-
Notifications
You must be signed in to change notification settings - Fork 34
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix/template issues new #41
base: master
Are you sure you want to change the base?
Conversation
@@ -44,3 +44,6 @@ validate: | |||
response_code: | |||
gte: 200 | |||
lt: 300 | |||
response_payload: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
isn't 200 resp code enough for noauth test?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No harm adding response length check @ayushaga14
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
discussed with ankush, we should also consider the case where initial response length was 0
- "Django tried these url patterns" | ||
- "Django version" | ||
- "Exception Type" | ||
- "Template rendering" | ||
- "Request Method" | ||
- "Request URL" | ||
- "Django Settings" | ||
- "Python Executable" | ||
- "Python Path" | ||
- "Server time" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- "Request Method"
- "Request URL"
- "Exception Type"
Just confirm once if these can give false positives
not_contains_either: | ||
- root |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we dont want the original request / response to have possibilities of LFI, without even modifying the request
@@ -52,3 +52,5 @@ validate: | |||
response_payload: | |||
contains_either: | |||
- "hello world" | |||
not_contains_either: | |||
- "| echo 'hello world'" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why not just check for "echo 'hello world'"?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you have a point, but we dont want our own modified request to reflect in the response payload, we can use either to validate that.
No description provided.