dap 0.0.20 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 47ecf168f8bc6242364441c3181c9fce903662d5
-  data.tar.gz: 1e566ba434fe69f3a9c6aaa099013f9be8f526fd
+  metadata.gz: ce658733f9634e96a6258dcfc0caf74f91d2c6fa
+  data.tar.gz: 93acca40858a6d0ad1f4a5869240dc0a85d9601c
 SHA512:
-  metadata.gz: e893cacfbcc0bc02d6a1e1190c5843a8aeb372ed63a28929952f0afb56d2d600f1a24c8c5fc019f479590107e6618c2898b64603c20a77b617876a6bdfe05607
-  data.tar.gz: '0508097ed78aaa9454d459ba8e0365b1a99ab9968c3e2b478150a74b868c74760bdb7c9ca34af406c566e544c50b3e791180643e105b7f37ff9089f83e798e13'
+  metadata.gz: 995dc3db11fa7d501cc7bcb89520e161235a0c872a5b100ab2f80195486fb1989d594b00efaa88cdf7d354efc9e5bc87280bff287263a61a0138aadcc0b070c9
+  data.tar.gz: c2426cc2d20170400f8aeee33d21b3f7ee41a0afd473323bfbaaf712cf96332da8f5e2957683958fddb6ec740c5ed94ed4125b731b2703c71214c357f934d1a4

data/lib/dap/filter/http.rb

@@ -149,41 +149,51 @@ class FilterDecodeHTTPReply
 
     while lines.length > 0
       hline = lines.shift
-      case hline
-      when /^ETag:\s*(.*)/i
-        save["http_etag"] = $1
+      if /^(?<header_name>[^:]+):\s*(?<header_value>.*)$/ =~ hline
+        header_value.strip!
+        header_name.downcase!
 
-      when /^Set-Cookie:\s*(.*)/i
-        bits = $1.gsub(/\;?\s*path=.*/i, '').gsub(/\;?\s*expires=.*/i, '').gsub(/\;\s*HttpOnly.*/, '')
-        save["http_cookie"] = bits.strip
+        if valid_header_name?(header_name)
+          save["http_raw_headers"] ||= {}
+          save["http_raw_headers"][header_name] ||= []
+          save["http_raw_headers"][header_name] << header_value
 
-      when /^Server:\s*(.*)/i
-        save["http_server"] = $1.strip
+          # XXX: warning, all of these mishandle duplicate headers
+          case header_name
+          when 'etag'
+            save["http_etag"] = header_value
 
-      when /^X-Powered-By:\s*(.*)/i
-        save["http_powered"] = $1.strip
+          when 'set-cookie'
+            bits = header_value.gsub(/\;?\s*path=.*/i, '').gsub(/\;?\s*expires=.*/i, '').gsub(/\;\s*HttpOnly.*/, '')
+            save["http_cookie"] = bits
 
-      when /^Date:\s*(.*)/i
-        d = DateTime.parse($1.strip) rescue nil
-        save["http_date"] = d.to_time.strftime("%Y%m%dT%H:%M:%S") if d
+          when 'server'
+            save["http_server"] = header_value
 
-      when /^Last-modified:\s*(.*)/i
-        d = DateTime.parse($1.strip) rescue nil
-        save["http_modified"] = d.to_time.strftime("%Y%m%dT%H:%M:%S") if d
+          when 'x-powered-by'
+            save["http_powered"] = header_value
 
-      when /^Location:\s*(.*)/i
-        save["http_location"] = $1.strip
+          when 'date'
+            d = DateTime.parse(header_value) rescue nil
+            save["http_date"] = d.to_time.utc.strftime("%Y%m%dT%H:%M:%S%z") if d
 
-      when /^WWW-Authenticate:\s*(.*)/i
-        save["http_auth"] = $1.strip
+          when 'last-modified'
+            d = DateTime.parse(header_value) rescue nil
+            save["http_modified"] = d.to_time.utc.strftime("%Y%m%dT%H:%M:%S%z") if d
 
-      when /^Content-Length:\s*(.*)/i
-        clen = $1.strip.to_i
+          when 'location'
+            save["http_location"] = header_value
 
-      when /^([A-Za-z0-9\-]+):\s*(.*)/i
-        save["http_raw_headers"][$1.downcase.strip] = $2.strip
+          when 'www-authenticate'
+            save["http_auth"] = header_value
 
-      when ""
+          when 'content-length'
+            save["content-length"] = header_value.to_i
+          end
+        else
+          # not a valid header.  XXX, eventually we should log or do something more useful here
+        end
+      elsif hline == ""
         break
       end
     end
@@ -193,7 +203,9 @@ class FilterDecodeHTTPReply
     # Some buggy systems exclude the header entirely
     body ||= head
 
-    if save["http_raw_headers"]["content-encoding"] == "gzip"
+    content_encoding = save["http_raw_headers"]["content-encoding"]
+
+    if content_encoding && content_encoding.include?("gzip")
       begin
         gunzip = Zlib::GzipReader.new(StringIO.new(body))
         body = gunzip.read.encode('UTF-8', :invalid=>:replace, :replace=>'?')
@@ -209,6 +221,10 @@ class FilterDecodeHTTPReply
 
     save
   end
+
+  def valid_header_name?(name)
+    return name !~ /[\x00-\x1f()<>@,;:\\\"\/\[\]?={}\s]/
+  end
 end
 
 end

data/lib/dap/version.rb

@@ -1,3 +1,3 @@
 module Dap
-  VERSION = "0.0.20"
+  VERSION = "0.1.0"
 end

data/spec/dap/filter/http_filter_spec.rb

@@ -14,7 +14,8 @@ describe Dap::Filter::FilterDecodeHTTPReply do
     end
 
     context 'decoding uncompressed response' do
-      let(:decode) { filter.decode("HTTP/1.0 200 OK\r\nHeader1: value1\r\n\r\nstuff") }
+      let(:decode) { filter.decode("HTTP/1.0 200 OK\r\nHeader1: value1\r\nHow(}does<htTp=work?:itdoesn't\r\nHeader2: value2\r\nHEADER2: VALUE2\r\n\r\nstuff") }
+      let(:decode_date) { filter.decode("HTTP/1.0 200 OK\r\nHeader1: value1\r\nHow(}does<htTp=work?:itdoesn't\r\nDate: Fri, 24 Mar 2017 15:34:04 GMT\r\nHEADER2: VALUE2\r\nLast-Modified: Fri, 24 Mar 2013 15:34:04 GMT\r\n\r\nstuff") }
 
       it 'correctly sets status code' do
         expect(decode['http_code']).to eq(200)
@@ -28,8 +29,18 @@ describe Dap::Filter::FilterDecodeHTTPReply do
         expect(decode['http_body']).to eq('stuff')
       end
 
-      it 'correct extracts header(s)' do
-        expect(decode['http_raw_headers']).to eq({'header1' => 'value1'})
+      it 'correctly extracts http_raw_headers' do
+        expect(decode['http_raw_headers']).to eq({'header1' => ['value1'], 'header2' => ['value2', 'VALUE2']})
+      end
+
+      it 'extracts Date http header' do
+        expect(decode_date['http_raw_headers']['date']).to eq(["Fri, 24 Mar 2017 15:34:04 GMT"])
+	expect(decode_date['http_date']).to eq("20170324T15:34:04+0000")
+      end
+
+      it 'extracts Last-Modified http header' do
+        expect(decode_date['http_raw_headers']['last-modified']).to eq(["Fri, 24 Mar 2013 15:34:04 GMT"])
+	expect(decode_date['http_modified']).to eq("20130324T15:34:04+0000")
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dap
 version: !ruby/object:Gem::Version
-  version: 0.0.20
+  version: 0.1.0
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-17 00:00:00.000000000 Z
+date: 2017-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec