From babad0941a211859225ff980b79b3f0ee63f1144 Mon Sep 17 00:00:00 2001 From: Sean Smith Date: Mon, 19 Aug 2024 12:36:30 -0500 Subject: [PATCH] Fixes a few issues with redirects First, this prevents a DNS lookup from happening when we encounter a redirect, *even if we don't intend to follow it*. This likely addresses some part of #452 Second, if we aren't following redirects, don't have the scan fail in an 'application-error'. We are succeeding in what we intended to do, which is to scan without following redirects --- modules/http/scanner.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/modules/http/scanner.go b/modules/http/scanner.go index a124b306..b63aba3c 100644 --- a/modules/http/scanner.go +++ b/modules/http/scanner.go @@ -388,6 +388,12 @@ func redirectsToLocalhost(host string) bool { // the redirectToLocalhost and MaxRedirects config func (scan *scan) getCheckRedirect() func(*http.Request, *http.Response, []*http.Request) error { return func(req *http.Request, res *http.Response, via []*http.Request) error { + if scan.scanner.config.MaxRedirects == 0 { + return nil + } + if len(via) > scan.scanner.config.MaxRedirects { + return ErrTooManyRedirects + } if !scan.scanner.config.FollowLocalhostRedirects && redirectsToLocalhost(req.URL.Hostname()) { return ErrRedirLocalhost } @@ -413,10 +419,6 @@ func (scan *scan) getCheckRedirect() func(*http.Request, *http.Response, []*http } } - if len(via) > scan.scanner.config.MaxRedirects { - return ErrTooManyRedirects - } - return nil } }