Repository: zaproxy/zaproxy
Issue: Misspelling in `config.xml` `scanner.antiCSFR` should be `scanner.antiCSRF`

### Describe the bug

Minor typo.

### Steps to reproduce the behavior

`grep CSFR ~/.ZAP/config.xml`

### Expected behavior

Just a spelling correction but may have larger ramifications since it's in the config file.

### Software versions

2.12.0

### Screenshots

_No response_

### Errors from the zap.log file

_No response_

### Additional context

_No response_

### Would you like to help fix this issue?

- [ ] Yes

Changed files:
zap/src/main/java/org/parosproxy/paros/core/scanner/ScannerParam.java, zap/src/test/java/org/parosproxy/paros/core/scanner/ScannerParamUnitTest.java

diff --git a/zap/src/main/java/org/parosproxy/paros/core/scanner/ScannerParam.java b/zap/src/main/java/org/parosproxy/paros/core/scanner/ScannerParam.java
index 0a2685f04..fe571edea 100644
--- a/zap/src/main/java/org/parosproxy/paros/core/scanner/ScannerParam.java
+++ b/zap/src/main/java/org/parosproxy/paros/core/scanner/ScannerParam.java
@@ -77,7 +77,7 @@ public class ScannerParam extends AbstractParam {
     // ZAP: Added support for delayInMs
     private static final String DELAY_IN_MS = ACTIVE_SCAN_BASE_KEY + ".delayInMs";
     private static final String INJECT_PLUGIN_ID_IN_HEADER = ACTIVE_SCAN_BASE_KEY + ".pluginHeader";
-    private static final String HANDLE_ANTI_CSRF_TOKENS = ACTIVE_SCAN_BASE_KEY + ".antiCSFR";
+    private static final String HANDLE_ANTI_CSRF_TOKENS = ACTIVE_SCAN_BASE_KEY + ".antiCSRF";
     private static final String PROMPT_IN_ATTACK_MODE = ACTIVE_SCAN_BASE_KEY + ".attackPrompt";
     private static final String RESCAN_IN_ATTACK_MODE = ACTIVE_SCAN_BASE_KEY + ".attackRescan";
     private static final String PROMPT_TO_CLEAR_FINISHED = ACTIVE_SCAN_BASE_KEY + ".clearFinished";
@@ -219,7 +219,7 @@ public class ScannerParam extends AbstractParam {
 
     @Override
     protected void parse() {
-        removeOldOptions();
+        migrateOldOptions();
 
         this.threadPerHost = Math.max(1, getInt(THREAD_PER_HOST, 2));
 
@@ -311,8 +311,14 @@ public class ScannerParam extends AbstractParam {
         }
     }
 
-    private void removeOldOptions() {
-        final String oldKey = "scanner.deleteOnShutdown";
+    private void migrateOldOptions() {
+        String oldKey = "scanner.antiCSFR";
+        if (getConfig().containsKey(oldKey)) {
+            getConfig().setProperty(HANDLE_ANTI_CSRF_TOKENS, getConfig().getProperty(oldKey));
+            getConfig().clearProperty(oldKey);
+        }
+
+        oldKey = "scanner.deleteOnShutdown";
         if (getConfig().containsKey(oldKey)) {
             getConfig().clearProperty(oldKey);
         }
diff --git a/zap/src/test/java/org/parosproxy/paros/core/scanner/ScannerParamUnitTest.java b/zap/src/test/java/org/parosproxy/paros/core/scanner/ScannerParamUnitTest.java
index 1fb294b8f..91e4c504c 100644
--- a/zap/src/test/java/org/parosproxy/paros/core/scanner/ScannerParamUnitTest.java
+++ b/zap/src/test/java/org/parosproxy/paros/core/scanner/ScannerParamUnitTest.java
@@ -22,6 +22,7 @@ package org.parosproxy.paros.core.scanner;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.mockito.Mockito.mock;
 
 import org.junit.jupiter.api.AfterAll;
@@ -185,4 +186,18 @@ class ScannerParamUnitTest {
         assertThat(
                 configuration.getBoolean(ScannerParam.SCAN_NULL_JSON_VALUES), is(equalTo(value)));
     }
+
+    @Test
+    void shouldMigrateOldOptions() {
+        // Given
+        configuration.setProperty("scanner.deleteOnShutdown", true);
+        configuration.setProperty("scanner.antiCSRF", true);
+        // When
+        param.load(configuration);
+        // Then
+        assertThat(configuration.getProperty("scanner.antiCSRF"), is(equalTo(true)));
+        assertThat(param.getHandleAntiCSRFTokens(), is(equalTo(true)));
+        assertNull(configuration.getProperty("scanner.antiCSFR"));
+        assertNull(configuration.getProperty("scanner.deleteOnShutdown"));
+    }
 }