-simple.cc
+    parser-json-zap.cc
     parser-xml.cc
     parser-xml-valgrind.cc
     shared-string.cc
diff --git a/src/lib/parser-common.hh b/src/lib/parser-common.hh
index 4c53dd98..a58ff135 100644
--- a/src/lib/parser-common.hh
+++ b/src/lib/parser-common.hh
@@ -29,6 +29,10 @@
 #define RE_CHECKER_NAME_MISRA "(?:MISRA C(?:\\+\\+)?-[0-9]+ (?:Directive|Rule) [0-9.-]+)"
 #define RE_CHECKER_NAME RE_CHECKER_NAME_SA "|" RE_CHECKER_NAME_CERT "|" RE_CHECKER_NAME_MISRA
 
+#define RE_PATH_LOCAL "[^:]+"
+#define RE_PATH_URL "http(?:s)?://[^:]+(?::[0-9]+)?[^:]+"
+#define RE_PATH RE_PATH_LOCAL "|" RE_PATH_URL
+
 #define RE_EVENT_GCC "(?:(?:(?:fatal|internal) )?[A-Za-z][A-Za-z0-9_-]+)(?:\\[[^ \\]]+\\])?"
 #define RE_EVENT_PROSPECTOR "(?:[A-Z]+[0-9]+\\[[a-z0-9-]+\\])"
 #define RE_EVENT RE_EVENT_GCC "|" RE_EVENT_PROSPECTOR
diff --git a/src/lib/parser-cov.cc b/src/lib/parser-cov.cc
index 50d2a387..39fc87b1 100644
--- a/src/lib/parser-cov.cc
+++ b/src/lib/parser-cov.cc
@@ -151,7 +151,7 @@ class ErrFileLexer {
             RE("^Error: *(" RE_CHECKER_NAME ")( *\\([^)]+\\))? *:(?: \\[#def[0-9]+\\])?$");
 
         const RE reEvent_ =
-            RE(/* location */ "^([^:]+)(?::([0-9]+|<[Uu]nknown>))?(?::([0-9]+))?"
+            RE(/* location */ "^(" RE_PATH ")(?::([0-9]+|<[Uu]nknown>))?(?::([0-9]+))?"
                /* evt/mesg */ ": (" RE_EVENT "): (.*)$");
 };
 
@@ -279,6 +279,9 @@ KeyEventDigger::KeyEventDigger():
     d->hMap["GCC_ANALYZER_WARNING"] .insert("warning");
     d->hMap["GCC_ANALYZER_WARNING"] .insert("fatal error");
 
+    // OWASP ZAP uses "alert" as the key event
+    d->hMap["OWASP_ZAP_WARNING"]    .insert("alert");
+
     // events that should never be used as key events (excluding trace events)
     d->denyList.insert("another_instance");
     d->denyList.insert("comparison_remediation");
diff --git a/src/lib/parser-json-zap.cc b/src/lib/parser-json-zap.cc
new file mode 100644
index 00000000..89f3cca0
--- /dev/null
+++ b/src/lib/parser-json-zap.cc
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2022 Red Hat, Inc.
+ *
+ * This file is part of csdiff.
+ *
+ * csdiff is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * any later version.
+ *
+ * csdiff is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with csdiff.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "parser-json-zap.hh"
+
+struct ZapTreeDecoder::Private {
+    std::string                     timeStamp;
+    Defect                          sitePrototype;
+    Defect                          alertPrototype;
+    const pt::ptree                *alertList = nullptr;
+    const pt::ptree                *instList = nullptr;
+    pt::ptree::const_iterator       alertIter;
+    pt::ptree::const_iterator       instIter;
+
+    Private()
+    {
+        this->sitePrototype.checker = "OWASP_ZAP_WARNING";
+        this->sitePrototype.tool    = "owasp-zap";
+    }
+
+    void readSiteProto(const pt::ptree &siteNode);
+    void readAlertProto(const pt::ptree &alertNode);
+    void readAlertInst(Defect *pDef, const pt::ptree &instNode);
+};
+
+template <typename TPropList>
+void readNonEmptyProps(
+        TEvtList                   *pDst,
+        const pt::ptree            &node,
+        const DefEvent             &evtProto,
+        const TPropList            &propList)
+{
+    // make our own copy of the given prototype event
+    DefEvent evt = evtProto;
+
+    for (const auto &evtName : propList) {
+        evt.event = evtName;
+        evt.msg = valueOf<std::string>(node, evtName);
+        if (!evt.msg.empty())
+            pDst->push_back(evt);
+    }
+}
+
+void ZapTreeDecoder::Private::readSiteProto(const pt::ptree &siteNode)
+{
+    this->sitePrototype.events.clear();
+    const auto siteName = valueOf<std::string>(siteNode, "@name");
+    if (siteName.empty() || this->timeStamp.empty())
+        return;
+
+    // create a prototype "note" event
+    DefEvent siteEvt("note");
+    siteEvt.fileName = std::move(siteName);
+    siteEvt.msg = "dynamically analyzed on " + this->timeStamp;
+    siteEvt.verbosityLevel = /* info event */ 1;
+    this->sitePrototype.events.push_back(std::move(siteEvt));
+}
+
+void ZapTreeDecoder::Private::readAlertProto(const pt::ptree &alertNode)
+{
+    // read per-alert properties
+    this->alertPrototype = this->sitePrototype;
+    this->alertPrototype.cwe = valueOf<int>(alertNode, "cweid");
+    this->alertPrototype.imp = (1 < valueOf<int>(alertNode, "riskcode"));
+
+    // initialize key event
+    DefEvent evt("alert");
+
+    // get "uri" from the prototype event
+    TEvtList &events = this->alertPrototype.events;
+    if (!events.empty())
+        evt.fileName = events.front().fileName;
+
+    // read "alertRef" if available
+    const auto alertRef = valueOf<std::string>(alertNode, "alertRef");
+    if (!alertRef.empty())
+        evt.event += "[" + alertRef + "]";
+
+    // read "alert" if available
+    evt.msg = valueOf<std::string>(alertNode, "alert");
+
+    // append the key event
+    this->alertPrototype.keyEventIdx = events.size();
+    events.push_back(evt);
+
+    // read other per-alert events if available
+    evt.verbosityLevel = /* info event */ 1;
+    const auto defProps = { "desc", "solution", "otherinfo", "reference" };
+    readNonEmptyProps(&events, alertNode, evt, defProps);
+}
+
+void ZapTreeDecoder::Private::readAlertInst(
+        Defect                      *pDef,
+        const pt::ptree             &instNode)
+{
+    // start with the prototype initialized by readAlertProto()
+    *pDef = this->alertPrototype;
+    TEvtList &events = pDef->events;
+
+    // reinitialize events with "uri" specific for this instance (if available)
+    const std::string uri = valueOf<std::string>(instNode, "uri");
+    if (!uri.empty())
+        for (DefEvent &evt : events)
+            evt.fileName = uri;
+
+    // use the key event as a prototype for instance-specific events
+    DefEvent evtProto = events[pDef->keyEventIdx];
+    evtProto.verbosityLevel = /* info event */ 1;
+
+    // read per-instance properties
+    const auto instProps = { "method", "param", "attack", "evidence" };
+    readNonEmptyProps(&events, instNode, evtProto, instProps);
+}
+
+ZapTreeDecoder::ZapTreeDecoder():
+    d(new Private)
+{
+}
+
+ZapTreeDecoder::~ZapTreeDecoder() = default;
+
+void ZapTreeDecoder::readScanProps(
+        TScanProps                 *pDst,
+        const pt::ptree            *root)
+{
+    const auto version = valueOf<std::string>(*root, "@version");
+    if (!version.empty())
+        (*pDst)["analyzer-version-owasp-zap"] = version;
+
+    d->timeStamp = valueOf<std::string>(*root, "@generated");
+}
+
+const pt::ptree* ZapTreeDecoder::nextAlert()
+{
+    // iterate over sites unless we are processing a site already
+    while (!d->alertList || d->alertList->end() == d->alertIter) {
+        const pt::ptree *siteNode = this->nextNode();
+        if (!siteNode)
+            // failed initialization or EOF
+            return nullptr;
+
+        if (!findChildOf(&d->alertList, *siteNode, "alerts")) {
+            // "alerts" node missing for this site
+            d->alertList = nullptr;
+            continue;
+        }
+
+        // initialize iteration over alerts
+        d->alertIter = d->alertList->begin();
+        d->instList = nullptr;
+
+        if (!d->alertList->empty())
+            // site with alerts found --> update site prototype
+            d->readSiteProto(*siteNode);
+    }
+
+    // get the current alert and move to the next one
+    const auto itAlertNow = d->alertIter++;
+    return &itAlertNow->second;
+}
+
+bool ZapTreeDecoder::readNode(Defect *pDef)
+{
+    if (!d->instList || d->instList->end() == d->instIter) {
+        // iterate over alerts
+        const pt::ptree *alertNode = this->nextAlert();
+        if (!alertNode)
+            // failed initialization or EOF
+            return false;
+
+        // process the current alert
+        d->readAlertProto(*alertNode);
+
+        // read the list of instances
+        if (!findChildOf(&d->instList, *alertNode, "instances")
+                || d->instList->empty())
+        {
+            // no instances for this alert --> emit the prototype
+            d->instList = nullptr;
+            *pDef = d->alertPrototype;
+            return true;
+        }
+
+        // initialize iteration over instances
+        d->instIter = d->instList->begin();
+    }
+
+    // get the current instance and move to the next one
+    const auto itInstNow = d->instIter++;
+
+    // process the current instance
+    d->readAlertInst(pDef, itInstNow->second);
+    return true;
+}
diff --git a/src/lib/parser-json-zap.hh b/src/lib/parser-json-zap.hh
new file mode 100644
index 00000000..3300a7cc
--- /dev/null
+++ b/src/lib/parser-json-zap.hh
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012-2022 Red Hat, Inc.
+ *
+ * This file is part of csdiff.
+ *
+ * csdiff is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * any later version.
+ *
+ * csdiff is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with csdiff.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef H_GUARD_PARSER_JSON_ZAP_H
+#define H_GUARD_PARSER_JSON_ZAP_H
+
+#include "abstract-tree.hh"
+
+/// tree decoder of the OWASP ZAP JSON format
+class ZapTreeDecoder: public AbstractTreeDecoder {
+    public:
+        ZapTreeDecoder();
+        ~ZapTreeDecoder() override;
+
+        void readScanProps(
+                TScanProps             *pDst,
+                const pt::ptree        *root)
+            override;
+
+        bool readNode(Defect *def) override;
+
+    private:
+        struct Private;
+        std::unique_ptr<Private> d;
+        const pt::ptree* nextAlert();
+};
+
+#endif /* H_GUARD_PARSER_JSON_ZAP_H */
diff --git a/src/lib/parser-json.cc b/src/lib/parser-json.cc
index 0b3a74f0..8b4fe30e 100644
--- a/src/lib/parser-json.cc
+++ b/src/lib/parser-json.cc
@@ -24,6 +24,7 @@
 #include "parser-json-sarif.hh"
 #include "parser-json-shchk.hh"
 #include "parser-json-simple.hh"
+#include "parser-json-zap.hh"
 
 #include <boost/property_tree/json_parser.hpp>
 
@@ -83,6 +84,9 @@ JsonParser::JsonParser(InStream &input):
         else if (findChildOf(&node, d->root, "comments"))
             // ShellCheck JSON format
             d->decoder.reset(new ShellCheckTreeDecoder);
+        else if (findChildOf(&node, d->root, "site"))
+            // OWASP ZAP JSON format
+            d->decoder.reset(new ZapTreeDecoder);
         else if (first.not_found() != first.find("kind"))
             // GCC JSON format
             d->decoder.reset(new GccTreeDecoder);
diff --git a/tests/csgrep/0103-json-parser-zap-args.txt b/tests/csgrep/0103-json-parser-zap-args.txt
new file mode 100644
index 00000000..7df3c951
--- /dev/null
+++ b/tests/csgrep/0103-json-parser-zap-args.txt
@@ -0,0 +1 @@
+--mode=json
diff --git a/tests/csgrep/0103-json-parser-zap-stdin.txt b/tests/csgrep/0103-json-parser-zap-stdin.txt
new file mode 100644
index 00000000..7373fc65
--- /dev/null
+++ b/tests/csgrep/0103-json-parser-zap-stdin.txt
@@ -0,0 +1,106 @@
+{
+        "@version": "2.11.1",
+        "@generated": "Tue, 9 Aug 2022 14:38:31",
+        "site":[ 
+                {
+                        "@name": "http://rhos-fedora-devel.usersys.redhat.com:5000",
+                        "@host": "rhos-fedora-devel.usersys.redhat.com",
+                        "@port": "5000",
+                        "@ssl": "false",
+                        "alerts": [ 
+                                {
+                                        "pluginid": "90022",
+                                        "alertRef": "90022",
+                                        "alert": "Application Error Disclosure",
+                                        "name": "Application Error Disclosure",
+                                        "riskcode": "1",
+                                        "confidence": "2",
+                                        "riskdesc": "Low (Medium)",
+                                        "desc": "<p>This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.</p>",
+                                        "instances":[ 
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                                                        "method": "GET",
+                                                        "param": "",
+                                                        "attack": "",
+                                                        "evidence": "HTTP/1.1 500 INTERNAL SERVER ERROR"
+                                                }
+                                        ],
+                                        "count": "1",
+                                        "solution": "<p>Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.</p>",
+                                        "otherinfo": "",
+                                        "reference": "",
+                                        "cweid": "200",
+                                        "wascid": "13",
+                                        "sourceid": "7"
+                                },
+                                {
+                                        "pluginid": "10023",
+                                        "alertRef": "10023",
+                                        "alert": "Information Disclosure - Debug Error Messages",
+                                        "name": "Information Disclosure - Debug Error Messages",
+                                        "riskcode": "1",
+                                        "confidence": "2",
+                                        "riskdesc": "Low (Medium)",
+                                        "desc": "<p>The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.</p>",
+                                        "instances":[ 
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                                                        "method": "GET",
+                                                        "param": "",
+                                                        "attack": "",
+                                                        "evidence": "Internal Server Error"
+                                                }
+                                        ],
+                                        "count": "1",
+                                        "solution": "<p>Disable debugging messages before pushing to production.</p>",
+                                        "otherinfo": "",
+                                        "reference": "",
+                                        "cweid": "200",
+                                        "wascid": "13",
+                                        "sourceid": "7"
+                                },
+                                {
+                                        "pluginid": "10021",
+                                        "alertRef": "10021",
+                                        "alert": "X-Content-Type-Options Header Missing",
+                                        "name": "X-Content-Type-Options Header Missing",
+                                        "riskcode": "1",
+                                        "confidence": "2",
+                                        "riskdesc": "Low (Medium)",
+                                        "desc": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                                        "instances":[ 
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                                                        "method": "GET",
+                                                        "param": "X-Content-Type-Options",
+                                                        "attack": "",
+                                                        "evidence": ""
+                                                },
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                                                        "method": "GET",
+                                                        "param": "X-Content-Type-Options",
+                                                        "attack": "",
+                                                        "evidence": ""
+                                                },
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                                                        "method": "GET",
+                                                        "param": "X-Content-Type-Options",
+                                                        "attack": "",
+                                                        "evidence": ""
+                                                }
+                                        ],
+                                        "count": "3",
+                                        "solution": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                                        "otherinfo": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                                        "reference": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                                        "cweid": "693",
+                                        "wascid": "15",
+                                        "sourceid": "1"
+                                }
+                        ]
+                }
+        ]
+}
diff --git a/tests/csgrep/0103-json-parser-zap-stdout.txt b/tests/csgrep/0103-json-parser-zap-stdout.txt
new file mode 100644
index 00000000..bb6921eb
--- /dev/null
+++ b/tests/csgrep/0103-json-parser-zap-stdout.txt
@@ -0,0 +1,299 @@
+{
+    "scan": {
+        "analyzer-version-owasp-zap": "2.11.1"
+    },
+    "defects": [
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 200,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "alert[90022]",
+                    "message": "Application Error Disclosure",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "evidence",
+                    "message": "HTTP/1.1 500 INTERNAL SERVER ERROR",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 200,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "alert[10023]",
+                    "message": "Information Disclosure - Debug Error Messages",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Disable debugging messages before pushing to production.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "evidence",
+                    "message": "Internal Server Error",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 693,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "alert[10021]",
+                    "message": "X-Content-Type-Options Header Missing",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "otherinfo",
+                    "message": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 693,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "alert[10021]",
+                    "message": "X-Content-Type-Options Header Missing",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "otherinfo",
+                    "message": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 693,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "alert[10021]",
+                    "message": "X-Content-Type-Options Header Missing",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "otherinfo",
+                    "message": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                }
+            ]
+        }
+    ]
+}
diff --git a/tests/csgrep/0104-cov-parser-zap-args.txt b/tests/csgrep/0104-cov-parser-zap-args.txt
new file mode 100644
index 00000000..888ec755
--- /dev/null
+++ b/tests/csgrep/0104-cov-parser-zap-args.txt
@@ -0,0 +1 @@
+--mode=json --set-scan-prop=analyzer-version-zap:2.11.1
diff --git a/tests/csgrep/0104-cov-parser-zap-stdin.txt b/tests/csgrep/0104-cov-parser-zap-stdin.txt
new file mode 100644
index 00000000..8572b255
--- /dev/null
+++ b/tests/csgrep/0104-cov-parser-zap-stdin.txt
@@ -0,0 +1,29 @@
+Error: OWASP_ZAP_WARNING (CWE-200):
+http://rhos-fedora-devel.usersys.redhat.com:5000: note: dynamically analyzed on Tue, 9 Aug 2022 14:38:31
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: alert[90022]: Application Error Disclosure
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: desc: <p>This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: solution: <p>Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: method: GET
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: evidence: HTTP/1.1 500 INTERNAL SERVER ERROR
+
+Error: OWASP_ZAP_WARNING (CWE-200):
+http://rhos-fedora-devel.usersys.redhat.com:5000: note: dynamically analyzed on Tue, 9 Aug 2022 14:38:31
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: alert[10023]: Information Disclosure - Debug Error Messages
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: desc: <p>The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: solution: <p>Disable debugging messages before pushing to production.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: method: GET
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id: evidence: Internal Server Error
+
+Error: OWASP_ZAP_WARNING (CWE-693):
+http://rhos-fedora-devel.usersys.redhat.com:5000: note: dynamically analyzed on Tue, 9 Aug 2022 14:38:31
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: alert[10021]: X-Content-Type-Options Header Missing
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: desc: <p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: solution: <p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: otherinfo: <p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At "High" threshold this scan rule will not alert on client or server error responses.</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: reference: <p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: method: GET
+http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json: param: X-Content-Type-Options
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/: method: GET
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/: param: X-Content-Type-Options
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name: method: GET
+http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name: param: X-Content-Type-Options
diff --git a/tests/csgrep/0104-cov-parser-zap-stdout.txt b/tests/csgrep/0104-cov-parser-zap-stdout.txt
new file mode 100644
index 00000000..719cc3a9
--- /dev/null
+++ b/tests/csgrep/0104-cov-parser-zap-stdout.txt
@@ -0,0 +1,199 @@
+{
+    "scan": {
+        "analyzer-version-zap": "2.11.1"
+    },
+    "defects": [
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 200,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "alert[90022]",
+                    "message": "Application Error Disclosure",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "evidence",
+                    "message": "HTTP/1.1 500 INTERNAL SERVER ERROR",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 200,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "alert[10023]",
+                    "message": "Information Disclosure - Debug Error Messages",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Disable debugging messages before pushing to production.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/id/pet_id",
+                    "line": 0,
+                    "event": "evidence",
+                    "message": "Internal Server Error",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 693,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Tue, 9 Aug 2022 14:38:31",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "alert[10021]",
+                    "message": "X-Content-Type-Options Header Missing",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "otherinfo",
+                    "message": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/docs/openapi.json",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "method",
+                    "message": "GET",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:5000/pets/name/pet_name",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                }
+            ]
+        }
+    ]
+}
diff --git a/tests/csgrep/0105-json-parser-zap-args.txt b/tests/csgrep/0105-json-parser-zap-args.txt
new file mode 100644
index 00000000..7df3c951
--- /dev/null
+++ b/tests/csgrep/0105-json-parser-zap-args.txt
@@ -0,0 +1 @@
+--mode=json
diff --git a/tests/csgrep/0105-json-parser-zap-stdin.txt b/tests/csgrep/0105-json-parser-zap-stdin.txt
new file mode 100644
index 00000000..b7f6ac7d
--- /dev/null
+++ b/tests/csgrep/0105-json-parser-zap-stdin.txt
@@ -0,0 +1,100 @@
+{
+        "@version": "2.11.1",
+        "@generated": "Wed, 10 Aug 2022 10:13:02",
+        "site":[ 
+                {
+                        "@name": "http://rhos-fedora-devel.usersys.redhat.com:9000",
+                        "@host": "rhos-fedora-devel.usersys.redhat.com",
+                        "@port": "9000",
+                        "@ssl": "false",
+                        "alerts": [ 
+                                {
+                                        "pluginid": "40018",
+                                        "alertRef": "40018",
+                                        "alert": "SQL Injection - SQLite",
+                                        "name": "SQL Injection - SQLite",
+                                        "riskcode": "3",
+                                        "confidence": "2",
+                                        "riskdesc": "High (Medium)",
+                                        "desc": "<p>SQL injection may be possible.</p>",
+                                        "instances":[ 
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                                                        "method": "POST",
+                                                        "param": "month",
+                                                        "attack": ";",
+                                                        "evidence": "near \";\": syntax error"
+                                                }
+                                        ],
+                                        "count": "1",
+                                        "solution": "<p>Do not trust client side input, even if there is client side validation in place.  </p><p>In general, type check all data on the server side.</p><p>If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'</p><p>If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.</p><p>If database Stored Procedures can be used, use them.</p><p>Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!</p><p>Do not create dynamic SQL queries using simple string concatenation.</p><p>Escape all data received from the client.</p><p>Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.</p><p>Apply the principle of least privilege by using the least privileged database user possible.</p><p>In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.</p><p>Grant the minimum database access that is necessary for the application.</p>",
+                                        "otherinfo": "<p>RDBMS [SQLite] likely, given error message regular expression [near \".+\": syntax error] matched by the HTML results.</p><p>The vulnerability was detected by manipulating the parameter to cause a database error message to be returned and recognised</p>",
+                                        "reference": "<p>https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html</p>",
+                                        "cweid": "89",
+                                        "wascid": "19",
+                                        "sourceid": "63"
+                                },
+                                {
+                                        "pluginid": "40009",
+                                        "alertRef": "40009",
+                                        "alert": "Server Side Include",
+                                        "name": "Server Side Include",
+                                        "riskcode": "3",
+                                        "confidence": "2",
+                                        "riskdesc": "High (Medium)",
+                                        "desc": "<p>Certain parameters may cause Server Side Include commands to be executed.  This may allow database connection or arbitrary code to be executed.</p>",
+                                        "instances":[ 
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                                                        "method": "POST",
+                                                        "param": "month",
+                                                        "attack": "<!--#EXEC cmd=\"ls /\"-->",
+                                                        "evidence": "root'\nHOSTNAME = 'dfd2f63e3bbf'\nHTTP_ACCEPT = '*/*'\nHTTP_CACHE_CONTROL = 'no-cache'\nHTTP_HOST = 'rhos-fedora-devel.usersys.redhat.com:9000'\nHTTP_PRAGMA = 'no-cache'\nHTTP_USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0'\nPATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr"
+                                                }
+                                        ],
+                                        "count": "1",
+                                        "solution": "<p>Do not trust client side input and enforce a tight check in the server side.  Disable server side includes.</p><p></p>",
+                                        "otherinfo": "",
+                                        "reference": "<p>http://www.carleton.ca/~dmcfet/html/ssi.html</p>",
+                                        "cweid": "97",
+                                        "wascid": "31",
+                                        "sourceid": "38"
+                                },
+                                {
+                                        "pluginid": "10021",
+                                        "alertRef": "10021",
+                                        "alert": "X-Content-Type-Options Header Missing",
+                                        "name": "X-Content-Type-Options Header Missing",
+                                        "riskcode": "1",
+                                        "confidence": "2",
+                                        "riskdesc": "Low (Medium)",
+                                        "desc": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                                        "instances":[ 
+                                                {
+                                                        "uri": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                                                        "method": "POST",
+                                                        "param": "X-Content-Type-Options",
+                                                        "attack": "",
+                                                        "evidence": ""
+                                                }
+                                        ],
+                                        "count": "1",
+                                        "solution": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                                        "otherinfo": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                                        "reference": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                                        "cweid": "693",
+                                        "wascid": "15",
+                                        "sourceid": "3"
+                                }
+                        ]
+                },
+                {
+                        "@name": "http://rhos-fedora-devel.usersys.redhat.com:9001",
+                        "@host": "rhos-fedora-devel.usersys.redhat.com",
+                        "@port": "9001",
+                        "@ssl": "false",
+                        "alerts": [ 
+                        ]
+                }
+        ]
+}
diff --git a/tests/csgrep/0105-json-parser-zap-stdout.txt b/tests/csgrep/0105-json-parser-zap-stdout.txt
new file mode 100644
index 00000000..42f23b00
--- /dev/null
+++ b/tests/csgrep/0105-json-parser-zap-stdout.txt
@@ -0,0 +1,222 @@
+{
+    "scan": {
+        "analyzer-version-owasp-zap": "2.11.1"
+    },
+    "defects": [
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 89,
+            "imp": 1,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "alert[40018]",
+                    "message": "SQL Injection - SQLite",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>SQL injection may be possible.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Do not trust client side input, even if there is client side validation in place.  </p><p>In general, type check all data on the server side.</p><p>If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'</p><p>If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.</p><p>If database Stored Procedures can be used, use them.</p><p>Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!</p><p>Do not create dynamic SQL queries using simple string concatenation.</p><p>Escape all data received from the client.</p><p>Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.</p><p>Apply the principle of least privilege by using the least privileged database user possible.</p><p>In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.</p><p>Grant the minimum database access that is necessary for the application.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "otherinfo",
+                    "message": "<p>RDBMS [SQLite] likely, given error message regular expression [near \".+\": syntax error] matched by the HTML results.</p><p>The vulnerability was detected by manipulating the parameter to cause a database error message to be returned and recognised</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "method",
+                    "message": "POST",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "param",
+                    "message": "month",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "attack",
+                    "message": ";",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "evidence",
+                    "message": "near \";\": syntax error",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 97,
+            "imp": 1,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "alert[40009]",
+                    "message": "Server Side Include",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>Certain parameters may cause Server Side Include commands to be executed.  This may allow database connection or arbitrary code to be executed.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Do not trust client side input and enforce a tight check in the server side.  Disable server side includes.</p><p></p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>http://www.carleton.ca/~dmcfet/html/ssi.html</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "method",
+                    "message": "POST",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "param",
+                    "message": "month",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "attack",
+                    "message": "<!--#EXEC cmd=\"ls /\"-->",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "evidence",
+                    "message": "root'\nHOSTNAME = 'dfd2f63e3bbf'\nHTTP_ACCEPT = '*/*'\nHTTP_CACHE_CONTROL = 'no-cache'\nHTTP_HOST = 'rhos-fedora-devel.usersys.redhat.com:9000'\nHTTP_PRAGMA = 'no-cache'\nHTTP_USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0'\nPATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr",
+                    "verbosity_level": 1
+                }
+            ]
+        },
+        {
+            "checker": "OWASP_ZAP_WARNING",
+            "cwe": 693,
+            "tool": "owasp-zap",
+            "key_event_idx": 1,
+            "events": [
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "note",
+                    "message": "dynamically analyzed on Wed, 10 Aug 2022 10:13:02",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "alert[10021]",
+                    "message": "X-Content-Type-Options Header Missing",
+                    "verbosity_level": 0
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "desc",
+                    "message": "<p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "solution",
+                    "message": "<p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "otherinfo",
+                    "message": "<p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At \"High\" threshold this scan rule will not alert on client or server error responses.</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "reference",
+                    "message": "<p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p>",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "method",
+                    "message": "POST",
+                    "verbosity_level": 1
+                },
+                {
+                    "file_name": "http://rhos-fedora-devel.usersys.redhat.com:9000/api/v1/activities/",
+                    "line": 0,
+                    "event": "param",
+                    "message": "X-Content-Type-Options",
+                    "verbosity_level": 1
+                }
+            ]
+        }
+    ]
+}
diff --git a/tests/csgrep/CMakeLists.txt b/tests/csgrep/CMakeLists.txt
index 701007ea..eb38a528 100644
--- a/tests/csgrep/CMakeLists.txt
+++ b/tests/csgrep/CMakeLists.txt
@@ -146,6 +146,9 @@ test_csgrep("0099-csparser-his-metrics"               )
 test_csgrep("0100-sarif-parser-gitleaks"              )
 test_csgrep("0101-json-parser-empty"                  )
 test_csgrep("0102-xml-parser-empty"                   )
+test_csgrep("0103-json-parser-zap"                    )
+test_csgrep("0104-cov-parser-zap"                     )
+test_csgrep("0105-json-parser-zap"                    )
 test_csgrep("0106-snyk-prepend-path"                  )
 test_csgrep("0107-gcc-prepend-path"                   )
 test_csgrep("0108-sarif-empty-results"                )