Skip to content

Commit

Permalink
Fixes a few issues with redirects
Browse files Browse the repository at this point in the history
First, this prevents a DNS lookup from happening when we encounter a
redirect, *even if we don't intend to follow it*. This likely addresses
some part of #452

Second, if we aren't following redirects, don't have the scan fail in an
'application-error'. We are succeeding in what we intended to do, which
is to scan without following redirects
  • Loading branch information
Seanstoppable committed Aug 19, 2024
1 parent 6cdc779 commit babad09
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions modules/http/scanner.go
Original file line number Diff line number Diff line change
Expand Up @@ -388,6 +388,12 @@ func redirectsToLocalhost(host string) bool {
// the redirectToLocalhost and MaxRedirects config
func (scan *scan) getCheckRedirect() func(*http.Request, *http.Response, []*http.Request) error {
return func(req *http.Request, res *http.Response, via []*http.Request) error {
if scan.scanner.config.MaxRedirects == 0 {
return nil
}
if len(via) > scan.scanner.config.MaxRedirects {
return ErrTooManyRedirects
}
if !scan.scanner.config.FollowLocalhostRedirects && redirectsToLocalhost(req.URL.Hostname()) {
return ErrRedirLocalhost
}
Expand All @@ -413,10 +419,6 @@ func (scan *scan) getCheckRedirect() func(*http.Request, *http.Response, []*http
}
}

if len(via) > scan.scanner.config.MaxRedirects {
return ErrTooManyRedirects
}

return nil
}
}
Expand Down

0 comments on commit babad09

Please sign in to comment.