mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
03b023eba5
roundTripper.RoundTrip injects the global cookie, custom headers and user agent on every hop, including redirect requests. because that injection sits below the client's redirect handling, it undoes net/http's own stripping of Cookie/Authorization/Www-Authenticate when a redirect crosses hosts, so a target that 302s to an attacker host would receive the scan's secret cookie and bearer token. req.Response is only set on requests net/http built to follow a redirect, and its Request field is the prior hop, so comparing hosts there is enough to detect a cross-host hop without any extra state. skip the sensitive header classes on that hop and keep injecting everything else as before.