Skip to content

fix: populate req_url_pattern before event creation #6547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ehsandeep merged 1 commit into from
Oct 23, 2025
Merged

fix: populate req_url_pattern before event creation #6547

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions pkg/protocols/http/operators.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,12 @@ func (request *Request) MakeResultEventItem(wrapped *output.InternalWrappedEvent
if value, ok := wrapped.InternalEvent["analyzer_details"]; ok {
analyzerDetails = value.(string)
}
var reqURLPattern string
if request.options.ExportReqURLPattern {
if value, ok := wrapped.InternalEvent[ReqURLPatternKey]; ok {
reqURLPattern = types.ToString(value)
}
}
data := &output.ResultEvent{
TemplateID: types.ToString(wrapped.InternalEvent["template-id"]),
TemplatePath: types.ToString(wrapped.InternalEvent["template-path"]),
Expand All @@ -197,6 +203,7 @@ func (request *Request) MakeResultEventItem(wrapped *output.InternalWrappedEvent
TemplateEncoded: request.options.EncodeTemplate(),
Error: types.ToString(wrapped.InternalEvent["error"]),
AnalyzerDetails: analyzerDetails,
ReqURLPattern: reqURLPattern,
}
return data
}
Expand Down
13 changes: 5 additions & 8 deletions pkg/protocols/http/request.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1043,6 +1043,11 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
request.pruneSignatureInternalValues(generatedRequest.meta)

interimEvent := generators.MergeMaps(generatedRequest.dynamicValues, finalEvent)
// add the request URL pattern to the event BEFORE operators execute
// so that interactsh events etc can also access it
if request.options.ExportReqURLPattern {
interimEvent[ReqURLPatternKey] = generatedRequest.requestURLPattern
}
Comment on lines +1046 to +1050
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

The conditional check appears inconsistent with the PR objectives.

Based on the PR description and inline comment, the pattern needs to be available in the interim event for interactsh and operators to use during execution. However, the conditional if request.options.ExportReqURLPattern on line 1048 means the pattern won't be added to interimEvent when this option is false, preventing interactsh from accessing it for vulnhash calculation.

Consider making this unconditional so interactsh and operators always have access to the pattern:

 interimEvent := generators.MergeMaps(generatedRequest.dynamicValues, finalEvent)
 // add the request URL pattern to the event BEFORE operators execute
 // so that interactsh events etc can also access it
-if request.options.ExportReqURLPattern {
-	interimEvent[ReqURLPatternKey] = generatedRequest.requestURLPattern
-}
+interimEvent[ReqURLPatternKey] = generatedRequest.requestURLPattern

The ExportReqURLPattern check in MakeResultEventItem (operators.go:177) already ensures it's only exported to result events when enabled, so this change maintains the correct export behavior while fixing the availability for interactsh.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// add the request URL pattern to the event BEFORE operators execute
// so that interactsh events etc can also access it
if request.options.ExportReqURLPattern {
interimEvent[ReqURLPatternKey] = generatedRequest.requestURLPattern
}
// add the request URL pattern to the event BEFORE operators execute
// so that interactsh events etc can also access it
interimEvent[ReqURLPatternKey] = generatedRequest.requestURLPattern
🤖 Prompt for AI Agents 
In pkg/protocols/http/request.go around lines 1046-1050, the code currently only
adds generatedRequest.requestURLPattern to interimEvent when
request.options.ExportReqURLPattern is true, which prevents interactsh and
operators from accessing the pattern during execution; remove the conditional
and always set interimEvent[ReqURLPatternKey] =
generatedRequest.requestURLPattern so the pattern is available to
interactsh/operators for vulnhash calculation, leaving ExportReqURLPattern in
MakeResultEventItem (operators.go:177) to control final result export.

isDebug := request.options.Options.Debug || request.options.Options.DebugResponse
event := eventcreator.CreateEventWithAdditionalOptions(request, interimEvent, isDebug, func(internalWrappedEvent *output.InternalWrappedEvent) {
internalWrappedEvent.OperatorsResult.PayloadValues = generatedRequest.meta
Expand All @@ -1058,14 +1063,6 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
})
}

// if requrlpattern is enabled, only then it is reflected in result event else it is empty string
// consult @Ice3man543 before changing this logic (context: vuln_hash)
if request.options.ExportReqURLPattern {
for _, v := range event.Results {
v.ReqURLPattern = generatedRequest.requestURLPattern
}
}

responseContentType := respChain.Response().Header.Get("Content-Type")
isResponseTruncated := request.MaxSize > 0 && respChain.Body().Len() >= request.MaxSize
dumpResponse(event, request, respChain.FullResponse().Bytes(), formedURL, responseContentType, isResponseTruncated, input.MetaInput.Input)
Expand Down
Loading