BUG HTTPTarget stores responses as str(bytes) and the JSON callback can't address keys with digits or hyphens
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Locate HTTPTarget, HTTPXAPITarget, and the _fetch_key entry point, then compare their handling of response content and key tokens with the examples in the issue. Check the saved output in doc/code/targets/10_http_target.ipynb as a reference. Done means response text remains decoded and keys containing digits or hyphens can be addressed without being split.
Written by the indexing model from the issue text.
Description
Two problems in the HTTP targets.
First, HTTPTarget and HTTPXAPITarget save str(response.content) when there's no callback. content is bytes, so what ends up in memory is the Python repr: b'...' with every non-ASCII character escaped. The regex callback searches that same repr, so matches pick up escapes and a trailing quote:
server text: 'Sure — here’s the answer:\nStep 1: café'
stored: "b'Sure \\xe2\\x80\\x94 here\\xe2\\x80\\x99s the answer:\\nStep 1: caf\\xc3\\xa9'"
regex 'Step 1: .*': "Step 1: caf\\xc3\\xa9'"
You can see it in the saved output of doc/code/targets/10_http_target.ipynb too (b'<!DOCTYPE html>...).
Second, _fetch_key tokenizes with ([a-zA-Z_]+), so keys with digits or hyphens get split. output2 looks up output, generated-text looks up generated, and both raise.
Fix: use response.text, and treat anything other than ., [ and ] as part of a key.
- Dominant language
- Python
- Stars
- 4.5k
- Forks
- 896
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 191
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/PyRIT
-
BUG HarmBench loader drops ContextString, so contextual behaviors are sent without their context Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
stephrobert/dsoxlab#238 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
sublimehq/package_control#1780 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
nwg-piotr/nwg-displays#145 ·