@lievclouds/dsh-cortex 0.5.4 → 1.0.0

package/src/cortex-ui/renderer/lib/repeaterStoreApi.ts

@@ -0,0 +1,163 @@
+/**
+ * Client for the single-Repeater history / favorites Host routes.
+ *
+ * The routes live under the same `/cortex-api/cortex` surface but are not part
+ * of `CortexApi`; the dialogs use these plain same-origin fetches.
+ */
+import type { RepeaterSendResult } from '@shared/repeater'
+
+const API_BASE = '/cortex-api/cortex'
+
+export type RepeaterStoredRequest = RepeaterSendResult['request']
+export type RepeaterStoredResponse = RepeaterSendResult['response']
+
+export interface RepeaterHistoryEntry {
+  id: string
+  createdAt: string
+  vulnId: string
+  raw: string
+  request: RepeaterStoredRequest
+  response: RepeaterStoredResponse | null
+}
+
+export interface RepeaterCollectionEntry {
+  id: string
+  name: string
+  createdAt: string
+  vulnId: string
+  raw: string
+  request: RepeaterStoredRequest
+  response: RepeaterStoredResponse | null
+}
+
+export interface SaveRepeaterCollectionInput {
+  name: string
+  vulnId: string
+  raw: string
+  request: RepeaterStoredRequest
+  response?: RepeaterStoredResponse | null
+}
+
+interface ApiErrorPayload {
+  error?: unknown
+  message?: unknown
+  code?: unknown
+  details?: unknown
+}
+
+/** Stable client error: `code` mirrors the Host error envelope when present. */
+export class RepeaterStoreApiError extends Error {
+  readonly code: string
+  readonly status: number
+  readonly details: unknown
+
+  constructor(code: string, message: string, status: number, details?: unknown) {
+    super(message)
+    this.name = 'RepeaterStoreApiError'
+    this.code = code
+    this.status = status
+    this.details = details
+  }
+}
+
+function errorMessage(error: unknown): string {
+  if (error instanceof RepeaterStoreApiError) return error.message
+  if (error instanceof Error && error.message !== '') return error.message
+  return typeof error === 'string' && error !== '' ? error : 'Unknown error'
+}
+
+export { errorMessage as repeaterStoreErrorMessage }
+
+interface RequestOptions {
+  method?: 'GET' | 'POST' | 'DELETE'
+  body?: unknown
+}
+
+async function requestJson<T>(path: string, options: RequestOptions = {}): Promise<T> {
+  const init: RequestInit = { method: options.method ?? 'GET' }
+  if (options.body !== undefined) {
+    init.headers = { 'Content-Type': 'application/json' }
+    init.body = JSON.stringify(options.body)
+  }
+
+  let response: Response
+  try {
+    response = await fetch(`${API_BASE}${path}`, init)
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause)
+    throw new RepeaterStoreApiError('NETWORK_ERROR', detail, 0)
+  }
+
+  const text = await response.text().catch(() => '')
+  let payload: unknown = null
+  if (text !== '') {
+    try {
+      payload = JSON.parse(text) as unknown
+    } catch {
+      payload = null
+    }
+  }
+
+  if (!response.ok) {
+    const envelope = (payload ?? {}) as ApiErrorPayload
+    const message =
+      typeof envelope.error === 'string' && envelope.error !== ''
+        ? envelope.error
+        : typeof envelope.message === 'string' && envelope.message !== ''
+          ? envelope.message
+          : `HTTP ${response.status}`
+    const code =
+      typeof envelope.code === 'string' && envelope.code !== ''
+        ? envelope.code
+        : `HTTP_${response.status}`
+    throw new RepeaterStoreApiError(code, message, response.status, envelope.details)
+  }
+
+  return payload as T
+}
+
+const encodeId = (value: string): string => encodeURIComponent(value)
+
+function unwrapItems<T>(payload: unknown): T[] {
+  if (Array.isArray(payload)) return payload as T[]
+  if (payload !== null && typeof payload === 'object') {
+    const items = (payload as { items?: unknown }).items
+    if (Array.isArray(items)) return items as T[]
+  }
+  return []
+}
+
+export function listRepeaterHistory(limit = 20): Promise<RepeaterHistoryEntry[]> {
+  const safeLimit = Math.max(1, Math.min(50, Math.trunc(limit)))
+  return requestJson<unknown>(`/repeater/history?limit=${safeLimit}`).then((payload) =>
+    unwrapItems<RepeaterHistoryEntry>(payload)
+  )
+}
+
+export function clearRepeaterHistory(): Promise<boolean> {
+  return requestJson<{ cleared?: boolean }>('/repeater/history', { method: 'DELETE' }).then(
+    (payload) => payload.cleared === true
+  )
+}
+
+export function listRepeaterCollections(): Promise<RepeaterCollectionEntry[]> {
+  return requestJson<unknown>('/repeater/collections').then((payload) =>
+    unwrapItems<RepeaterCollectionEntry>(payload)
+  )
+}
+
+export function saveRepeaterCollection(
+  input: SaveRepeaterCollectionInput
+): Promise<RepeaterCollectionEntry> {
+  return requestJson<{ item: RepeaterCollectionEntry }>('/repeater/collections', {
+    method: 'POST',
+    body: input
+  }).then((payload) => payload.item)
+}
+
+export function deleteRepeaterCollection(id: string): Promise<boolean> {
+  return requestJson<{ deleted?: boolean }>(
+    `/repeater/collections/${encodeId(id)}`,
+    { method: 'DELETE' }
+  ).then((payload) => payload.deleted === true)
+}

package/src/cortex-ui/renderer/lib/retestResponse.ts

@@ -1,17 +1,64 @@
-/**
- * Response formatting helpers for the retest repeater (Yakit/Burp-style JSON
- * view). Kept away from the TSX component so they are unit-testable.
- */
-
-/** Pretty-print JSON bodies; null when the body is not JSON. */
-export function prettyJsonBody(body: string, contentType: string): string | null {
-  const trimmed = body.trim()
-  if (trimmed.length === 0) return null
-  if (!/json/i.test(contentType) && !/^[{[]/.test(trimmed)) return null
-  if (trimmed.length > 2_000_000) return null
-  try {
-    return JSON.stringify(JSON.parse(body), null, 2)
-  } catch {
-    return null
-  }
-}
+/**
+ * Response formatting helpers for the retest repeater (Yakit/Burp-style JSON
+ * view) and the Fuzzer result detail. Kept away from the TSX components so
+ * they are unit-testable.
+ */
+
+/** Pretty-print JSON bodies; null when the body is not JSON. */
+export function prettyJsonBody(body: string, contentType: string): string | null {
+  const trimmed = body.trim()
+  if (trimmed.length === 0) return null
+  if (!/json/i.test(contentType) && !/^[{[]/.test(trimmed)) return null
+  if (trimmed.length > 2_000_000) return null
+  try {
+    return JSON.stringify(JSON.parse(body), null, 2)
+  } catch {
+    return null
+  }
+}
+
+/** Case-insensitive response/request header lookup. */
+export function headerValue(headers: Record<string, string>, name: string): string {
+  const lower = name.toLowerCase()
+  const entry = Object.entries(headers).find(([key]) => key.toLowerCase() === lower)
+  return entry?.[1] ?? ''
+}
+
+/** True when a response declares (or visibly contains) HTML. */
+export function isHtmlResponse(body: string, headers: Record<string, string>): boolean {
+  const contentType = headerValue(headers, 'content-type')
+  if (/text\/html|application\/xhtml\+xml/i.test(contentType)) return true
+  return /^\s*(?:<!doctype\s+html|<html[\s>])/i.test(body.slice(0, 300))
+}
+
+/** Rendered HTML needs a base URL so relative CSS/images resolve against the target. */
+export function buildHtmlPreview(body: string, targetUrl: string): string {
+  let base = ''
+  try {
+    base = `${new URL(targetUrl).origin}/`
+  } catch {
+    base = ''
+  }
+  if (base === '') return body
+  const tag = `<base href="${base.replace(/"/g, '&quot;')}">`
+  if (/<head(?:\s[^>]*)?>/i.test(body)) {
+    return body.replace(/<head(?:\s[^>]*)?>/i, (match) => `${match}${tag}`)
+  }
+  return `${tag}${body}`
+}
+
+/** Tailwind tone for a response status chip. */
+export function statusTone(status: number): string {
+  if (status >= 500) return 'border-red-300 bg-red-50 text-red-800'
+  if (status >= 400) return 'border-amber-300 bg-amber-50 text-amber-900'
+  if (status >= 300) return 'border-sky-300 bg-sky-50 text-sky-900'
+  return 'border-emerald-300 bg-emerald-50 text-emerald-900'
+}
+
+/** True when a response status redirects and carries a Location header. */
+export function isRedirectResponse(
+  status: number,
+  headers: Record<string, string>
+): boolean {
+  return status >= 300 && status < 400 && headerValue(headers, 'location') !== ''
+}

package/src/cortex-ui/renderer/pages/FuzzerPage.tsx

@@ -0,0 +1,212 @@
+import { useEffect, useRef, useState } from 'react'
+import { Zap } from 'lucide-react'
+import type { Severity, Vulnerability, VulnerabilityListItem } from '@shared/types'
+import { YakitSendPanel } from '@renderer/components/retest/YakitSendPanel'
+import { SeverityBadge, StatusBadge } from '@renderer/components/common/Badges'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue
+} from '@renderer/components/ui/select'
+import { Skeleton } from '@renderer/components/ui/skeleton'
+import { useI18n } from '@renderer/i18n'
+import { getApi } from '@renderer/lib/api'
+
+interface FuzzerPageProps {
+  dataVersion: number
+}
+
+const TARGET_STORAGE_KEY = 'cortex.fuzzer.target'
+
+function storedTargetId(): string {
+  try {
+    return window.localStorage.getItem(TARGET_STORAGE_KEY) ?? ''
+  } catch {
+    return ''
+  }
+}
+
+function rememberTarget(id: string): void {
+  try {
+    window.localStorage.setItem(TARGET_STORAGE_KEY, id)
+  } catch {
+    /* localStorage may be unavailable in a hardened WebView */
+  }
+}
+
+/**
+ * Dedicated Web Fuzzer page: a Yakit-style manual HTTP sender with the request
+ * editor on the left, the response viewer on the right and both panes filling
+ * the available height. There is deliberately no ported vulnerability list and
+ * no batch fuzzing: a compact target selector in the header is the only link to
+ * a finding, because the Host derives the outbound origin allowlist from it.
+ */
+export function FuzzerPage({ dataVersion }: FuzzerPageProps) {
+  const { t } = useI18n()
+  const [items, setItems] = useState<VulnerabilityListItem[] | null>(null)
+  const [listLoading, setListLoading] = useState(true)
+  const [listError, setListError] = useState<string | null>(null)
+  const [selectedId, setSelectedId] = useState<string | null>(null)
+  const [detail, setDetail] = useState<Vulnerability | null>(null)
+  const [detailLoading, setDetailLoading] = useState(false)
+  const [detailError, setDetailError] = useState<string | null>(null)
+  const detailCache = useRef(new Map<string, Vulnerability>())
+
+  useEffect(() => {
+    const api = getApi()
+    if (!api) {
+      setListError(t('common.apiUnavailable'))
+      setListLoading(false)
+      return
+    }
+    let alive = true
+    setListLoading(true)
+    api
+      .listVulnerabilities({ realm: 'web', page: 1, pageSize: 200 })
+      .then(
+        (result) => {
+          if (!alive) return
+          setItems(result.items)
+          setListError(null)
+          setListLoading(false)
+          const remembered = storedTargetId()
+          setSelectedId((current) => {
+            const preferred = current ?? remembered
+            if (preferred !== '' && result.items.some((item) => item.id === preferred)) {
+              return preferred
+            }
+            return result.items[0]?.id ?? null
+          })
+        },
+        (cause: unknown) => {
+          if (!alive) return
+          setListError(cause instanceof Error ? cause.message : String(cause))
+          setListLoading(false)
+        }
+      )
+    return () => {
+      alive = false
+    }
+  }, [dataVersion, t])
+
+  useEffect(() => {
+    if (selectedId === null) {
+      setDetail(null)
+      setDetailLoading(false)
+      setDetailError(null)
+      return
+    }
+    rememberTarget(selectedId)
+    const cached = detailCache.current.get(selectedId)
+    if (cached !== undefined) {
+      setDetail(cached)
+      setDetailLoading(false)
+      setDetailError(null)
+      return
+    }
+    const api = getApi()
+    if (!api) {
+      setDetailError(t('common.apiUnavailable'))
+      setDetailLoading(false)
+      return
+    }
+    let alive = true
+    setDetail(null)
+    setDetailLoading(true)
+    setDetailError(null)
+    api.getVulnerability(selectedId).then(
+      (next) => {
+        if (!alive) return
+        if (next === null) {
+          setDetailError(t('fuzzer.target.detailFailed'))
+        } else {
+          detailCache.current.set(next.id, next)
+          setDetail(next)
+        }
+        setDetailLoading(false)
+      },
+      (cause: unknown) => {
+        if (!alive) return
+        setDetailError(cause instanceof Error ? cause.message : String(cause))
+        setDetailLoading(false)
+      }
+    )
+    return () => {
+      alive = false
+    }
+  }, [selectedId, dataVersion, t])
+
+  const selectedItem = items?.find((item) => item.id === selectedId) ?? null
+
+  return (
+    <div
+      data-testid="fuzzer-page"
+      className="mx-auto flex h-full min-h-0 w-full max-w-[1680px] flex-col px-6 py-4"
+    >
+      <div className="flex shrink-0 flex-wrap items-center justify-between gap-3">
+        <h1 className="text-[19px] font-semibold tracking-tight text-foreground">
+          {t('nav.fuzzer')}
+        </h1>
+
+        <div className="flex min-w-0 flex-wrap items-center justify-end gap-2">
+          <span className="text-[10.5px] text-muted-foreground">{t('fuzzer.target.title')}</span>
+          {listLoading && items === null ? (
+            <Skeleton className="h-8 w-[300px]" />
+          ) : (
+            <Select
+              value={selectedId ?? undefined}
+              onValueChange={(value) => setSelectedId(value)}
+              disabled={items === null || items.length === 0}
+            >
+              <SelectTrigger
+                data-testid="fuzzer-target-select"
+                aria-label={t('fuzzer.target.title')}
+                className="h-8 w-[300px] text-[11.5px]"
+              >
+                <SelectValue placeholder={t('fuzzer.target.select')} />
+              </SelectTrigger>
+              <SelectContent className="max-h-[320px]">
+                {(items ?? []).map((item) => (
+                  <SelectItem key={item.id} value={item.id} className="text-[11.5px]">
+                    {item.vuln_name}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          )}
+          {selectedItem !== null ? (
+            <span className="flex items-center gap-1.5 text-[10px] text-muted-foreground">
+              <SeverityBadge severity={selectedItem.severity as Severity} />
+              <span className="max-w-[180px] truncate font-mono">{selectedItem.host}</span>
+              <StatusBadge status={selectedItem.status} />
+            </span>
+          ) : null}
+        </div>
+      </div>
+
+      {listError !== null ? (
+        <div role="alert" className="mt-3 rounded-lg border border-red-200 bg-red-50 px-3 py-2 text-[11.5px] text-red-700">
+          {t('fuzzer.target.loadFailed', { error: listError })}
+        </div>
+      ) : null}
+
+      <div className="mt-3 flex min-h-0 flex-1 flex-col">
+        {detailError !== null ? (
+          <div role="alert" className="rounded-lg border border-red-200 bg-red-50 px-3 py-2 text-[11.5px] text-red-700">
+            {detailError}
+          </div>
+        ) : detail === null && listError === null && !listLoading && (items?.length ?? 0) === 0 ? (
+          <div className="flex min-h-0 flex-1 items-center justify-center rounded-lg border border-dashed border-border bg-background/60 text-[12px] text-muted-foreground">
+            {t('fuzzer.target.empty')}
+          </div>
+        ) : detail === null ? (
+          <YakitSendPanel vuln={null} loading={detailLoading || listLoading || (items?.length ?? 0) > 0} />
+        ) : (
+          <YakitSendPanel key={detail.id} vuln={detail} loading={detailLoading} />
+        )}
+      </div>
+    </div>
+  )
+}