Bug report: Defang URL changes "http" inside hostnames and paths
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- Under an hour
- Newbie friendliness
- 15/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript
- Domain
- tooling
Research direction
The bug is in DefangURL.mjs, where a global case-insensitive replace of "http" also rewrites hostnames and paths; start by reading that replace call. Done means the scheme alone is defanged while hostnames and paths keep their original text, checked with the input from the report. A pull request (#2894) is already open against this issue, so coordinate with it before writing a competing change.
Written by the indexing model from the issue text.
Description
Describe the bug
Defang URL replaces every "http" with "hxxp", not just the scheme.
To Reproduce
Input https://httpbin.example.com/http/get with default arguments.
Output: hxxps[://]hxxpbin[.]example[.]com/hxxp/get
Expected behaviour
Output: hxxps[://]httpbin[.]example[.]com/http/get
Additional context
Caused by url.replace(/http/gi, "hxxp") in DefangURL.mjs. PR to follow.
Screenshot
- Dominant language
- JavaScript
- Stars
- 36.4k
- Forks
- 4.2k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 14
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from gchq/CyberChef
-
Name of CyberChef_*.zip on GitHub contains commit ID instead of version number since v11.1.0Possibly taken @sylvesterkaczmarek claimed this 63 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gchq/CyberChef#2640 · 6 comments · 4 reactions ·
Maintainers usually reply within 1 day
-
bug(AMF Encode): Uncaught TypeError setting getter-only property "value"Possibly taken @skyswordw claimed this 159 days ago. Openbug help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Collate information on contributing to the project into a single source of truth.Possibly taken A pull request linked to this issue is open or already merged. Openinfra/meta
Difficulty 2/5 Half a day Newbie friendliness 74/100
gchq/CyberChef#2337 · 2 reactions ·
Maintainers usually reply within 1 day
-
Bug report: Text Encoding Brute Force: `inputType` is `"string"` instead of `"byteArray"`Possibly taken @williballenthin claimed this 234 days ago. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
gchq/CyberChef#2860 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
remotion-dev/remotion#13341 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
svix/svix-webhooks#2808 ·
Maintainers usually reply within 1 day