trap-bytes / hauditor

hauditor is a tool designed to analyze the security headers returned by a web page.
MIT License
165 stars 13 forks source link

Implement json output via the -j flag #3

Open lucafaggianelli opened 2 months ago

lucafaggianelli commented 2 months ago

I implemented the JSON output for the CLI so when the flag -j is used, the output in the console is a valid JSON, i.e.:

go run main.go -t facebook.com -j
  {
    "URL": "https://facebook.com/",
    "Responses": [
      {
        "Header": "x-frame-options",
        "Status": "Success",
        "Messages": null
      },
      {
        "Header": "x-content-type-options",
        "Status": "Success",
        "Messages": null
      },
      {
        "Header": "strict-transport-security",
        "Status": "Success",
        "Messages": null
      },
      {
        "Header": "content-security-policy",
        "Status": "Error",
        "Messages": [
          "Possible dangerous source in script-src: *.facebook.com is hosting JSONP endpoints.",
          "Possible dangerous source in script-src: *.fbcdn.net is hosting JSONP endpoints.",
          "Dangerous source in script-src: 'unsafe-inline' allows the execution of unsafe in-page scripts and event handlers."
        ]
      }
    ],
    "Status": "Error"
  }

Implementation

To implement the JSON output, I needed to store the messages in some structs rather than printing them on the shell, so finally it's the main.go file that decides what to output on the shell: a JSON string or a list of colored messages.

The 2 struct used:

type HeaderResponse struct {
    Header          string
    Status          ResponseStatus
    Messages        []string
    ConsoleMessages []string `json:"-"`
}

type TargetResponse struct {
    URL       string
    Responses []HeaderResponse
    Status    ResponseStatus
}

There is also a hack concerning some info print (like the banner): to handle those prints I disabled the print at the beginning of main with os.Stdout = nil and then I restored it before printing the output.

Other options would be creating some logging function or wrapping each print in if jsonOutput {}.

PR for issue #2