Quoted Teststrings are read without context

[lumaier]

In the context of web application firewalls it makes a difference whether a string comes within a quoted context or not.

Assuming a Unix shell injection of the form
ls "dir/<INJECTION>"
it makes a difference whether the injected string is "; cat secret.txt" (quoted) or ; cat secret.txt(unquoted).

In some testcases (e.g., testcases/owasp/sql-injection.yml) there are teststrings in a quoted context. However, the scanner strips the quotation marks from the teststrings and submits an altered form.

This is because in internal/db/load.go the yaml configuration is unmarshalled (line 56). There, the quotations around teststrings are deleted.

Thanks for looking into this