FlowAnalyzer 0.4.5__tar.gz → 0.4.7__tar.gz

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/FlowAnalyzer/FlowAnalyzer.py

@@ -56,7 +56,7 @@ class FlowAnalyzer:
             sql_pair = """
             SELECT 
                 req.frame_num, req.header, req.file_data, req.full_uri, req.time_epoch,  -- 0-4 (Request)
-                resp.frame_num, resp.header, resp.file_data, resp.time_epoch, resp.request_in -- 5-9 (Response)
+                resp.frame_num, resp.header, resp.file_data, resp.time_epoch, resp.request_in, resp.status_code -- 5-10 (Response)
             FROM requests req
             LEFT JOIN responses resp ON req.frame_num = resp.request_in
             ORDER BY req.frame_num ASC
@@ -70,20 +70,20 @@ class FlowAnalyzer:
 
                 resp = None
                 if row[5] is not None:
-                    resp = Response(frame_num=row[5], header=row[6] or b"", file_data=row[7] or b"", time_epoch=row[8], _request_in=row[9])
+                    resp = Response(frame_num=row[5], header=row[6] or b"", file_data=row[7] or b"", time_epoch=row[8], _request_in=row[9], status_code=row[10] or 0)
 
                 yield HttpPair(request=req, response=resp)
 
             # === 第二步：孤儿响应查询 ===
             sql_orphan = """
-            SELECT frame_num, header, file_data, time_epoch, request_in
+            SELECT frame_num, header, file_data, time_epoch, request_in, status_code
             FROM responses
             WHERE request_in NOT IN (SELECT frame_num FROM requests)
             """
             cursor.execute(sql_orphan)
 
             for row in cursor:
-                resp = Response(frame_num=row[0], header=row[1] or b"", file_data=row[2] or b"", time_epoch=row[3], _request_in=row[4])
+                resp = Response(frame_num=row[0], header=row[1] or b"", file_data=row[2] or b"", time_epoch=row[3], _request_in=row[4], status_code=row[5] or 0)
                 yield HttpPair(request=None, response=resp)
 
     # =========================================================================
@@ -161,7 +161,7 @@ class FlowAnalyzer:
             cursor.execute("PRAGMA journal_mode = MEMORY")
 
             cursor.execute("CREATE TABLE requests (frame_num INTEGER PRIMARY KEY, header BLOB, file_data BLOB, full_uri TEXT, time_epoch REAL)")
-            cursor.execute("CREATE TABLE responses (frame_num INTEGER PRIMARY KEY, header BLOB, file_data BLOB, time_epoch REAL, request_in INTEGER)")
+            cursor.execute("CREATE TABLE responses (frame_num INTEGER PRIMARY KEY, header BLOB, file_data BLOB, time_epoch REAL, request_in INTEGER, status_code INTEGER)")
 
             cursor.execute("""
                 CREATE TABLE meta_info (
@@ -174,50 +174,29 @@ class FlowAnalyzer:
             """)
             conn.commit()
 
+        lua_script_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "tshark.lua")
+
+        # Pass filter via environment variable
+        env = os.environ.copy()
+        env["flowanalyzer_filter"] = display_filter
+
         command = [
             tshark_path,
             "-r",
             pcap_path,
-            "-Y",
-            f"({display_filter})",
-            "-T",
-            "fields",
-            "-e",
-            "http.response.code",  # 0
-            "-e",
-            "http.request_in",  # 1
-            "-e",
-            "tcp.reassembled.data",  # 2
-            "-e",
-            "frame.number",  # 3
-            "-e",
-            "tcp.payload",  # 4
-            "-e",
-            "frame.time_epoch",  # 5
-            "-e",
-            "exported_pdu.exported_pdu",  # 6
-            "-e",
-            "http.request.full_uri",  # 7
-            "-e",
-            "tcp.segment.count",  # 8
-            "-E",
-            "header=n",
-            "-E",
-            "separator=/t",
-            "-E",
-            "quote=n",
-            "-E",
-            "occurrence=f",
+            "-q",
+            "-X",
+            f"lua_script:{lua_script_path}",
         ]
 
-        logger.debug(f"执行 Tshark: {command}")
+        logger.debug(f"执行 Tshark: {' '.join(command)}")
         BATCH_SIZE = 2000
         MAX_PENDING_BATCHES = 20  # 控制内存中待处理的批次数量 (Backpressure)
 
         # 使用 ThreadPoolExecutor 并行处理数据
         max_workers = min(32, (os.cpu_count() or 1) + 4)
 
-        process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=os.path.dirname(os.path.abspath(pcap_path)))
+        process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=os.path.dirname(os.path.abspath(pcap_path)), env=env, encoding="utf-8", errors="replace")
         try:
             with sqlite3.connect(db_path) as conn:
                 cursor = conn.cursor()
@@ -236,14 +215,14 @@ class FlowAnalyzer:
 
                         for item in results:
                             if item["type"] == "response":
-                                db_resp_rows.append((item["frame_num"], item["header"], item["file_data"], item["time_epoch"], item["request_in"]))
+                                db_resp_rows.append((item["frame_num"], item["header"], item["file_data"], item["time_epoch"], item["request_in"], item.get("status_code", 0)))
                             else:
                                 db_req_rows.append((item["frame_num"], item["header"], item["file_data"], item["full_uri"], item["time_epoch"]))
 
                         if db_req_rows:
                             cursor.executemany("INSERT OR REPLACE INTO requests VALUES (?,?,?,?,?)", db_req_rows)
                         if db_resp_rows:
-                            cursor.executemany("INSERT OR REPLACE INTO responses VALUES (?,?,?,?,?)", db_resp_rows)
+                            cursor.executemany("INSERT OR REPLACE INTO responses VALUES (?,?,?,?,?,?)", db_resp_rows)
 
                     def submit_batch():
                         """提交当前批次到线程池"""
@@ -259,6 +238,10 @@ class FlowAnalyzer:
                     # --- Main Pipeline Loop ---
                     if process.stdout:
                         for line in process.stdout:
+                            # Strip newline
+                            line = line.strip()
+                            if not line:
+                                continue
                             current_batch.append(line)
 
                             if len(current_batch) >= BATCH_SIZE:

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/FlowAnalyzer/Models.py

@@ -8,17 +8,18 @@ class Request:
     frame_num: int
     header: bytes
     file_data: bytes
-    full_uri: str
     time_epoch: float
+    full_uri: str
 
 
 @dataclass
 class Response:
-    __slots__ = ("frame_num", "header", "file_data", "time_epoch", "_request_in")
+    __slots__ = ("frame_num", "header", "file_data", "time_epoch", "status_code", "_request_in")
     frame_num: int
     header: bytes
     file_data: bytes
     time_epoch: float
+    status_code: int
     _request_in: Optional[int]
 
 

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/FlowAnalyzer/PacketParser.py

@@ -2,55 +2,90 @@ import binascii
 import contextlib
 import gzip
 from typing import List, Optional, Tuple
-from urllib import parse
 
 from .logging_config import logger
 
 
 class PacketParser:
     @staticmethod
-    def parse_packet_data(row: list) -> Tuple[int, int, float, str, bytes]:
+    def process_batch(lines: List[str]) -> List[dict]:
         """
-        解析 Tshark 输出的一行数据
-        row definition (all bytes):
-        0: http.response.code
-        1: http.request_in
-        2: tcp.reassembled.data
-        3: frame.number
-        4: tcp.payload
-        5: frame.time_epoch
-        6: exported_pdu.exported_pdu
-        7: http.request.full_uri 
-        8: tcp.segment.count
+        批量处理行数据
         """
-        frame_num = int(row[3])
-        request_in = int(row[1]) if row[1] else frame_num
-        # Decode only URI to string
-        full_uri = parse.unquote(row[7].decode("utf-8", errors="replace")) if row[7] else ""
-        time_epoch = float(row[5])
-
-        # Logic for Raw Packet (Header Source)
-        # Previous index 9 is now 8 since we removed http.file_data
-        is_reassembled = len(row) > 8 and row[8]
-
-        if is_reassembled and row[2]:
-            full_request = row[2]
-        elif row[4]:
-            full_request = row[4]
-        else:
-            # Fallback (e.g. Exported PDU)
-            full_request = row[2] if row[2] else (row[6] if row[6] else b"")
-
-        return frame_num, request_in, time_epoch, full_uri, full_request
+        results = []
+        for line in lines:
+            res = PacketParser.process_row(line)
+            if res:
+                results.append(res)
+        return results
+
+    @staticmethod
+    def process_row(line: str) -> Optional[dict]:
+        """
+        解析 Tshark Lua 脚本输出的一行数据
+        Columns:
+        0: type ("req" / "rep" / "data")
+        1: frame.number
+        2: time_epoch
+        3: header_hex
+        4: file_data_hex (Body)
+        5: uri_or_code
+        6: request_in
+        """
+        try:
+            parts = line.split("\t")
+            if len(parts) < 6:
+                return None
+
+            p_type = parts[0]
+            frame_num = int(parts[1])
+            time_epoch = float(parts[2])
+
+            # Hex string -> Bytes
+            # parts[3] might be empty string
+            header = binascii.unhexlify(parts[3]) if parts[3] else b""
+            file_data = binascii.unhexlify(parts[4]) if parts[4] else b""
+
+            uri_or_code = parts[5]
+            request_in_str = parts[6] if len(parts) > 6 else ""
+
+            if p_type == "req":
+                return {"type": "request", "frame_num": frame_num, "header": header, "file_data": file_data, "time_epoch": time_epoch, "full_uri": uri_or_code, "request_in": None}
+            elif p_type == "rep":
+                request_in = int(request_in_str) if request_in_str else 0
+                try:
+                    status_code = int(uri_or_code)
+                except (ValueError, TypeError):
+                    status_code = 0
+
+                return {
+                    "type": "response",
+                    "frame_num": frame_num,
+                    "header": header,
+                    "file_data": file_data,
+                    "time_epoch": time_epoch,
+                    "request_in": request_in,
+                    "status_code": status_code,
+                    "full_uri": "",
+                }
+            else:
+                # 'data' or unknown, ignore for now based on current logic
+                return None
+
+        except Exception as e:
+            logger.debug(f"Packet parse error: {e} | Line: {line[:100]}...")
+            return None
 
     @staticmethod
     def split_http_headers(file_data: bytes) -> Tuple[bytes, bytes]:
         headerEnd = file_data.find(b"\r\n\r\n")
         if headerEnd != -1:
             return file_data[: headerEnd + 4], file_data[headerEnd + 4 :]
-        elif file_data.find(b"\n\n") != -1:
-            headerEnd = file_data.index(b"\n\n") + 2
-            return file_data[:headerEnd], file_data[headerEnd:]
+
+        headerEnd = file_data.find(b"\n\n")
+        if headerEnd != -1:
+            return file_data[: headerEnd + 2], file_data[headerEnd + 2 :]
+
         return b"", file_data
 
     @staticmethod
@@ -73,6 +108,10 @@ class PacketParser:
                 raise ValueError("Not chunked data")
 
             size_line = file_data[cursor:newline_idx].strip()
+            # Handle chunk extension: ignore everything after ';'
+            if b";" in size_line:
+                size_line = size_line.split(b";", 1)[0].strip()
+
             if not size_line:
                 cursor = newline_idx + 1
                 continue
@@ -135,49 +174,3 @@ class PacketParser:
         except Exception as e:
             logger.error(f"解析HTTP数据未知错误: {e}")
             return b"", b""
-
-    @staticmethod
-    def process_row(line: bytes) -> Optional[dict]:
-        """
-        处理单行数据，返回结构化结果供主线程写入
-        """
-        line = line.rstrip(b"\r\n")
-        if not line:
-            return None
-
-        row = line.split(b"\t")
-        try:
-            frame_num, request_in, time_epoch, full_uri, full_request = PacketParser.parse_packet_data(row)
-
-            if not full_request:
-                return None
-
-            header, file_data = PacketParser.extract_http_file_data(full_request)
-
-            # row[0] is http.response.code (bytes)
-            is_response = bool(row[0])
-
-            return {
-                "type": "response" if is_response else "request",
-                "frame_num": frame_num,
-                "header": header,
-                "file_data": file_data,
-                "time_epoch": time_epoch,
-                "request_in": request_in,  # Only useful for Response
-                "full_uri": full_uri,  # Only useful for Request
-            }
-
-        except Exception:
-            return None
-
-    @staticmethod
-    def process_batch(lines: List[bytes]) -> List[dict]:
-        """
-        批量处理行数据，减少函数调用开销
-        """
-        results = []
-        for line in lines:
-            res = PacketParser.process_row(line)
-            if res:
-                results.append(res)
-        return results

flowanalyzer-0.4.7/FlowAnalyzer/tshark.lua

@@ -0,0 +1,196 @@
+-- =========================================================================
+-- 1. 字段定义
+-- =========================================================================
+local f_resp_code = Field.new("http.response.code")
+local f_full_uri = Field.new("http.request.full_uri")
+local f_frame_num = Field.new("frame.number")
+local f_time_epoch = Field.new("frame.time_epoch")
+local f_reassembled = Field.new("tcp.reassembled.data")
+local f_payload = Field.new("tcp.payload")
+local f_file_data = Field.new("http.file_data")
+local f_seg_count = Field.new("tcp.segment.count")
+local f_retrans = Field.new("tcp.analysis.retransmission")
+local f_request_in = Field.new("http.request_in")
+-- [新增] 替换 Header 源的字段
+local f_exported_pdu = Field.new("exported_pdu.exported_pdu")
+
+-- =========================================================================
+-- 2. 获取过滤器
+-- =========================================================================
+local user_filter = os.getenv("flowanalyzer_filter")
+if not user_filter or user_filter == "" then
+    user_filter = "http"
+end
+
+-- =========================================================================
+-- 3. 初始化监听器
+-- =========================================================================
+local tap = Listener.new("frame", user_filter)
+
+-- =========================================================================
+-- 4. 辅助函数
+-- =========================================================================
+
+local function val_to_str(val)
+    if val == nil then
+        return ""
+    end
+    return tostring(val)
+end
+
+-- 查找 Header 结束位置
+local function find_header_split_pos(hex_str)
+    if not hex_str then
+        return nil
+    end
+
+    -- 1. 找 0D0A0D0A (CRLF CRLF)
+    local start_idx = 1
+    while true do
+        local s, e = string.find(hex_str, "0D0A0D0A", start_idx, true)
+        if not s then
+            break
+        end
+        if s % 2 == 1 then
+            return s
+        end -- 确保字节对齐
+        start_idx = s + 1
+    end
+
+    -- 2. 找 0A0A (LF LF)
+    start_idx = 1
+    while true do
+        local s, e = string.find(hex_str, "0A0A", start_idx, true)
+        if not s then
+            break
+        end
+        if s % 2 == 1 then
+            return s
+        end
+        start_idx = s + 1
+    end
+    return nil
+end
+
+-- [核心性能优化] 智能提取 Header Hex
+-- 即使 Body 不限制大小，Header 依然建议只扫描前 2KB，因为 Header 不会那么长
+local function extract_header_smart(field_info)
+    if not field_info then
+        return ""
+    end
+
+    local range = field_info.range
+    local total_len = range:len()
+
+    -- 预览前 2KB
+    local cap_len = 2048
+    if total_len < cap_len then
+        cap_len = total_len
+    end
+
+    -- [关键] 转为 Hex 并强制转为大写
+    local preview_hex = string.upper(range(0, cap_len):bytes():tohex())
+
+    -- 查找分隔符
+    local pos = find_header_split_pos(preview_hex)
+
+    if pos then
+        return string.sub(preview_hex, 1, pos - 1)
+    else
+        return preview_hex
+    end
+end
+
+-- 直接获取完整 Hex
+local function get_full_hex(field_info)
+    if not field_info then
+        return ""
+    end
+    -- 强制转大写，保持格式一致
+    return string.upper(field_info.range:bytes():tohex())
+end
+
+-- =========================================================================
+-- 5. 主处理逻辑
+-- =========================================================================
+function tap.packet(pinfo, tvb)
+    -- 过滤 TCP 重传
+    if f_retrans() then
+        return
+    end
+
+    local frame_num = f_frame_num()
+    if not frame_num then
+        return
+    end
+
+    -- === 1. 确定类型 (req/rep) 和 信息 (URI/Code) ===
+    local col_type = "data"
+    local col_uri_or_code = ""
+
+    local code = f_resp_code()
+    local uri = f_full_uri()
+
+    if code then
+        col_type = "rep"
+        col_uri_or_code = tostring(code)
+    elseif uri then
+        col_type = "req"
+        col_uri_or_code = tostring(uri)
+    end
+
+    -- === 2. 基础信息 ===
+    local col_frame = tostring(frame_num)
+    local col_time = val_to_str(f_time_epoch())
+
+    -- === 3. Header Hex ===
+    -- 逻辑：Exported PDU > TCP Reassembled > TCP Payload
+    local col_header_hex = ""
+
+    local exp_pdu = f_exported_pdu()
+
+    if exp_pdu then
+        col_header_hex = extract_header_smart(exp_pdu)
+    else
+        local seq_count = f_seg_count()
+        local reass = nil
+        if seq_count then
+            reass = f_reassembled()
+        end
+
+        if reass then
+            col_header_hex = extract_header_smart(reass)
+        else
+            local pay = f_payload()
+            if pay then
+                col_header_hex = extract_header_smart(pay)
+            end
+        end
+    end
+
+    -- === 4. File Data (Body Hex) ===
+    -- [修改] 移除大小判断，无条件转换所有 Body
+    local col_file_data = ""
+    local fd = f_file_data()
+
+    if fd then
+        col_file_data = get_full_hex(fd)
+    end
+
+    -- === 5. Request In (仅响应包有) ===
+    local col_req_in = ""
+    local req_in = f_request_in()
+    if req_in then
+        col_req_in = tostring(req_in)
+    end
+
+    -- === 输出 (Tab 分隔) ===
+    print(table.concat({col_type, -- 1. req / rep
+    col_frame, -- 2. Frame Number
+    col_time, -- 3. Time Epoch
+    col_header_hex, -- 4. Header Bytes (Hex)
+    col_file_data, -- 5. File Data (Hex) [完整数据，不跳过]
+    col_uri_or_code, -- 6. URI / Code
+    col_req_in -- 7. Request In
+    }, "\t"))
+end

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/FlowAnalyzer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: FlowAnalyzer
-Version: 0.4.5
+Version: 0.4.7
 Summary: FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件
 Home-page: https://github.com/Byxs20/FlowAnalyzer
 Author: Byxs20

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/FlowAnalyzer.egg-info/SOURCES.txt

@@ -8,6 +8,7 @@ FlowAnalyzer/Path.py
 FlowAnalyzer/PcapSplitter.py
 FlowAnalyzer/__init__.py
 FlowAnalyzer/logging_config.py
+FlowAnalyzer/tshark.lua
 FlowAnalyzer.egg-info/PKG-INFO
 FlowAnalyzer.egg-info/SOURCES.txt
 FlowAnalyzer.egg-info/dependency_links.txt

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: FlowAnalyzer
-Version: 0.4.5
+Version: 0.4.7
 Summary: FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件
 Home-page: https://github.com/Byxs20/FlowAnalyzer
 Author: Byxs20

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/setup.py

@@ -7,16 +7,16 @@ with open(os.path.join(os.path.dirname(__file__), "README.md"), encoding="utf-8"
 
 setup(
     name="FlowAnalyzer",
-    version="0.4.5",
+    version="0.4.7",
     description="FlowAnalyzer是一个流量分析器，用于解析和处理tshark导出的JSON数据文件",
     author="Byxs20",
     author_email="97766819@qq.com",
     packages=find_packages(exclude=["tests", "*.egg-info"]),
     package_data={
-        '': ['LICENSE', 'README.md', 'setup.py'],
+        "": ["LICENSE", "README.md", "setup.py"],
+        "FlowAnalyzer": ["*.lua"],
     },
-    install_requires=[
-    ],
+    install_requires=[],
     classifiers=[
         "Development Status :: 3 - Alpha",
         "Intended Audience :: Developers",
@@ -27,7 +27,6 @@ setup(
         "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
     ],
-
     long_description=long_description,
     long_description_content_type="text/markdown",
     url="https://github.com/Byxs20/FlowAnalyzer",

{flowanalyzer-0.4.5 → flowanalyzer-0.4.7}/tests/test.py

@@ -1,7 +1,5 @@
 import os
 
-from viztracer import VizTracer
-
 from FlowAnalyzer.FlowAnalyzer import FlowAnalyzer
 
 # ============================
@@ -20,8 +18,7 @@ def main():
         return
 
     print("[*] 开始解析 PCAP 文件...")
-    with VizTracer():
-        db_path = FlowAnalyzer.get_db_data(PCAP_FILE, DISPLAY_FILTER)
+    db_path = FlowAnalyzer.get_db_data(PCAP_FILE, DISPLAY_FILTER)
     print(f"[*] 解析完成，数据库生成: {db_path}")
 
     print("[*] 遍历 HTTP 请求-响应对:")

flowanalyzer-0.4.7/tests/test_parser.py

@@ -0,0 +1,52 @@
+import binascii
+import gzip
+import unittest
+from urllib import parse
+
+from FlowAnalyzer.PacketParser import PacketParser
+
+
+class TestPacketParserOptimization(unittest.TestCase):
+    def test_gzip_decompression(self):
+        # Construct a fake HTTP response with GZIP body
+        content = b"Hello, Gzip World!"
+        compressed = gzip.compress(content)
+        header = b"HTTP/1.1 200 OK\r\nContent-Encoding: gzip\r\n\r\n"
+        full_response = header + compressed
+
+        full_request_hex = binascii.hexlify(full_response)
+
+        # Test extract_http_file_data
+        extracted_header, extracted_body = PacketParser.extract_http_file_data(full_request_hex)
+
+        self.assertEqual(extracted_header, header)
+        self.assertEqual(extracted_body, content)
+
+    def test_basic_extraction(self):
+        # Case: Simple text body, no chunking
+        content = b"Simple Body"
+        header = b"HTTP/1.1 200 OK\r\n\r\n"
+        full_response = header + content
+        full_request_hex = binascii.hexlify(full_response)
+
+        extracted_header, extracted_body = PacketParser.extract_http_file_data(full_request_hex)
+        self.assertEqual(extracted_body, content)
+
+    def test_chunked_decoding(self):
+        # Case: Chunked body
+        # 5\r\nHello\r\n0\r\n\r\n
+        chunked_body = bytes.fromhex(
+            "333b577644436167386f6a6d41707950734d36456d590d0a6e616d0d0a323b5052457a347a3678686b797875775656506d645a7757700d0a653d0d0a333b30544350750d0a6868680d0a333b4271694b6e7056486c4338750d0a2532370d0a333b4562636d544855354b6a58485976725575615074414d0d0a2537430d0a313b6a694f4542774c44624b3267620d0a250d0a333b376c6447726b3663350d0a3743250d0a313b3232424d6c5838426f360d0a320d0a333b684d61354547593339740d0a3853450d0a313b41723843390d0a4c0d0a333b31693052423453360d0a4543540d0a313b444968514d3164633870560d0a250d0a333b4d73736a630d0a3230250d0a323b4a77756d74324636440d0a32370d0a323b37654844337a30646430454d55643353636c0d0a52430d0a323b797549574643783137377330476630530d0a75470d0a323b6552794878625735625175485a64575832450d0a25320d0a313b5a7145444c32690d0a370d0a333b346a637a720d0a2532300d0a333b39627a59497650544b39714655376f6a6d374d664d305976480d0a46524f0d0a313b5556477645615749584e62784f0d0a4d0d0a323b4b503748426f7a6f687530744e514a6c59634a44417156630d0a25320d0a313b3458467945466a3347366f765869694f650d0a300d0a333b696a3054754c3578595768705049390d0a4455410d0a313b595730494f0d0a4c0d0a323b4e3567485a4861504d3233346b50564b4b4f45464e390d0a25320d0a313b495254683876435468625137334a773669397a0d0a300d0a333b414635416a7265585977356e35496b67453952513252420d0a5748450d0a313b67565846465a586b547074313752574d580d0a520d0a323b614e7a5947754948774339790d0a45250d0a313b3076757a444f43446e36613162313269424c73796b616e65430d0a320d0a323b41666e524d716447540d0a30390d0a333b427a3773504a534d370d0a3736360d0a333b34544757775458484a51687a7666596238326a6c6b39440d0a2533440d0a323b48334b35646c4c0d0a39370d0a323b7362517563480d0a36360d0a333b326c6f45534c79684f32495535306865756f300d0a2532300d0a333b65415169345751456e4c4d30446d39636d537836430d0a414e440d0a333b65556a4c6b4a6635635441364c346c3731305547376c67570d0a2532300d0a333b63416f4d546771444c590d0a3937390d0a323b523778364233616167387648310d0a39250d0a333b7765764b577a52530d0a3344490d0a323b527344505845754a517563314c54434d0d0a46250d0a313b45617431624b354c4e76365465384c0d0a320d0a313b48725072376d6c7231666265446c7353454d6f4d550d0a380d0a313b634137714b43516e5671387155794d7046367a4c38665058650d0a250d0a323b4f664c343252727364356f4d6855644548336878745459720d0a32380d0a333b70336e437046720d0a4f52440d0a323b4972505332386b344f42416b414b306d6e7769724156370d0a25320d0a323b7476674d72366363670d0a384d0d0a323b317a4f77623045774256516641486a7266386858576d6946710d0a49440d0a323b3779366b7077375a304b6a46777a724e0d0a25320d0a323b5259684b71336e4853656d786b564952514b53444877346d0d0a38250d0a333b3264365a4d3643674451700d0a3238530d0a323b4d61443468473772496b59336c565a476f6d0d0a454c0d0a323b31476336376e6f46750d0a45430d0a333b746774754b0d0a5425320d0a313b6549464d676a594b6b4b4f487143654169540d0a300d0a313b327530776264486f5363737536327370757076580d0a490d0a333b716d733841370d0a464e550d0a333b78563962414232630d0a4c4c250d0a313b3733507567370d0a320d0a333b454b4e6268326a316271415635440d0a3843410d0a313b52787738716c78454f4a6d6d700d0a530d0a323b6a337954446476564d516372714f360d0a54250d0a333b4e47566976674144590d0a3238660d0a323b5954615959654b474c564b41536e78650d0a6c610d0a323b6272557a796e324179304d667a6c6f6e0d0a67250d0a323b684870416876446c706f570d0a32300d0a323b6172786778475938714c51655677503931687453344d456c530d0a41530d0a313b4a52304472594a69427972794b74646d31666950340d0a250d0a313b546835467a0d0a320d0a313b6d6c366d39774b514435745841725059750d0a300d0a313b314a484a690d0a430d0a313b6c524b5531477152466e6e454d46754e64780d0a480d0a313b61447071630d0a410d0a313b6d7a65557152486455337a756a730d0a520d0a333b474e4d375164436f4a3042696d0d0a2532390d0a323b7655686967646f3373727739456f67547a4c0d0a25320d0a323b34576a6d747a394c5744384d77434831567175786d7a706d350d0a43300d0a313b343831656f4c5a720d0a780d0a333b456e64787155527049734372540d0a3230250d0a313b63797356646954553537510d0a320d0a323b4e447159334557710d0a39250d0a323b776d44496a4f0d0a32300d0a333b535839487375573269476247440d0a46524f0d0a333b4d7636616e53516e586a3072714337487936536b576558570d0a4d25320d0a323b5441674444626d6437480d0a30740d0a333b784f346a79584f677251676f390d0a6573740d0a333b6b5766563469557466430d0a2e666c0d0a323b6d334b4d416565430d0a61670d0a333b6a6141744d4631576d540d0a2532300d0a313b3150596e30506e75570d0a4f0d0a333b683638724e36554a684f6a476a65450d0a5244450d0a313b4f51316c736a6e344b337049540d0a520d0a333b7257625142566452613868464b4c7352780d0a2532300d0a333b3941694b4d4454596976647476423561347642676739440d0a4259250d0a323b66626d764c5475434855505064644d796d320d0a32300d0a313b716933793571563066467a63556166643245770d0a660d0a313b524b424673594f3574694342360d0a6c0d0a323b6d494343414c0d0a61670d0a313b6c4b4236585632384b72316e33750d0a250d0a333b6d77794e6765520d0a32304c0d0a333b4849337031346574450d0a494d490d0a333b425836546a4a68306e43754c6a6b4d7436646c760d0a5425320d0a333b356e363078326d4b6f5a7063484f6b654f5a7861386774594d0d0a3030250d0a313b39753457534e655a0d0a320d0a323b77536e544967446b0d0a43310d0a323b3372446f630d0a25320d0a333b32636f744f4759700d0a3925320d0a333b35464f6d34706b636346376a5a7973304e776a750d0a4334320d0a313b686f645257386c6a776c6e5a47675a6d4e4c690d0a250d0a323b624e6d784c0d0a32430d0a333b66374e6931536d6c0d0a3125320d0a313b4d46466e573043645637340d0a390d0a313b774b4e4645454445747a4a537075325a4c626d78656a49304c0d0a250d0a333b636e595a5843373633767a5343636c6b5936790d0a3239250d0a323b343731684f545179580d0a33450d0a333b5166684944494c4a675556754937616244410d0a3125320d0a323b753442385358704742536e0d0a39250d0a323b4f374c73474b775169324b30330d0a32430d0a313b6b375639414951544d4661713879745541540d0a530d0a313b6533336944690d0a4c0d0a323b6f75386d44324343504e4870316232474f0d0a45450d0a323b6e4b6f644d0d0a50250d0a323b4b45584b6b43750d0a32380d0a333b495357635771784f39507750724244766772370d0a3125320d0a323b42596b4a4948704c62623147760d0a39250d0a333b783347786e434b776e48370d0a3243390d0a313b7837396f49670d0a370d0a323b734634364168736c7968547a667a756f32520d0a39390d0a333b5a786e37734e69534d7356386d51685244637872594953490d0a2532390d0a333b416e586f37345071447531500d0a2532390d0a323b6f7164664144327247580d0a25370d0a313b39384f494f4358644a6d66664f386c770d0a430d0a333b47565a6e593965457769584a0d0a2537430d0a323b614e376c4b6147544c77735172786342410d0a25320d0a333b6563585745797364467679474162306f61515a7966327239660d0a3726700d0a333b6e7878464c545a65527779646639310d0a6173730d0a323b4952463149314a36490d0a3d780d0a323b3567327643664e0d0a78780d0a300d0a0d0a"
+        )
+        header = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n"
+        full_response = header + chunked_body
+        full_request_hex = binascii.hexlify(full_response)
+        extracted_header, extracted_body = PacketParser.extract_http_file_data(full_request_hex)
+        self.assertEqual(
+            parse.unquote_to_bytes(extracted_body),  # 手动url解码一下
+            b"name=hhh'||(SELECT 'RCuG' FROM DUAL WHERE 9766=9766 AND 9799=IF((ORD(MID((SELECT IFNULL(CAST(flag AS CHAR),0x20) FROM test.flag ORDER BY flag LIMIT 0,1),42,1))>1),SLEEP(1),9799))||'&pass=xxx",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

flowanalyzer-0.4.5/tests/test_parser.py

@@ -1,47 +0,0 @@
-import binascii
-import gzip
-import unittest
-
-from FlowAnalyzer.PacketParser import PacketParser
-
-
-class TestPacketParserOptimization(unittest.TestCase):
-    def test_gzip_decompression(self):
-        # Construct a fake HTTP response with GZIP body
-        content = b"Hello, Gzip World!"
-        compressed = gzip.compress(content)
-        header = b"HTTP/1.1 200 OK\r\nContent-Encoding: gzip\r\n\r\n"
-        full_response = header + compressed
-
-        full_request_hex = binascii.hexlify(full_response)
-
-        # Test extract_http_file_data
-        extracted_header, extracted_body = PacketParser.extract_http_file_data(full_request_hex)
-
-        self.assertEqual(extracted_header, header)
-        self.assertEqual(extracted_body, content)
-
-    def test_basic_extraction(self):
-        # Case: Simple text body, no chunking
-        content = b"Simple Body"
-        header = b"HTTP/1.1 200 OK\r\n\r\n"
-        full_response = header + content
-        full_request_hex = binascii.hexlify(full_response)
-
-        extracted_header, extracted_body = PacketParser.extract_http_file_data(full_request_hex)
-        self.assertEqual(extracted_body, content)
-
-    def test_chunked_decoding(self):
-        # Case: Chunked body
-        # 5\r\nHello\r\n0\r\n\r\n
-        chunked_body = b"5\r\nHello\r\n0\r\n\r\n"
-        header = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n"
-        full_response = header + chunked_body
-        full_request_hex = binascii.hexlify(full_response)
-
-        extracted_header, extracted_body = PacketParser.extract_http_file_data(full_request_hex)
-        self.assertEqual(extracted_body, b"Hello")
-
-
-if __name__ == "__main__":
-    unittest.main()