@@ -18,7 +18,7 @@ func main() {
18
18
19
19
var input io.Reader
20
20
input = strings .NewReader (strings .Join (flag .Args (), "\n " ))
21
- if flag .Arg ( 0 ) == "" {
21
+ if flag .NArg ( ) == 0 {
22
22
input = os .Stdin
23
23
}
24
24
@@ -27,29 +27,39 @@ func main() {
27
27
for sc .Scan () {
28
28
u , err := url .Parse (sc .Text ())
29
29
if err != nil {
30
- fmt .Println ( err )
31
- return
30
+ fmt .Fprintln ( os . Stderr , err )
31
+ continue
32
32
}
33
33
34
34
resp , err := http .Get (u .String ())
35
35
if err != nil {
36
- fmt .Println ( err )
37
- return
36
+ fmt .Fprintln ( os . Stderr , err )
37
+ continue
38
38
}
39
39
40
40
defer resp .Body .Close ()
41
41
42
42
b , err := ioutil .ReadAll (resp .Body )
43
43
if err != nil {
44
- fmt .Println ( err )
45
- return
44
+ fmt .Fprintln ( os . Stderr , err )
45
+ continue
46
46
}
47
47
body := string (b )
48
48
49
49
for k , vv := range u .Query () {
50
50
for _ , v := range vv {
51
51
52
+ // short strings are so likely to show up in the response
53
+ // that it's best just to skip over them to avoid too many
54
+ // false positives. There should be a flag to control this.
55
+ if len (v ) < 4 {
56
+ continue
57
+ }
58
+
52
59
// a fairly shonky way to get a few chars of context either side of the match
60
+ // but it helps avoid trying to find the locations of all the matches in the
61
+ // body, and then getting the context on either side, with all the bounds
62
+ // checking etc that would need to be done for that.
53
63
re , err := regexp .Compile ("(.{0,6}" + regexp .QuoteMeta (v ) + ".{0,6})" )
54
64
if err != nil {
55
65
fmt .Fprintf (os .Stderr , "regexp compile error: %s" , err )
@@ -58,7 +68,7 @@ func main() {
58
68
matches := re .FindAllStringSubmatch (body , - 1 )
59
69
60
70
for _ , m := range matches {
61
- fmt .Printf ("%s: query string key '%s' with value ' %s' reflected in response body (...%s...)\n " , u , k , v , m [0 ])
71
+ fmt .Printf ("%s: '%s= %s' reflected in response body (...%s...)\n " , u , k , v , m [0 ])
62
72
}
63
73
}
64
74
0 commit comments