(IHttpRequestResponse basePair)
| 296 | } |
| 297 | |
| 298 | private List<IScanIssue> doCodePathScan(IHttpRequestResponse basePair) { |
| 299 | String baseRespString = OldUtilities.safeBytesToString(basePair.getResponse()); |
| 300 | String baseRespPrint = OldUtilities.tagmap(baseRespString); |
| 301 | Pair<String, IHttpRequestResponse> xmlResult = codepathAttack(basePair, "application/xml"); |
| 302 | if (!xmlResult.getKey().equals("-1")) { |
| 303 | if (!xmlResult.getKey().equals(baseRespPrint)) { |
| 304 | Pair<String, IHttpRequestResponse> zmlResult = codepathAttack(basePair, "application/zml"); |
| 305 | assert !zmlResult.getKey().equals("-1"); |
| 306 | if (!zmlResult.getKey().equals(xmlResult.getKey())) { |
| 307 | OldUtilities.launchPassiveScan(xmlResult.getValue()); |
| 308 | return Collections.singletonList(new CustomScanIssue( |
| 309 | basePair.getHttpService(), Utilities.helpers.analyzeRequest(basePair).getUrl(), |
| 310 | new IHttpRequestResponse[]{basePair, xmlResult.getValue(), zmlResult.getValue()}, |
| 311 | "XML input supported", |
| 312 | "The application appears to handle application/xml input. Consider investigating whether it's vulnerable to typical XML parsing attacks such as XXE.", |
| 313 | "Tentative", CustomScanIssue.severity.Information |
| 314 | )); |
| 315 | } |
| 316 | } |
| 317 | } |
| 318 | |
| 319 | return Collections.emptyList(); |
| 320 | } |
| 321 | |
| 322 | private Pair<String, IHttpRequestResponse> codepathAttack(IHttpRequestResponse basePair, String contentType) { |
| 323 | byte[] attack = OldUtilities.setHeader(basePair.getRequest(), "Content-Type", contentType, true); |
nothing calls this directly
no test coverage detected