mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-07 21:07:05 -07:00
Tigah
a7f769b35a
the page scanner and the next.js manifest parser both reassembled the response body line by line with a default bufio.Scanner (64k token cap), so a line past the cap (common with minified or inlined js) silently halted the read and dropped every script and route reference after it. read the whole body instead, capped at 5mb. parsing the raw page bytes also fixes script tags split across a newline, which the old line-joined reassembly merged and missed.
51 lines
2.0 KiB
Go
51 lines
2.0 KiB
Go
/*
|
|
·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
|
|
: :
|
|
: █▀ █ █▀▀ · Blazing-fast pentesting suite :
|
|
: ▄█ █ █▀ · BSD 3-Clause License :
|
|
: :
|
|
: (c) 2022-2026 vmfunc, xyzeva, :
|
|
: lunchcat alumni & contributors :
|
|
: :
|
|
·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
|
|
*/
|
|
|
|
package frameworks
|
|
|
|
import (
|
|
"bufio"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestGetPagesRouterScriptsReadsPastLongLine(t *testing.T) {
|
|
// a manifest token past bufio's 64k cap must not truncate the read and
|
|
// drop the script references that follow it.
|
|
huge := strings.Repeat("x", bufio.MaxScanTokenSize+1)
|
|
manifest := `["early.js"]` + "\n" + huge + "\n" + `["late.js"]`
|
|
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.Write([]byte(manifest))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
scripts, err := GetPagesRouterScripts(srv.URL + "/_buildManifest.js")
|
|
if err != nil {
|
|
t.Fatalf("GetPagesRouterScripts: %v", err)
|
|
}
|
|
|
|
found := func(needle string) bool {
|
|
for _, s := range scripts {
|
|
if strings.Contains(s, needle) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
if !found("early.js") || !found("late.js") {
|
|
t.Errorf("want both early.js and late.js, got %v", scripts)
|
|
}
|
|
}
|