Payload files on main contain exact duplicate entries within the same file

Aperta
  • Qualcosa non va?
#73 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
65/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python, shell
Ambito
content, security

Direzione di ricerca

Start with the listed single-line payload files, such as XSS/xss-payloads.txt, and compare non-comment, nonblank lines as shown in the reproduction command. Review each repeated entry in context, preserving intentional baseline lines used in true/false pairs. Done when redundant duplicates are removed from the listed files; the optional tree-wide reporting script or CI job is additional scope.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug good first issue

Problem

CONTRIBUTING.md says not to submit a payload that is character-for-character identical to an existing one, and the duplicate check blocks that in new PRs. The existing files were never cleaned, so main already contains exact repeats inside the same file.

Examples

File Payload Lines
XSS/xss-payloads.txt <scr<script>ipt>alert(1)</scr</script>ipt> 25, 208, 639
Path-Traversal/path-traversal-payloads.txt ..%c0%af 22, 60, 74, 85
Command-Injection/command-injection-payloads.txt {cat,/etc/passwd} 243, 250, 435
Open-Redirect/open-redirect-payloads.txt ///evil.com 7, 46, 140
SQL-Injection/sql-injection-payloads.txt ' AND 'x'='x 61, 66, 70, 74, 78

Number of distinct payload lines that occur more than once in the same file (comments and blank lines excluded):

  • XSS/xss-payloads.txt: 20
  • Open-Redirect/open-redirect-payloads.txt: 16
  • Command-Injection/command-injection-payloads.txt: 16
  • SSJI/ssji-payloads.txt: 11
  • Path-Traversal/path-traversal-payloads.txt: 10
  • CORS-Misconfiguration/cors-misconfiguration-payloads.txt: 10
  • SQL-Injection/sql-injection-payloads.txt: 7
  • SSTI/ssti-payloads.txt: 7
  • Authentication-Bypass/auth-bypass-payloads.txt: 7

To reproduce for one file:

grep -v '^\s*#' XSS/xss-payloads.txt | grep -v '^\s*$' | sort | uniq -cd | sort -rn

Notes

  • Some repeats may be intentional, for example the same baseline line reused in several true/false pairs. Those should stay, ideally with a comment.
  • Files that hold multi-line fixtures (HTTP request smuggling, file upload, password reset) repeat lines such as headers by design and are out of scope.

Suggested work

  1. Review the single-line payload files above and remove repeats that add nothing.
  2. Optionally add a script mode or CI job that reports same-file duplicates across the whole tree, so this does not drift again.
Lingua principale
Python
Stelle
22
Fork
15
Merge medio
14h 14m
PR unite (30g)
29

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OWASP/OWASP-Hunting

Tutte le issue di OWASP/OWASP-Hunting

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.