(t *testing.T)
| 885 | } |
| 886 | |
| 887 | func TestVerbTamperingPreservesQueryString(t *testing.T) { |
| 888 | resetTestState() |
| 889 | |
| 890 | ts, getRequests := testServer(t, nil) |
| 891 | defer ts.Close() |
| 892 | |
| 893 | payloadsDir := setupPayloadsDir(t) |
| 894 | |
| 895 | opts := RequestOptions{ |
| 896 | uri: ts.URL + "/admin?token=abc123&role=user", |
| 897 | headers: []header{{"User-Agent", "test"}}, |
| 898 | method: "GET", |
| 899 | proxy: &url.URL{}, |
| 900 | folder: payloadsDir, |
| 901 | timeout: 5000, |
| 902 | rateLimit: false, |
| 903 | redirect: false, |
| 904 | verbose: true, |
| 905 | } |
| 906 | |
| 907 | requestMethods(opts) |
| 908 | |
| 909 | reqs := getRequests() |
| 910 | if len(reqs) == 0 { |
| 911 | t.Fatal("expected requests, got 0") |
| 912 | } |
| 913 | |
| 914 | // All requests should preserve the query string |
| 915 | for _, r := range reqs { |
| 916 | rawURI := r.URL.RequestURI() |
| 917 | if !strings.Contains(rawURI, "token=abc123") || !strings.Contains(rawURI, "role=user") { |
| 918 | t.Errorf("query string lost in verb tampering request: %s", rawURI) |
| 919 | } |
| 920 | } |
| 921 | } |
| 922 | |
| 923 | func TestHeadersIncludesHostVariations(t *testing.T) { |
| 924 | resetTestState() |
nothing calls this directly
no test coverage detected