Major vhost (virtualhost) rewrite #2672
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| assert canary_subdomain.endswith(".example.com"), ( | ||
| f"Subdomain canary doesn't end with basehost: {canary_subdomain}" | ||
| ) | ||
| assert "-test.example.com" in canary_mutation, ( |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 days ago
The fix is to replace the substring check " -test.example.com" in canary_mutation with a more precise hostname validation. Since canary_mutation is intended as a hostname or domain, and we want to ensure it correctly ends with -test.example.com rather than appearing at any arbitrary position, we should parse (or treat) it as a domain name and use the .endswith() method. This would check that canary_mutation is a domain with the required suffix, so only validly-structured canary hosts would pass the test.
The change should occur in bbot/test/test_step_2/module_tests/test_module_virtualhost.py, around line 470, inside the check method of TestVirtualhostHTTPSLogic. No additional imports are needed, as string logic is sufficient here.
| @@ -467,8 +467,8 @@ | ||
| assert canary_subdomain.endswith(".example.com"), ( | ||
| f"Subdomain canary doesn't end with basehost: {canary_subdomain}" | ||
| ) | ||
| assert "-test.example.com" in canary_mutation, ( | ||
| f"Mutation canary doesn't contain expected pattern: {canary_mutation}" | ||
| assert canary_mutation.endswith("-test.example.com"), ( | ||
| f"Mutation canary doesn't end with expected pattern: {canary_mutation}" | ||
| ) | ||
| assert canary_random.endswith(".com"), f"Random canary doesn't end with .com: {canary_random}" | ||
|
|
🚀 Performance Benchmark Report
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## asn-as-targets #2672 +/- ##
================================================
Coverage ? 91%
================================================
Files ? 411
Lines ? 35381
Branches ? 0
================================================
Hits ? 32086
Misses ? 3295
Partials ? 0 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This restores the modules and tests that were temporarily removed in asn-as-targets branch: - bbot/modules/virtualhost.py - bbot/modules/waf_bypass.py - bbot/test/test_step_2/module_tests/test_module_virtualhost.py - bbot/test/test_step_2/module_tests/test_module_waf_bypass.py - bbot/presets/waf-bypass.yml - bbot/presets/web/virtualhost-heavy.yml - bbot/presets/web/virtualhost-light.yml
…removal state This restores: - New modules: virtualhost.py, waf_bypass.py and their tests - New presets: waf-bypass.yml, virtualhost-heavy.yml, virtualhost-light.yml - Modified files: web.py, shared_deps.py, generic_ssrf.py, host_header.py, web_report.py, test_module_generic_ssrf.py All restored from commit before the temporary removal.
This restores the modules and tests that were temporarily removed in asn-as-targets branch: - bbot/modules/virtualhost.py - bbot/modules/waf_bypass.py - bbot/test/test_step_2/module_tests/test_module_virtualhost.py - bbot/test/test_step_2/module_tests/test_module_waf_bypass.py - bbot/presets/waf-bypass.yml - bbot/presets/web/virtualhost-heavy.yml - bbot/presets/web/virtualhost-light.yml
…' into virtualhost-upgrade
1 participant
No description provided.