zaproxy/zaproxy · error · IllegalArgumentException

Add-on "{name}" contains malformed zapAddOn.xml file, {reaso

Error message

Add-on "{name}" contains malformed zapAddOn.xml file, {reason}

What it means

Internal helper that throws IllegalArgumentException when a required element of zapAddOn.xml is missing or structurally invalid during dependency/extension parsing (readDependencies, readAddOnDependencies, readExtensionsWithDeps). The message names the add-on, the manifest file, and the specific reason.

Source

Thrown at zap/src/main/java/org/zaproxy/zap/control/BaseZapAddOnXmlData.java:464

            extensionsWithDeps.add(new ExtensionWithDeps(classname, addOnDeps, classnames));
        }

        return extensionsWithDeps;
    }

    private AddOnClassnames readAddOnClassnames(HierarchicalConfiguration node) {
        List<String> allowed =
                getStrings(node, CLASSNAMES_ALLOWED_ALL_ELEMENTS, CLASSNAMES_ALLOWED_ELEMENT);
        List<String> restricted =
                getStrings(node, CLASSNAMES_RESTRICTED_ALL_ELEMENTS, CLASSNAMES_RESTRICTED_ELEMENT);
        if (allowed.isEmpty() && restricted.isEmpty()) {
            return AddOnClassnames.ALL_ALLOWED;
        }
        return new AddOnClassnames(allowed, restricted);
    }

    private void malformedFile(String reason) {
        throw new IllegalArgumentException(
                "Add-on \""
                        + name
                        + "\" contains malformed "
                        + AddOn.MANIFEST_FILE_NAME
                        + " file, "
                        + reason);
    }

    public static class Dependencies {

        private final String javaVersion;

        private final List<AddOnDep> addOnDependencies;

        public Dependencies(String javaVersion, List<AddOnDep> addOnDependencies) {
            this.javaVersion = javaVersion;
            this.addOnDependencies = addOnDependencies;
        }

View on GitHub (pinned to 9d1970a436)

Solutions

1. Read the 'reason' part of the message to find the exact missing/invalid element in zapAddOn.xml
2. Regenerate the manifest from the official add-on project template (zap-extensions template) and re-add fields
3. Validate zapAddOn.xml against the ZAP manifest schema before packaging
4. Diff your manifest against a working add-on's manifest to spot structural issues

Example fix

<!-- before -->
<dependencies></dependencies>
<!-- after -->
<dependencies>
  <dependency id="selenium" />
</dependencies>

Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder()
    .parse(new InputSource(new StringReader(manifestXml)));
if (doc.getElementsByTagName("dependencies").getLength() > 0) {
    NodeList deps = doc.getElementsByTagName("dependency");
    if (deps.getLength() == 0) throw new IllegalArgumentException("<dependencies> missing <dependency> children");
}

try { parseManifest(xml); } catch (IllegalArgumentException e) { if (e.getMessage().contains("contains malformed zapAddOn.xml")) { LOGGER.error("Fix manifest structure: {}", e.getMessage()); } throw e; }

When it happens

Trigger: Parsing a manifest whose <dependencies> or <extensions> section is malformed: missing child elements, wrong element names, or invalid structure where the parser expects mandatory data.

Common situations: Hand-edited manifests with wrong XML structure; manifests from older add-on formats missing elements the current parser requires; copy-paste errors between manifests; truncation during editing.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Unrecognised status "{status}" in {name}, expected one of {A
• Add-on does not have the zapAddOn.xml file.
• InvalidAddOnException
• The mandatory add-on was not found: {id} Refer to https://ww
• DOES_NOT_EXIST

AI-assisted analysis of zaproxy/zaproxy@9d1970a436 (2026-09-05). Data as JSON: /api/errors/bd30ae93ecc9ad13. Report an issue: GitHub.