@lievclouds/dsh-cortex 0.4.4 → 1.0.0

package/src/cortex-ui/renderer/components/retest/YakitSendPanel.tsx

@@ -0,0 +1,411 @@
+import { useEffect, useMemo, useState } from 'react'
+import { ArrowRight, Braces, CornerDownRight, Loader2, Play } from 'lucide-react'
+import type { Vulnerability } from '@shared/types'
+import type { RepeaterSendResult } from '@shared/repeater'
+import { Button } from '@renderer/components/ui/button'
+import { Checkbox } from '@renderer/components/ui/checkbox'
+import { Skeleton } from '@renderer/components/ui/skeleton'
+import { useI18n } from '@renderer/i18n'
+import { getApi } from '@renderer/lib/api'
+import {
+  formatRequestBody,
+  parseRawRequest,
+  stripDerivedHeaders
+} from '@renderer/lib/repeaterRaw'
+import {
+  defaultRequestIndex,
+  extractRepeaterRequests,
+  resolveRepeaterUrl
+} from '@renderer/lib/retestRequest'
+import {
+  buildHtmlPreview,
+  headerValue,
+  isHtmlResponse,
+  isRedirectResponse,
+  prettyJsonBody,
+  statusTone
+} from '@renderer/lib/retestResponse'
+import { cn } from '@renderer/lib/utils'
+
+interface YakitSendPanelProps {
+  vuln: Vulnerability | null
+  loading: boolean
+}
+
+function describeSendError(cause: unknown, connectionRefused: string): string {
+  const raw = cause instanceof Error ? cause.message : String(cause)
+  const cleaned = raw
+    .replace(/^Error invoking remote method '[^']+':\s*/, '')
+    .replace(/^Error:\s*/, '')
+    .trim()
+  if (/ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ECONNRESET/i.test(cleaned)) return connectionRefused
+  return cleaned === '' ? connectionRefused : cleaned
+}
+
+/**
+ * Yakit-style manual HTTP sender: the request editor fills the left half with
+ * the send button at its top-left, the response viewer fills the right half, and
+ * both panes use the full available height. This is the plain Web Fuzzer module
+ * (no payload markers, attack modes, batch jobs or result table); every request
+ * still goes through the retest proxy and the finding origin allowlist.
+ */
+export function YakitSendPanel({ vuln, loading }: YakitSendPanelProps) {
+  const { t } = useI18n()
+  const [raw, setRaw] = useState('')
+  const [step, setStep] = useState(0)
+  const [sending, setSending] = useState(false)
+  const [followRedirects, setFollowRedirects] = useState(false)
+  const [bodyView, setBodyView] = useState<'raw' | 'pretty' | 'html'>('raw')
+  const [error, setError] = useState<string | null>(null)
+  const [result, setResult] = useState<RepeaterSendResult | null>(null)
+
+  const requests = useMemo(() => (vuln === null ? [] : extractRepeaterRequests(vuln)), [vuln])
+
+  useEffect(() => {
+    setResult(null)
+    setError(null)
+    if (vuln === null) {
+      setRaw('')
+      setStep(0)
+      return
+    }
+    const nextStep = defaultRequestIndex(vuln, requests)
+    setStep(nextStep)
+    const initial = requests[nextStep]?.raw ?? ''
+    setRaw(formatRequestBody(initial) ?? initial)
+    // Reset only when the selected vulnerability changes; user edits must survive.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [vuln?.id])
+
+  const selectStep = (nextStep: number): void => {
+    const next = requests[nextStep]
+    if (next === undefined) return
+    setStep(nextStep)
+    setRaw(formatRequestBody(next.raw) ?? next.raw)
+    setResult(null)
+    setError(null)
+  }
+
+  /** Pretty-print the JSON request body while keeping the request line/headers. */
+  const formatRequest = (): void => {
+    const formatted = formatRequestBody(raw)
+    if (formatted === null) {
+      setError(t('retest.repeater.formatRequestFailed'))
+      return
+    }
+    setRaw(formatted)
+    setError(null)
+  }
+
+  const rawBytes = useMemo(() => new TextEncoder().encode(raw).byteLength, [raw])
+  const responseIsRedirect =
+    result !== null && isRedirectResponse(result.response.status, result.response.headers)
+  const responseIsHtml =
+    result !== null && isHtmlResponse(result.response.body, result.response.headers)
+  const formattedJson = useMemo(
+    () =>
+      result === null
+        ? null
+        : prettyJsonBody(result.response.body, headerValue(result.response.headers, 'content-type')),
+    [result]
+  )
+  const htmlPreview = useMemo(
+    () =>
+      result === null || vuln === null
+        ? ''
+        : buildHtmlPreview(result.response.body, vuln.target_url),
+    [result, vuln]
+  )
+  /** Status line + response headers, shared by the raw and formatted views. */
+  const responseHead = useMemo(() => {
+    if (result === null) return ''
+    const lines = [`HTTP/1.1 ${result.response.status}`]
+    for (const [name, value] of Object.entries(result.response.headers)) {
+      lines.push(`${name}: ${value}`)
+    }
+    return lines.join('\n')
+  }, [result])
+  /** Raw response as one block: status + headers + blank line + body. */
+  const rawResponse = useMemo(
+    () => (result === null ? '' : `${responseHead}\n\n${result.response.body}`),
+    [result, responseHead]
+  )
+  /** JSON view keeps the status/header block and only formats the body. */
+  const jsonResponse = useMemo(
+    () => (formattedJson === null ? '' : `${responseHead}\n\n${formattedJson}`),
+    [formattedJson, responseHead]
+  )
+
+  const send = async (): Promise<void> => {
+    if (vuln === null || sending) return
+    const api = getApi()
+    if (!api) {
+      setError(t('common.apiUnavailable'))
+      return
+    }
+    setSending(true)
+    setError(null)
+    try {
+      const parsed = parseRawRequest(raw)
+      const response = await api.sendRepeaterRequest({
+        vulnId: vuln.id,
+        method: parsed.method,
+        url: resolveRepeaterUrl(parsed.url, vuln.target_url),
+        headers: stripDerivedHeaders(parsed.headers),
+        ...(parsed.body === '' ? {} : { body: parsed.body }),
+        followRedirects
+      })
+      setResult(response)
+      // Formatted JSON is the default response view; raw stays one click away.
+      setBodyView(
+        prettyJsonBody(response.response.body, headerValue(response.response.headers, 'content-type')) !== null
+          ? 'pretty'
+          : 'raw'
+      )
+    } catch (cause) {
+      setError(describeSendError(cause, t('retest.repeater.connectionFailed')))
+      setResult(null)
+    } finally {
+      setSending(false)
+    }
+  }
+
+  if (loading && vuln === null) {
+    return (
+      <div className="grid min-h-0 flex-1 gap-3 lg:grid-cols-2">
+        <Skeleton className="h-full min-h-[360px] w-full" />
+        <Skeleton className="h-full min-h-[360px] w-full" />
+      </div>
+    )
+  }
+
+  if (vuln === null) {
+    return (
+      <div className="flex min-h-0 flex-1 items-center justify-center rounded-lg border border-dashed border-border bg-background/60 text-[12px] text-muted-foreground">
+        {t('retest.repeater.empty')}
+      </div>
+    )
+  }
+
+  return (
+    <div
+      data-testid="fuzzer-panel"
+      className="grid min-h-0 flex-1 items-stretch gap-3 lg:grid-cols-2"
+    >
+      {/* ------------------------------------------------------------- request */}
+      <section
+        data-testid="fuzzer-request-pane"
+        aria-label={t('fuzzer.request.paneAria')}
+        className="flex min-h-0 flex-col overflow-hidden rounded-lg border border-border bg-background"
+      >
+        <div className="flex h-12 shrink-0 items-center gap-2 border-b border-border px-3">
+          <Button
+            size="sm"
+            data-testid="fuzzer-send"
+            onClick={() => void send()}
+            disabled={sending || raw.trim() === ''}
+            className="gap-1.5"
+          >
+            {sending ? (
+              <Loader2 aria-hidden="true" className="h-3.5 w-3.5 animate-spin poc-spinner" />
+            ) : (
+              <Play aria-hidden="true" className="h-3.5 w-3.5" />
+            )}
+            {sending ? t('retest.repeater.sending') : t('retest.repeater.send')}
+          </Button>
+          <label className="flex shrink-0 cursor-pointer items-center gap-1.5 text-[10.5px] text-muted-foreground">
+            <Checkbox
+              data-testid="fuzzer-follow-redirects"
+              checked={followRedirects}
+              onChange={(event) => setFollowRedirects(event.target.checked)}
+            />
+            {t('retest.repeater.followRedirects')}
+          </label>
+          <Button
+            variant="outline"
+            size="xs"
+            data-testid="fuzzer-format-request"
+            title={t('retest.repeater.formatRequestTitle')}
+            onClick={formatRequest}
+            className="shrink-0 gap-1"
+          >
+            <Braces aria-hidden="true" className="h-3 w-3" />
+            {t('retest.repeater.formatRequest')}
+          </Button>
+          <span className="shrink-0 rounded border border-border bg-sidebar px-1.5 py-0.5 font-mono text-[9.5px] text-muted-foreground">
+            {vuln.id}
+          </span>
+          {requests.length > 0 ? (
+            <div
+              className="ml-auto flex min-w-0 items-center gap-1 overflow-x-auto"
+              role="tablist"
+              aria-label={t('retest.repeater.stepsAria')}
+            >
+              {requests.map((request, index) => (
+                <button
+                  key={`${index}-${request.label}`}
+                  type="button"
+                  role="tab"
+                  aria-selected={index === step}
+                  title={request.label}
+                  data-testid={`fuzzer-request-step-${index}`}
+                  onClick={() => selectStep(index)}
+                  className={cn(
+                    'h-6 shrink-0 rounded border px-2 font-mono text-[10px] transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring',
+                    index === step
+                      ? 'border-accent/50 bg-accent-soft font-medium text-accent'
+                      : 'border-border bg-background text-muted-foreground hover:bg-muted hover:text-foreground'
+                  )}
+                >
+                  {t('retest.repeater.stepN', { n: index + 1 })}
+                </button>
+              ))}
+            </div>
+          ) : null}
+          <span className={cn('shrink-0 font-mono text-[9.5px] tabular-nums text-muted-foreground', requests.length === 0 && 'ml-auto')}>
+            {t('retest.repeater.bytes', { count: rawBytes })}
+          </span>
+        </div>
+
+        <div className="flex min-h-0 flex-1 flex-col p-3">
+          <textarea
+            data-testid="fuzzer-request"
+            aria-label={t('retest.repeater.requestAria')}
+            value={raw}
+            spellCheck={false}
+            onChange={(event) => setRaw(event.target.value)}
+            className="min-h-0 w-full flex-1 resize-none rounded-lg border border-border bg-white px-3 py-2.5 font-mono text-[11.5px] leading-relaxed text-foreground caret-accent placeholder:text-muted-foreground/60 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background"
+          />
+          {error !== null ? (
+            <p
+              role="alert"
+              data-testid="fuzzer-send-error"
+              className="mt-2 rounded-md border border-red-200 bg-red-50 px-2.5 py-1.5 text-[10.5px] leading-relaxed text-red-700"
+            >
+              {error}
+            </p>
+          ) : null}
+        </div>
+      </section>
+
+      {/* ------------------------------------------------------------ response */}
+      <section
+        data-testid="fuzzer-response-pane"
+        aria-label={t('fuzzer.response.aria')}
+        className="flex min-h-0 flex-col overflow-hidden rounded-lg border border-border bg-background"
+      >
+        <div className="flex h-12 shrink-0 items-center gap-2 border-b border-border px-3">
+          <ArrowRight aria-hidden="true" className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
+          <span className="shrink-0 text-[12px] font-medium text-foreground">{t('retest.repeater.responseTitle')}</span>
+          {result !== null ? (
+            <>
+              <span
+                data-testid="fuzzer-response-status"
+                className={`rounded border px-1.5 py-0.5 font-mono text-[10px] tabular-nums ${statusTone(result.response.status)}`}
+              >
+                {result.response.status}
+              </span>
+              <span className="font-mono text-[9.5px] tabular-nums text-muted-foreground">
+                {result.response.durationMs} ms · {result.response.body.length} B
+              </span>
+              {result.response.truncated ? (
+                <span className="text-[9.5px] text-amber-700">{t('retest.repeater.truncated')}</span>
+              ) : null}
+              {responseIsRedirect ? (
+                <Button
+                  variant="outline"
+                  size="xs"
+                  onClick={() => void send()}
+                  disabled={sending}
+                  className="gap-1 text-[10.5px]"
+                >
+                  <CornerDownRight aria-hidden="true" className="h-3 w-3" />
+                  {t('retest.repeater.followRedirect')}
+                </Button>
+              ) : null}
+              {formattedJson !== null || responseIsHtml ? (
+                <div className="ml-auto flex shrink-0 items-center gap-0.5 rounded-md border border-border bg-muted p-0.5">
+                  <button
+                    type="button"
+                    data-testid="fuzzer-view-raw"
+                    onClick={() => setBodyView('raw')}
+                    className={cn(
+                      'rounded px-1.5 py-0.5 text-[10px] transition-colors',
+                      bodyView === 'raw'
+                        ? 'bg-background font-medium text-foreground shadow-sm'
+                        : 'text-muted-foreground hover:text-foreground'
+                    )}
+                  >
+                    {t('retest.repeater.viewRaw')}
+                  </button>
+                  {formattedJson !== null ? (
+                    <button
+                      type="button"
+                      data-testid="fuzzer-view-json"
+                      onClick={() => setBodyView('pretty')}
+                      className={cn(
+                        'rounded px-1.5 py-0.5 text-[10px] transition-colors',
+                        bodyView === 'pretty'
+                          ? 'bg-background font-medium text-foreground shadow-sm'
+                          : 'text-muted-foreground hover:text-foreground'
+                      )}
+                    >
+                      {t('retest.repeater.formatJson')}
+                    </button>
+                  ) : null}
+                  {responseIsHtml ? (
+                    <button
+                      type="button"
+                      data-testid="fuzzer-view-html"
+                      onClick={() => setBodyView('html')}
+                      className={cn(
+                        'rounded px-1.5 py-0.5 text-[10px] transition-colors',
+                        bodyView === 'html'
+                          ? 'bg-background font-medium text-foreground shadow-sm'
+                          : 'text-muted-foreground hover:text-foreground'
+                      )}
+                    >
+                      {t('retest.repeater.viewHtml')}
+                    </button>
+                  ) : null}
+                </div>
+              ) : null}
+            </>
+          ) : null}
+        </div>
+
+        {result === null ? (
+          <p className="flex flex-1 items-center justify-center px-3 text-[11.5px] text-muted-foreground">
+            {t('retest.repeater.emptyResponse')}
+          </p>
+        ) : (
+          <div className="flex min-h-0 flex-1 flex-col p-3">
+            {responseIsHtml && bodyView === 'html' ? (
+              <iframe
+                title={t('retest.repeater.htmlPreview')}
+                sandbox=""
+                referrerPolicy="no-referrer"
+                srcDoc={htmlPreview}
+                className="min-h-0 w-full flex-1 rounded-md border border-border bg-white"
+              />
+            ) : formattedJson !== null && bodyView === 'pretty' ? (
+              <pre
+                data-testid="fuzzer-response-json"
+                className="min-h-0 flex-1 overflow-auto whitespace-pre-wrap break-words rounded-md border border-border bg-white px-3 py-2.5 font-mono text-[11.5px] leading-relaxed text-foreground"
+              >
+                {jsonResponse}
+              </pre>
+            ) : (
+              <pre
+                data-testid="fuzzer-response-body"
+                className="min-h-0 flex-1 overflow-auto whitespace-pre-wrap break-words rounded-md border border-border bg-white px-3 py-2.5 font-mono text-[11.5px] leading-relaxed text-foreground"
+              >
+                {rawResponse.slice(0, 200_000)}
+              </pre>
+            )}
+          </div>
+        )}
+      </section>
+    </div>
+  )
+}

package/src/cortex-ui/renderer/components/vuln/DirectoryPickerDialog.tsx

@@ -0,0 +1,187 @@
+import * as DialogPrimitive from '@radix-ui/react-dialog'
+import { ArrowUp, Folder, FolderCheck, Loader2 } from 'lucide-react'
+import { useCallback, useEffect, useState } from 'react'
+import { Button } from '@renderer/components/ui/button'
+import { useI18n } from '@renderer/i18n'
+import { cn } from '@renderer/lib/utils'
+import { getPortalContainer } from '../../../dsh/portal'
+
+interface DirectoryListing {
+  path: string
+  parent: string | null
+  directories: Array<{ name: string; path: string }>
+  home: string
+}
+
+interface DirectoryPickerDialogProps {
+  open: boolean
+  initialPath?: string
+  onOpenChange: (open: boolean) => void
+  onSelect: (path: string) => void
+}
+
+async function listDirectories(path: string): Promise<DirectoryListing> {
+  const query = path.trim() === '' ? '' : `?path=${encodeURIComponent(path.trim())}`
+  const response = await fetch(`/cortex-api/cortex/fs/list${query}`)
+  const payload = (await response.json().catch(() => null)) as
+    | (DirectoryListing & { error?: string })
+    | null
+  if (!response.ok) {
+    throw new Error(payload?.error || `HTTP ${response.status}`)
+  }
+  return payload as DirectoryListing
+}
+
+/**
+ * Server-backed folder picker: the browser cannot reveal absolute directory
+ * paths for a text export dialog, so the Host lists folders and this dialog
+ * returns the chosen absolute path.
+ */
+export function DirectoryPickerDialog({
+  open,
+  initialPath = '',
+  onOpenChange,
+  onSelect
+}: DirectoryPickerDialogProps) {
+  const { t } = useI18n()
+  const [current, setCurrent] = useState('')
+  const [parent, setParent] = useState<string | null>(null)
+  const [directories, setDirectories] = useState<Array<{ name: string; path: string }>>([])
+  const [manual, setManual] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const load = useCallback(
+    async (target: string) => {
+      setLoading(true)
+      setError(null)
+      try {
+        const listing = await listDirectories(target)
+        setCurrent(listing.path)
+        setParent(listing.parent)
+        setDirectories(listing.directories)
+        setManual(listing.path)
+      } catch (cause) {
+        setError(cause instanceof Error ? cause.message : String(cause))
+      } finally {
+        setLoading(false)
+      }
+    },
+    []
+  )
+
+  useEffect(() => {
+    if (!open) return
+    void load(initialPath)
+    // Only reload when the dialog opens; user navigation is handled locally.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open])
+
+  return (
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
+        <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[80] bg-[hsl(224_18%_10%/0.3)]" />
+        <DialogPrimitive.Content
+          data-testid="directory-picker-dialog"
+          className="fixed left-1/2 top-1/2 z-[80] flex w-[min(620px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 flex-col rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring"
+        >
+          <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">
+            {t('vuln.dirPicker.title')}
+          </DialogPrimitive.Title>
+
+          <div className="mt-3 flex items-center gap-1.5">
+            <input
+              data-testid="directory-picker-path"
+              value={manual}
+              spellCheck={false}
+              onChange={(event) => setManual(event.target.value)}
+              onKeyDown={(event) => {
+                if (event.key === 'Enter') void load(manual)
+              }}
+              className="h-8 min-w-0 flex-1 rounded-md border border-border bg-background px-2.5 font-mono text-[11.5px] text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+            />
+            <Button
+              variant="outline"
+              size="xs"
+              onClick={() => void load(manual)}
+              disabled={loading}
+              className="h-8 gap-1 px-2.5"
+            >
+              {t('vuln.dirPicker.go')}
+            </Button>
+            <Button
+              variant="outline"
+              size="xs"
+              data-testid="directory-picker-up"
+              onClick={() => {
+                if (parent !== null) void load(parent)
+              }}
+              disabled={loading || parent === null}
+              className="h-8 gap-1 px-2.5"
+            >
+              <ArrowUp aria-hidden="true" className="h-3 w-3" />
+              {t('vuln.dirPicker.up')}
+            </Button>
+          </div>
+
+          <div className="mt-3 max-h-[320px] min-h-[180px] overflow-y-auto rounded-lg border border-border">
+            {loading ? (
+              <p className="flex h-[180px] items-center justify-center gap-2 text-[11.5px] text-muted-foreground">
+                <Loader2 aria-hidden="true" className="h-3.5 w-3.5 animate-spin" />
+                {t('vuln.dirPicker.loading')}
+              </p>
+            ) : error !== null ? (
+              <p className="p-3 text-[11.5px] text-red-700">
+                {t('vuln.dirPicker.error', { error })}
+              </p>
+            ) : directories.length === 0 ? (
+              <p className="flex h-[180px] items-center justify-center text-[11.5px] text-muted-foreground">
+                {t('vuln.dirPicker.empty')}
+              </p>
+            ) : (
+              <ul className="divide-y divide-border">
+                {directories.map((entry) => (
+                  <li key={entry.path}>
+                    <button
+                      type="button"
+                      data-testid="directory-picker-entry"
+                      onClick={() => void load(entry.path)}
+                      className={cn(
+                        'flex w-full items-center gap-2 px-3 py-2 text-left transition-colors',
+                        'hover:bg-sidebar focus-visible:bg-accent-soft focus-visible:outline-none'
+                      )}
+                    >
+                      <Folder aria-hidden="true" className="h-3.5 w-3.5 shrink-0 text-accent" />
+                      <span className="truncate text-[12px] text-foreground">{entry.name}</span>
+                    </button>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+
+          <div className="mt-4 flex items-center justify-between gap-2">
+            <span className="min-w-0 truncate font-mono text-[10.5px] text-muted-foreground" title={current}>
+              {current}
+            </span>
+            <div className="flex shrink-0 items-center gap-2">
+              <Button variant="outline" size="sm" onClick={() => onOpenChange(false)}>
+                {t('common.cancel')}
+              </Button>
+              <Button
+                size="sm"
+                data-testid="directory-picker-select"
+                disabled={loading || error !== null || current === ''}
+                onClick={() => onSelect(current)}
+                className="gap-1.5"
+              >
+                <FolderCheck aria-hidden="true" className="h-3.5 w-3.5" />
+                {t('vuln.dirPicker.select')}
+              </Button>
+            </div>
+          </div>
+        </DialogPrimitive.Content>
+      </DialogPrimitive.Portal>
+    </DialogPrimitive.Root>
+  )
+}