Function TestRequestFileParsesPostWithBody

cmd/bypass_test.go:681–758

(t *testing.T)

}

func TestRequestFileParsesPostWithBody(t *testing.T) {
	resetTestState()

	var mu sync.Mutex
	var capturedMethods []string
	var capturedURIs []string
	var capturedHeaders []http.Header

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		mu.Lock()
		capturedMethods = append(capturedMethods, r.Method)
		capturedURIs = append(capturedURIs, r.URL.RequestURI())
		capturedHeaders = append(capturedHeaders, r.Header.Clone())
		mu.Unlock()
		w.WriteHeader(http.StatusForbidden)
		fmt.Fprint(w, "Forbidden")
	}))
	defer ts.Close()

	// Simulate a Burp-style POST request with HTTP/2 and body
	rawRequest := fmt.Sprintf("POST /api/v1/data HTTP/2\r\nHost: %s\r\nContent-Type: application/json\r\nX-Custom: test-value\r\n\r\n{\"key\":\"value\"}",
		strings.TrimPrefix(ts.URL, "http://"))

	dir := t.TempDir()
	reqFile := filepath.Join(dir, "request.txt")
	if err := os.WriteFile(reqFile, []byte(rawRequest), 0o600); err != nil {
		t.Fatalf("write request file: %v", err)
	}

	payloadsDir := setupPayloadsDir(t)
	folder = payloadsDir
	nobanner = true

	loadFlagsFromRequestFile(reqFile, true, true, []string{"verbs"}, false)

	mu.Lock()
	defer mu.Unlock()

	if len(capturedMethods) == 0 {
		t.Fatal("expected requests from request file, got 0")
	}

	// Default request should use the original POST method
	foundPost := false
	for _, m := range capturedMethods {
		if m == "POST" {
			foundPost = true
			break
		}
	}
	if !foundPost {
		t.Errorf("expected POST method to be used, got methods: %v", capturedMethods)
	}

	// URI should be correctly parsed
	foundURI := false
	for _, uri := range capturedURIs {
		if strings.Contains(uri, "/api/v1/data") {