* return values:first bool is needed for responsesplitting, second bool is only needed for ScanParameters */
(rp requestParams)
| 375 | |
| 376 | /* return values:first bool is needed for responsesplitting, second bool is only needed for ScanParameters */ |
| 377 | func issueRequests(rp requestParams) (respsplit []string, impact bool, unkeyed bool) { |
| 378 | var repCheck reportCheck |
| 379 | repCheck.Identifier = rp.identifier |
| 380 | repCheck.URL = rp.url |
| 381 | |
| 382 | body1, statusCode1, repRequest, header1, err := firstRequest(rp) |
| 383 | if err != nil { |
| 384 | if err.Error() != "stop" { |
| 385 | if rp.m != nil { |
| 386 | rp.m.Lock() |
| 387 | defer rp.m.Unlock() |
| 388 | } |
| 389 | rp.repResult.HasError = true |
| 390 | rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error()) |
| 391 | } |
| 392 | |
| 393 | return nil, false, false |
| 394 | } |
| 395 | repCheck.Request = repRequest |
| 396 | |
| 397 | impactful := firstRequestPoisoningIndicator(rp.identifier, body1, rp.poison, header1, Config.Website.Cache.CBName == rp.name, rp.cb, statusCode1) |
| 398 | |
| 399 | if Config.Website.Cache.NoCache || Config.Website.Cache.Indicator == "age" { |
| 400 | time.Sleep(1 * time.Second) // wait a second to ensure that age header is not set to 0 |
| 401 | } |
| 402 | |
| 403 | body2, statusCode2, repRequest, respHeader, err := secondRequest(rp) |
| 404 | if err != nil { |
| 405 | if err.Error() != "stop" { |
| 406 | if rp.m != nil { |
| 407 | rp.m.Lock() |
| 408 | defer rp.m.Unlock() |
| 409 | } |
| 410 | rp.repResult.HasError = true |
| 411 | rp.repResult.ErrorMessages = append(rp.repResult.ErrorMessages, err.Error()) |
| 412 | } |
| 413 | return nil, impactful, false |
| 414 | } |
| 415 | repCheck.SecondRequest = &repRequest |
| 416 | sameBodyLength := len(body1) == len(body2) |
| 417 | |
| 418 | // Check for cache hit |
| 419 | hit := false |
| 420 | for _, v := range respHeader[Config.Website.Cache.Indicator] { |
| 421 | indicValue := strings.TrimSpace(strings.ToLower(v)) |
| 422 | hit = hit || checkCacheHit(indicValue, Config.Website.Cache.Indicator) |
| 423 | } |
| 424 | |
| 425 | // Lock here, to prevent false positives and too many GetWebsite requests |
| 426 | if rp.m != nil { |
| 427 | rp.m.Lock() |
| 428 | defer rp.m.Unlock() |
| 429 | } |
| 430 | responseSplittingHeaders := checkPoisoningIndicators(rp.repResult, repCheck, rp.success, string(body2), rp.poison, statusCode1, statusCode2, sameBodyLength, respHeader, false) |
| 431 | |
| 432 | return responseSplittingHeaders, impactful, hit |
| 433 | } |
| 434 |
no test coverage detected