Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bugfix: working filter by header value #134

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

madamantis-leviathan
Copy link

@madamantis-leviathan madamantis-leviathan commented Feb 12, 2025

When on a test, I noticed that the "Header doesn't contain" filter didn't work. It turned out that message_passed_interception_filters in authorization.py used a wrong index to get the filter value:

if interceptionFilterTitle == "Header contains":  # len = 15
            for header in list(resInfo.getHeaders()):
                if interceptionFilter[17:] in header:  # starts at (len + 2) (i.e. "Header contains: ")
                    message_passed_filters = False

        if interceptionFilterTitle == "Header doesn't contain":  # len = 22
            for header in list(resInfo.getHeaders()):
                if not interceptionFilter[17:] in header:  # the correct index would be 24 (22 + 2) 
                    message_passed_filters = False

I've fixed this using an approach where you don't have to hard-code the index. Now we split by : at the start of the function to get interceptionFilterTitle and interceptionFilterContent and cut off the extra space symbol after the filter name.

 try:
            interceptionFilterTitle, interceptionFilterContent = interceptionFilter.split(":", 1)  # split only once to avoid possible `:` in user input
            interceptionFilterContent = interceptionFilterContent[1:]  # could have been .lstrip(' '), but user input may start with a space
 except Exception as e:
            print(interceptionFilter)
            print(e)
            continue

As a bonus, I've also changed auth_enforced_via_enforcement_detectors to use the same approach. I've also expanded the filter list to distinguish between request and response headers. Here are the new filter names:

                    "Request headers contain: ",
                     "Request headers don't contain: ",
                     "Response headers contain: ",
                     "Response headers don't contain: ",

I hope this will be of use to the others. Please let me know if this needs any changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant