@readme/httpsnippet 3.1.1 → 4.0.0

package/src/targets/ruby/native/fixtures/full.rb

@@ -0,0 +1,17 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything?foo=bar&foo=baz&baz=abc&key=value")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["cookie"] = 'foo=bar; bar=baz'
+request["accept"] = 'application/json'
+request["content-type"] = 'application/x-www-form-urlencoded'
+request.body = "foo=bar"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/headers.rb

@@ -0,0 +1,16 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/headers")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Get.new(url)
+request["accept"] = 'application/json'
+request["x-foo"] = 'Bar'
+request["x-bar"] = 'Foo'
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/http-insecure.rb

@@ -0,0 +1,11 @@
+require 'uri'
+require 'net/http'
+
+url = URI("http://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+
+request = Net::HTTP::Get.new(url)
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/jsonObj-multiline.rb

@@ -0,0 +1,15 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["content-type"] = 'application/json'
+request.body = "{\n  \"foo\": \"bar\"\n}"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/jsonObj-null-value.rb

@@ -0,0 +1,15 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["content-type"] = 'application/json'
+request.body = "{\"foo\":null}"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/multipart-data.rb

@@ -0,0 +1,15 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["content-type"] = 'multipart/form-data; boundary=---011000010111000001101001'
+request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"foo\"; filename=\"hello.txt\"\r\nContent-Type: text/plain\r\n\r\nHello World\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bar\"\r\n\r\nBonjour le monde\r\n-----011000010111000001101001--\r\n"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/multipart-file.rb

@@ -0,0 +1,15 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["content-type"] = 'multipart/form-data; boundary=---011000010111000001101001'
+request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"foo\"; filename=\"hello.txt\"\r\nContent-Type: text/plain\r\n\r\n\r\n-----011000010111000001101001--\r\n"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/multipart-form-data-no-params.rb

@@ -0,0 +1,14 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["Content-Type"] = 'multipart/form-data'
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/multipart-form-data.rb

@@ -0,0 +1,15 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["Content-Type"] = 'multipart/form-data; boundary=---011000010111000001101001'
+request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"foo\"\r\n\r\nbar\r\n-----011000010111000001101001--\r\n"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/nested.rb

@@ -0,0 +1,13 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything?foo%5Bbar%5D=baz%2Czap&fiz=buz&key=value")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Get.new(url)
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/query-encoded.rb

@@ -0,0 +1,13 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything?startTime=2019-06-13T19%3A08%3A25.455Z&endTime=2015-09-15T14%3A00%3A12-04%3A00")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Get.new(url)
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/query.rb

@@ -0,0 +1,13 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything?foo=bar&foo=baz&baz=abc&key=value")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Get.new(url)
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/short.rb

@@ -0,0 +1,13 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Get.new(url)
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/native/fixtures/text-plain.rb

@@ -0,0 +1,15 @@
+require 'uri'
+require 'net/http'
+require 'openssl'
+
+url = URI("https://httpbin.org/anything")
+
+http = Net::HTTP.new(url.host, url.port)
+http.use_ssl = true
+
+request = Net::HTTP::Post.new(url)
+request["content-type"] = 'text/plain'
+request.body = "Hello World"
+
+response = http.request(request)
+puts response.read_body

package/src/targets/ruby/target.ts

@@ -0,0 +1,14 @@
+import type { Target } from '../targets';
+import { native } from './native/client';
+
+export const ruby: Target = {
+  info: {
+    key: 'ruby',
+    title: 'Ruby',
+    extname: '.rb',
+    default: 'native',
+  },
+  clientsById: {
+    native,
+  },
+};

package/src/targets/shell/curl/client.test.ts

@@ -0,0 +1,157 @@
+import type { Request } from '../../..';
+import full from '../../../fixtures/requests/full';
+import nested from '../../../fixtures/requests/nested';
+import { runCustomFixtures } from '../../../fixtures/runCustomFixtures';
+
+runCustomFixtures({
+  targetId: 'shell',
+  clientId: 'curl',
+  tests: [
+    {
+      it: 'should use short options',
+      input: full.log.entries[0].request as Request,
+      options: { short: true, indent: false },
+      expected: 'short-options.sh',
+    },
+    {
+      it: 'should use binary option',
+      input: full.log.entries[0].request as Request,
+      options: {
+        short: true,
+        indent: false,
+        binary: true,
+      },
+      expected: 'binary-option.sh',
+    },
+    {
+      it: 'should use short globoff option',
+      input: nested.log.entries[0].request as Request,
+      options: {
+        short: true,
+        indent: false,
+        globOff: true,
+      },
+      expected: 'globoff-option.sh',
+    },
+    {
+      it: 'should use long globoff option',
+      input: nested.log.entries[0].request as Request,
+      options: {
+        indent: false,
+        globOff: true,
+      },
+      expected: 'long-globoff-option.sh',
+    },
+    {
+      it: 'should not de-glob when globoff is false',
+      input: nested.log.entries[0].request as Request,
+      options: {
+        indent: false,
+        globOff: false,
+      },
+      expected: 'dont-deglob.sh',
+    },
+    {
+      it: 'should use --http1.0 for HTTP/1.0',
+      input: {
+        method: 'GET',
+        url: 'http://mockbin.com/request',
+        httpVersion: 'HTTP/1.0',
+      } as Request,
+      options: {
+        indent: false,
+      },
+      expected: 'http10.sh',
+    },
+    {
+      it: 'should use custom indentation',
+      input: full.log.entries[0].request as Request,
+      options: {
+        indent: '@',
+      },
+      expected: 'custom-indentation.sh',
+    },
+
+    {
+      it: 'should send JSON-encoded data with single quotes within a HEREDOC',
+      input: {
+        method: 'POST',
+        url: 'https://httpbin.org/anything',
+        headers: [
+          {
+            name: 'content-type',
+            value: 'application/json',
+          },
+        ],
+        postData: {
+          mimeType: 'application/json',
+          text: '{"number":1,"string":"f\'oo"}',
+        },
+      } as Request,
+      options: {},
+      expected: 'heredoc-json-encoded-data.sh',
+    },
+    {
+      it: 'should keep JSON payloads that are smaller than 20 characters on one line',
+      input: {
+        method: 'POST',
+        url: 'https://httpbin.org/anything',
+        headers: [
+          {
+            name: 'content-type',
+            value: 'application/json',
+          },
+        ],
+        postData: {
+          text: '{"foo": "bar"}',
+          mimeType: 'application/json',
+        },
+      } as Request,
+      options: {},
+      expected: 'json-payloads-smaller-than-20-characters.sh',
+    },
+
+    // `harIsAlreadyEncoded` option
+    {
+      it: 'should not double-encode already encoded data with `harIsAlreadyEncoded`',
+      input: {
+        cookies: [{ name: 'user', value: encodeURIComponent('abc^') }],
+        queryString: [
+          { name: 'stringPound', value: encodeURIComponent('somethign&nothing=true') },
+          { name: 'stringHash', value: encodeURIComponent('hash#data') },
+          { name: 'stringArray', value: encodeURIComponent('where[4]=10') },
+          { name: 'stringWeird', value: encodeURIComponent('properties["$email"] == "testing"') },
+          { name: 'array', value: encodeURIComponent('something&nothing=true') },
+          { name: 'array', value: encodeURIComponent('nothing&something=false') },
+          { name: 'array', value: encodeURIComponent('another item') },
+        ],
+        method: 'POST',
+        url: 'https://httpbin.org/anything',
+        httpVersion: 'HTTP/1.1',
+      } as Request,
+      options: {
+        harIsAlreadyEncoded: true,
+      },
+      expected: 'harIsAlreadyEncoded-option-already-encoded.sh',
+    },
+    {
+      it: 'should escape brackets in query strings when `harIsAlreadyEncoded` is `true` and `escapeBrackets` is `true`',
+      input: {
+        method: 'GET',
+        url: 'https://httpbin.org/anything',
+        httpVersion: 'HTTP/1.1',
+        queryString: [
+          {
+            name: 'where',
+            value: '[["$attributed_flow","=","FLOW_ID"]]',
+          },
+        ],
+      } as Request,
+      options: {
+        harIsAlreadyEncoded: true,
+        // escapeBrackets: true, // @todo this need to be enabled?
+      },
+      expected: 'harIsAlreadyEncoded=option-escape-brackets.sh',
+    },
+  ],
+});

package/src/targets/shell/curl/client.ts

@@ -0,0 +1,193 @@
+/**
+ * @description
+ *
+ * HTTP code snippet generator for the Shell using cURL.
+ *
+ * @author
+ * @AhmadNassri
+ *
+ * for any questions or issues regarding the generated code snippet, please open an issue mentioning the author.
+ */
+
+import type { Client } from '../../targets';
+import { CodeBuilder } from '../../../helpers/code-builder';
+import { getHeaderName, isMimeTypeJSON } from '../../../helpers/headers';
+import { quote } from '../../../helpers/shell';
+
+export interface CurlOptions {
+  short?: boolean;
+  binary?: boolean;
+  globOff?: boolean;
+  indent?: string | false;
+  escapeBrackets?: boolean;
+}
+
+/**
+ * This is a const record with keys that correspond to the long names and values that correspond to the short names for cURL arguments.
+ */
+const params = {
+  globoff: 'g',
+  request: 'X',
+  'url ': '',
+  'http1.0': '0',
+  header: 'H',
+  cookie: 'b',
+  form: 'F',
+  data: 'd',
+} as const;
+
+const getArg = (short: boolean) => (longName: keyof typeof params) => {
+  if (short) {
+    const shortName = params[longName];
+    if (!shortName) {
+      return '';
+    }
+    return `-${shortName}`;
+  }
+  return `--${longName}`;
+};
+
+export const curl: Client<CurlOptions> = {
+  info: {
+    key: 'curl',
+    title: 'cURL',
+    link: 'http://curl.haxx.se/',
+    description: 'cURL is a command line tool and library for transferring data with URL syntax',
+  },
+  convert: ({ fullUrl, method, httpVersion, headersObj, allHeaders, postData }, options = {}) => {
+    const { indent = '  ', short = false, binary = false, globOff = false, escapeBrackets = false } = options;
+
+    const { push, join } = new CodeBuilder({
+      ...(typeof indent === 'string' ? { indent } : {}),
+      join: indent !== false ? ` \\\n${indent}` : ' ',
+    });
+
+    const arg = getArg(short);
+
+    let formattedUrl = quote(fullUrl);
+    if (escapeBrackets) {
+      formattedUrl = formattedUrl.replace(/\[/g, '\\[').replace(/\]/g, '\\]');
+    }
+
+    push(`curl ${arg('request')} ${method}`);
+    if (globOff) {
+      formattedUrl = unescape(formattedUrl);
+      push(arg('globoff'));
+    }
+    push(`${arg('url ')}${formattedUrl}`);
+
+    if (httpVersion === 'HTTP/1.0') {
+      push(arg('http1.0'));
+    }
+
+    // if multipart form data, we want to remove the boundary
+    if (postData.mimeType === 'multipart/form-data') {
+      const contentTypeHeaderName = getHeaderName(headersObj, 'content-type');
+      if (contentTypeHeaderName) {
+        const contentTypeHeader = headersObj[contentTypeHeaderName];
+        if (contentTypeHeaderName && contentTypeHeader) {
+          // remove the leading semi colon and boundary
+          // up to the next semi colon or the end of string
+          const noBoundary = String(contentTypeHeader).replace(/; boundary.+?(?=(;|$))/, '');
+
+          // replace the content-type header with no boundary in both headersObj and allHeaders
+          headersObj[contentTypeHeaderName] = noBoundary;
+          allHeaders[contentTypeHeaderName] = noBoundary;
+        }
+      }
+    }
+
+    // construct headers
+    Object.keys(headersObj)
+      .sort()
+      .forEach(key => {
+        const header = `${key}: ${headersObj[key]}`;
+        push(`${arg('header')} ${quote(header)}`);
+      });
+
+    if (allHeaders.cookie) {
+      push(`${arg('cookie')} ${quote(allHeaders.cookie as string)}`);
+    }
+
+    // construct post params
+    switch (postData.mimeType) {
+      case 'multipart/form-data':
+        postData.params?.forEach(param => {
+          let post = '';
+          if (param.fileName) {
+            post = `${param.name}=@${param.fileName}`;
+          } else {
+            post = `${param.name}=${param.value}`;
+          }
+
+          push(`${arg('form')} ${quote(post)}`);
+        });
+        break;
+
+      case 'application/x-www-form-urlencoded':
+        if (postData.params) {
+          postData.params.forEach(param => {
+            const unencoded = param.name;
+            const encoded = encodeURIComponent(param.name);
+            const needsEncoding = encoded !== unencoded;
+            const name = needsEncoding ? encoded : unencoded;
+            const flag = binary ? '--data-binary' : `--data${needsEncoding ? '-urlencode' : ''}`;
+            push(`${flag} ${quote(`${name}=${param.value}`)}`);
+          });
+        } else {
+          push(`${binary ? '--data-binary' : arg('data')} ${quote(postData.text)}`);
+        }
+        break;
+
+      default:
+        // raw request body
+        if (!postData.text) {
+          break;
+        }
+
+        // eslint-disable-next-line no-case-declarations -- builtPayload is only used here.
+        let builtPayload = false;
+
+        // If we're dealing with a JSON variant, and our payload is JSON let's make it look a little
+        // nicer.
+        if (isMimeTypeJSON(postData.mimeType)) {
+          // If our postData is less than 20 characters, let's keep it all on one line so as to not
+          // make the snippet overly lengthy
+          if (postData.text.length > 20) {
+            try {
+              const jsonPayload = JSON.parse(postData.text);
+
+              // If the JSON object has a single quote we should prepare it inside of a HEREDOC
+              // because the single quote in something like `string's` can't be escaped when used
+              // with `--data`.
+              //
+              // Basically this boils down to `--data @- <<EOF...EOF` vs `--data '...'`.
+              builtPayload = true;
+
+              if (postData.text.indexOf("'") > 0) {
+                push(
+                  `${binary ? '--data-binary' : arg('data')} @- <<EOF\n${JSON.stringify(
+                    jsonPayload,
+                    null,
+                    indent || ' '
+                  )}\nEOF`
+                );
+              } else {
+                push(
+                  `${binary ? '--data-binary' : arg('data')} '\n${JSON.stringify(jsonPayload, null, indent || ' ')}\n'`
+                );
+              }
+            } catch (err) {
+              // no-op
+            }
+          }
+        }
+
+        if (!builtPayload) {
+          push(`${binary ? '--data-binary' : arg('data')} ${quote(postData.text)}`);
+        }
+    }
+
+    return join();
+  },
+};

package/src/targets/shell/curl/fixtures/application-form-encoded.sh

@@ -0,0 +1,5 @@
+curl --request POST \
+  --url https://httpbin.org/anything \
+  --header 'content-type: application/x-www-form-urlencoded' \
+  --data foo=bar \
+  --data hello=world

package/src/targets/shell/curl/fixtures/application-json.sh

@@ -0,0 +1,25 @@
+curl --request POST \
+  --url https://httpbin.org/anything \
+  --header 'content-type: application/json' \
+  --data '
+{
+  "number": 1,
+  "string": "f\"oo",
+  "arr": [
+    1,
+    2,
+    3
+  ],
+  "nested": {
+    "a": "b"
+  },
+  "arr_mix": [
+    1,
+    "a",
+    {
+      "arr_mix_nested": {}
+    }
+  ],
+  "boolean": false
+}
+'

package/src/targets/shell/curl/fixtures/binary-option.sh

@@ -0,0 +1 @@
+curl -X POST 'https://httpbin.org/anything?foo=bar&foo=baz&baz=abc&key=value' -H 'accept: application/json' -H 'content-type: application/x-www-form-urlencoded' -b 'foo=bar; bar=baz' --data-binary foo=bar

package/src/targets/shell/curl/fixtures/cookies.sh

@@ -0,0 +1,3 @@
+curl --request GET \
+  --url https://httpbin.org/cookies \
+  --cookie 'foo=bar; bar=baz'

package/src/targets/shell/curl/fixtures/custom-indentation.sh

@@ -0,0 +1,6 @@
+curl --request POST \
+@--url 'https://httpbin.org/anything?foo=bar&foo=baz&baz=abc&key=value' \
+@--header 'accept: application/json' \
+@--header 'content-type: application/x-www-form-urlencoded' \
+@--cookie 'foo=bar; bar=baz' \
+@--data foo=bar

package/src/targets/shell/curl/fixtures/custom-method.sh

@@ -0,0 +1,2 @@
+curl --request PROPFIND \
+  --url https://httpbin.org/anything

package/src/targets/shell/curl/fixtures/dont-deglob.sh

@@ -0,0 +1 @@
+curl --request GET --url 'https://httpbin.org/anything?foo%5Bbar%5D=baz%2Czap&fiz=buz&key=value'

package/src/targets/shell/curl/fixtures/full.sh

@@ -0,0 +1,6 @@
+curl --request POST \
+  --url 'https://httpbin.org/anything?foo=bar&foo=baz&baz=abc&key=value' \
+  --header 'accept: application/json' \
+  --header 'content-type: application/x-www-form-urlencoded' \
+  --cookie 'foo=bar; bar=baz' \
+  --data foo=bar

package/src/targets/shell/curl/fixtures/globoff-option.sh

@@ -0,0 +1 @@
+curl -X GET -g 'https://httpbin.org/anything?foo[bar]=baz,zap&fiz=buz&key=value'

package/src/targets/shell/curl/fixtures/harIsAlreadyEncoded-option-already-encoded.sh

@@ -0,0 +1,3 @@
+curl --request POST \
+  --url 'https://httpbin.org/anything?stringPound=somethign%26nothing%3Dtrue&stringHash=hash%23data&stringArray=where%5B4%5D%3D10&stringWeird=properties%5B%22%24email%22%5D%20%3D%3D%20%22testing%22&array=something%26nothing%3Dtrue&array=nothing%26something%3Dfalse&array=another%20item' \
+  --cookie user=abc%5E

package/src/targets/shell/curl/fixtures/harIsAlreadyEncoded=option-escape-brackets.sh

@@ -0,0 +1,2 @@
+curl --request GET \
+  --url 'https://httpbin.org/anything?where=[["$attributed_flow","=","FLOW_ID"]]'

package/src/targets/shell/curl/fixtures/headers.sh

@@ -0,0 +1,5 @@
+curl --request GET \
+  --url https://httpbin.org/headers \
+  --header 'accept: application/json' \
+  --header 'x-bar: Foo' \
+  --header 'x-foo: Bar'