Mixed output causes httpie to preprocess it incorrectly
还没有人认领这个 Issue。
评估
调研方向
首先,针对一个标记为 text/html、其中包含 JSON 和 escaped HTML 的响应,分别运行提供的 HTTPie 命令(带有和不带 | cat 管道)。跟踪响应的渲染行为,然后验证类似 JSON 的内容不会被自动美化格式化,并且字符会保持 escaped,而不是被当作 HTML 处理。
由索引模型根据 Issue 内容生成。
描述
Checklist
- I've searched for similar issues.
- I'm using the latest version of HTTPie.
Minimal reproduction code and steps
- Create a request to a service that returns mime type
text/htmlwith json body and escaped html inside a string - Observe the HTML getting highlighted and characters converted to their unescaped versions
- Compare with piping to cat to remove preprocessing, where the characters are left as they are
Current result
For example, proxy dns.google but set it's return content-type to text/html (proxy_pass https://dns.google; add_header Content-Type text/html always; in nginx).
http "http://localhost/resolve?name=example.com%3Cscript%3Ealert(1)%3C%2Fscript%3E" -v | cat
GET /resolve?name=example.com%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP/1.1
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
User-Agent: HTTPie/3.2.4
Host: dns.google
HTTP/1.1 200 OK
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Date: Sat, 08 Mar 2025 11:22:11 GMT
Expires: Sat, 08 Mar 2025 11:22:11 GMT
Cache-Control: private, max-age=86399
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Server: HTTP server (unknown)
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
{"Status":3,"TC":false,"RD":true,"RA":true,"AD":true,"CD":false,"Question":[{"name":"example.com\u003cscript\u003ealert(1)\u003c/script\u003e.","type":1}],"Authority":[{"name":".","type":6,"TTL":86399,"data":"a.root-servers.net. nstld.verisign-grs.com. 2025030800 1800 900 604800 86400"}]}
is the raw code, but without |cat gets rendered as
{
"AD": true,
"Authority": [
{
"TTL": 86397,
"data": "a.root-servers.net. nstld.verisign-grs.com. 2025030800 1800 900 604800 86400",
"name": ".",
"type": 6
}
],
"CD": false,
"Question": [
{
"name": "example.com<script>alert(1)</script>.",
"type": 1
}
],
"RA": true,
"RD": true,
"Status": 3,
"TC": false
}
which is incorrect and can be confusing
Expected result
Same as |cat output as there's no real HTML to prettify
Additional information, screenshots, or code examples
- 主要语言
- Python
- 星标
- 38.6k
- 派生
- 4k
- PR 合并指标
- 30 天内没有已合并 PR
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
httpie/cli 的其他 Issue
-
new
难度 2/5 1-3 小时 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 78/100
-
bug new
难度 4/5 3-5 天 新手友好度 48/100
-
难度 3/5 1-2 天 新手友好度 55/100
-
难度 4/5 3-5 天 新手友好度 35/100
相似的 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 75/100
stephrobert/dsoxlab#238 ·
-
难度 2/5 1-3 小时 新手友好度 75/100
-
难度 2/5 1-3 小时 新手友好度 75/100
sublimehq/package_control#1780 ·
-
难度 2/5 1-3 小时 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 70/100
nwg-piotr/nwg-displays#145 ·