assetnote / kiterunner

Contextual Content Discovery Tool
GNU Affero General Public License v3.0
2.57k stars 285 forks source link

fix(cli-scan): avoid double appending / in the basepath and route path in output #21

Closed minight closed 3 years ago

minight commented 3 years ago

Fixes #13 .

This changes the PrintOutput function for displaying results in pretty and text mode.

this will inspect the output bytes for the target to avoid printing both a trailing / on the basepath and a prefix / for the route path. This is purely a cosmetic change, as our underlying request engine already collapses duplicate paths

so now the behaviour will occurs as follows:

http://foo.com/foo + /bar.txt => http://foo.com/foo/bar.txt (as normal)
http://foo.com/foo + bar.txt => http://foo.com/foo/bar.txt (our wordlist loading prefixes / for you)
http://foo.com/foo + /bar.txt => http://foo.com/foo/bar.txt
http://foo.com/foo/ + /bar.txt => http://foo.com/foo/bar.txt (the bar.txt slash is dropped)
http://foo.com/foo// + /bar.txt => http://foo.com/foo//bar.txt (the bar.txt slash is dropped, but you added two, so thats your fault)

We also add some tests to validate that the parsing of the basepath is as we expect with trailing slashes.

In the future, we may want to modify the behaviour of the routes loading to not prepend the '/' so if you specify http://foo.com/bar and file.txt you'll get http://foo.com/barfile.txt without a joining slash.