Repository navigation
Preserve absolute request targets in HAR URLs - #6168
Closed
liangzaihuanyv wants to merge 1 commit into
Closed
liangzaihuanyv wants to merge 1 commit into
liangzaihuanyv wants to merge 1 commit into
Conversation
Request.url unconditionally prefixed http:// and the Host header, so an absolute request target recorded in the traffic log for refreshing, crawling and checking requests came out as http://hosthttps://host/path - a corrupted scheme, authority and path in the exported HAR entry. Return a case-insensitive absolute HTTP(S) target verbatim and keep the existing http:// + Host (and "unknown") fallback for origin-form targets. No scheme inference from ports; parser, body, header and timestamp behavior is unchanged. Focused offline regression on synthetic inert bytes: on the pristine source the final test bytes produced 7 assertion failures and 22 passes; with the same bytes after the fix 29 focused tests pass, and 76 tests pass in one scoped HAR + serialization + BigArray suite. MAIN independently ran 75, excluding one tree-wide reflection test. An independent eight-case collector matrix went from 4 wrong to 0. All runs were offline with zero socket attempts: no scanner CLI, attack entrypoint, server or authentication flow. CI remains pending.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Request.urlalways prefixeshttp://and the Host header, even when the parsed request target is already an absolute HTTP(S) URL. For example, a captured line such asGET https://app.example.invalid:8443/items?q=one HTTP/1.1becomeshttp://app.example.invalidhttps://app.example.invalid:8443/items?q=onein the exported HAR.This is reachable from the traffic-log format:
Connect.getPage()records absolute targets for refreshing/crawling/checking requests, andlogHTTPTraffic()forwards those logs toHTTPCollector. A malformedentries[].request.urlmisidentifies the recorded origin and path during evidence review.Fix
Return an absolute HTTP(S) target verbatim, using a case-insensitive anchored check. Keep the existing Host/
unknownfallback for origin-form targets. No scheme inference from ports, request transmission, or other HAR behavior changes.Regression evidence
All executions used synthetic inert HTTP bytes with socket connections blocked, not a live target:
Only Windows CPython 3.12 was exercised. The full suite and other CI interpreters were not run; CI is pending. No scanner CLI, attack entrypoint, server, authentication flow, or on-wire downgrade demonstration was performed.
Prepared with AI assistance, including regression generation and independent source/test review; no claim of unaided human authorship.