Examples with HttpMalformedHeaderException org.parosproxy.paros.network.HttpMalformedHeaderException used on opensource projects

Example 16 with HttpMalformedHeaderException

use of org.parosproxy.paros.network.HttpMalformedHeaderException in project zaproxy by zaproxy.

the class FilterReplaceResponseHeader method onHttpResponseReceive.

@Override
public void onHttpResponseReceive(HttpMessage msg) {
    if (getPattern() == null) {
        return;
    } else if (msg.getResponseHeader().isEmpty()) {
        return;
    }
    Matcher matcher = getPattern().matcher(msg.getResponseHeader().toString());
    String result = matcher.replaceAll(getReplaceText());
    try {
        msg.getResponseHeader().setMessage(result);
    } catch (HttpMalformedHeaderException e) {
    }
}

Example 17 with HttpMalformedHeaderException

use of org.parosproxy.paros.network.HttpMalformedHeaderException in project zaproxy by zaproxy.

the class Analyser method isFileExist.

public boolean isFileExist(HttpMessage msg) {
    if (msg.getResponseHeader().isEmpty()) {
        return false;
    }
    // RFC
    if (msg.getResponseHeader().getStatusCode() == HttpStatusCode.NOT_FOUND) {
        return false;
    }
    // ZAP: catch CloneNotSupportedException as introduced with version 3.1 of HttpClient
    URI uri = null;
    String sUri = null;
    try {
        uri = (URI) msg.getRequestHeader().getURI().clone();
        // strip off last part of path - use folder only
        uri.setQuery(null);
        String path = uri.getPath();
        path = path.replaceAll("/[^/]*$", "");
        uri.setPath(path);
    } catch (Exception e) {
    } finally {
        if (uri != null) {
            sUri = uri.toString();
        }
    }
    // get sample with same relative path position when possible.
    // if not exist, use the host only	
    // ZAP: Removed unnecessary cast.
    SampleResponse sample = mapVisited.get(sUri);
    if (sample == null) {
        try {
            uri.setPath(null);
        } catch (URIException e2) {
        }
        String sHostOnly = uri.toString();
        // ZAP: Removed unnecessary cast.
        sample = mapVisited.get(sHostOnly);
    }
    // check if any analysed result.
    if (sample == null) {
        if (msg.getResponseHeader().getStatusCode() == HttpStatusCode.OK) {
            // no anlaysed result to confirm, assume file exist and return
            return true;
        } else {
            return false;
        }
    }
    // check for redirect response.  If redirect to same location, then file does not exist
    if (HttpStatusCode.isRedirection(msg.getResponseHeader().getStatusCode())) {
        try {
            if (sample.getMessage().getResponseHeader().getStatusCode() == msg.getResponseHeader().getStatusCode()) {
                String location = msg.getResponseHeader().getHeader(HttpHeader.LOCATION);
                if (location != null && location.equals(sample.getMessage().getResponseHeader().getHeader(HttpHeader.LOCATION))) {
                    return false;
                }
            }
        } catch (Exception e) {
            logger.error(e.getMessage(), e);
        }
        return true;
    }
    // Not success code
    if (msg.getResponseHeader().getStatusCode() != HttpStatusCode.OK) {
        return false;
    }
    // remain only OK response here
    // nothing more to determine.  Check for possible not found page pattern.
    Matcher matcher = patternNotFound.matcher(msg.getResponseBody().toString());
    if (matcher.find()) {
        return false;
    }
    // static response
    String body = msg.getResponseBody().toString().replaceAll(p_REMOVE_HEADER, "");
    if (sample.getErrorPageType() == SampleResponse.ERROR_PAGE_STATIC) {
        try {
            if (sample.getMessage().getResponseBody().toString().equals(body)) {
                return false;
            }
        } catch (HttpMalformedHeaderException | DatabaseException e) {
            logger.error("Failed to read the message: " + e.getMessage(), e);
        }
        return true;
    }
    uri = msg.getRequestHeader().getURI();
    try {
        if (sample.getErrorPageType() == SampleResponse.ERROR_PAGE_DYNAMIC_BUT_DETERMINISTIC) {
            body = msg.getResponseBody().toString().replaceAll(getPathRegex(uri), "").replaceAll("\\s[012]\\d:[0-5]\\d:[0-5]\\d\\s", "");
            // ZAP: FindBugs fix - added call to HttpBody.toString() 
            if (sample.getMessage().getResponseBody().toString().equals(body)) {
                return false;
            }
            return true;
        }
    } catch (Exception e) {
        logger.error(e.getMessage(), e);
    }
    return true;
}

Example 18 with HttpMalformedHeaderException

use of org.parosproxy.paros.network.HttpMalformedHeaderException in project zaproxy by zaproxy.

the class ProxyThread method run.

@Override
public void run() {
    proxyThreadList.add(thread);
    boolean isSecure = this instanceof ProxyThreadSSL;
    HttpRequestHeader firstHeader = null;
    try {
        BufferedInputStream bufferedInputStream = new BufferedInputStream(inSocket.getInputStream(), 2048);
        inSocket = new CustomStreamsSocket(inSocket, bufferedInputStream, inSocket.getOutputStream());
        httpIn = new HttpInputStream(inSocket);
        httpOut = new HttpOutputStream(inSocket.getOutputStream());
        firstHeader = httpIn.readRequestHeader(isSecure);
        firstHeader.setSenderAddress(inSocket.getInetAddress());
        if (firstHeader.getMethod().equalsIgnoreCase(HttpRequestHeader.CONNECT)) {
            HttpMessage connectMsg = new HttpMessage(firstHeader);
            connectMsg.setTimeSentMillis(System.currentTimeMillis());
            try {
                httpOut.write(CONNECT_HTTP_200);
                httpOut.flush();
                connectMsg.setResponseHeader(CONNECT_HTTP_200);
                connectMsg.setTimeElapsedMillis((int) (System.currentTimeMillis() - connectMsg.getTimeSentMillis()));
                notifyConnectMessage(connectMsg);
                byte[] bytes = new byte[3];
                bufferedInputStream.mark(3);
                bufferedInputStream.read(bytes);
                bufferedInputStream.reset();
                if (isSslTlsHandshake(bytes)) {
                    isSecure = true;
                    beginSSL(firstHeader.getHostName());
                }
                firstHeader = httpIn.readRequestHeader(isSecure);
                firstHeader.setSenderAddress(inSocket.getInetAddress());
                processHttp(firstHeader, isSecure);
            } catch (MissingRootCertificateException e) {
                // Unluckily Firefox and Internet Explorer will not show this message.
                // We should find a way to let the browsers display this error message.
                // May we can redirect to some kind of ZAP custom error page.
                final HttpMessage errmsg = new HttpMessage(firstHeader);
                setErrorResponse(errmsg, BAD_GATEWAY_RESPONSE_STATUS, e, "ZAP SSL Error");
                writeHttpResponse(errmsg, httpOut);
                throw new IOException(e);
            }
        } else {
            processHttp(firstHeader, isSecure);
        }
    } catch (SocketTimeoutException e) {
        // ZAP: Log the exception
        if (firstHeader != null) {
            if (HttpRequestHeader.CONNECT.equalsIgnoreCase(firstHeader.getMethod())) {
                log.warn("Timeout reading (client) message after CONNECT to " + firstHeader.getURI());
            } else {
                log.warn("Timeout accessing " + firstHeader.getURI());
            }
        } else {
            log.warn("Socket timeout while reading first message.");
            if (log.isDebugEnabled()) {
                log.debug(e, e);
            }
        }
    } catch (HttpMalformedHeaderException e) {
        log.warn("Malformed Header: ", e);
    } catch (HttpException e) {
        log.error(e.getMessage(), e);
    } catch (IOException e) {
        log.debug("IOException: ", e);
    } finally {
        proxyThreadList.remove(thread);
        // ZAP: do only close if flag is false
        if (!keepSocketOpen) {
            disconnect();
        }
    }
}

Example 19 with HttpMalformedHeaderException

use of org.parosproxy.paros.network.HttpMalformedHeaderException in project zaproxy by zaproxy.

the class VariantHeaderUnitTest method createMessageWithHeaders.

private static HttpMessage createMessageWithHeaders(NameValuePair... headers) {
    HttpMessage message = new HttpMessage();
    try {
        StringBuilder requestHeaderBuilder = new StringBuilder("GET / HTTP/1.1\r\n");
        for (NameValuePair header : headers) {
            requestHeaderBuilder.append(header.getName());
            requestHeaderBuilder.append(": ");
            requestHeaderBuilder.append(header.getValue());
            requestHeaderBuilder.append("\r\n");
        }
        message.setRequestHeader(requestHeaderBuilder.toString());
    } catch (HttpMalformedHeaderException e) {
        throw new RuntimeException(e);
    }
    return message;
}

Example 20 with HttpMalformedHeaderException

use of org.parosproxy.paros.network.HttpMalformedHeaderException in project zaproxy by zaproxy.

the class ParosTableHistory method getHistoryCache.

@Override
public RecordHistory getHistoryCache(HistoryReference ref, HttpMessage reqMsg) throws DatabaseException, HttpMalformedHeaderException {
    try {
        //  get the cache from provided reference.
        //  naturally, the obtained cache should be AFTER AND NEARBY to the given reference.
        //  - historyId up to historyId+200
        //  - match sessionId
        //  - history type can be MANUEL or hidden (hidden is used by images not explicitly stored in history)
        //  - match URI
        PreparedStatement psReadCache = null;
        if (isExistStatusCode) {
            //          psReadCache = getConnection().prepareStatement("SELECT TOP 1 * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND " + HISTORYID + " >= ? AND " + HISTORYID + " <= ? AND SESSIONID = ? AND (HISTTYPE = " + HistoryReference.TYPE_MANUAL + " OR HISTTYPE = " + HistoryReference.TYPE_HIDDEN + ") AND STATUSCODE != 304");
            psReadCache = getConnection().prepareStatement("SELECT TOP 1 * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND " + HISTORYID + " >= ? AND " + HISTORYID + " <= ? AND SESSIONID = ? AND STATUSCODE != 304");
        } else {
            //          psReadCache = getConnection().prepareStatement("SELECT * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND " + HISTORYID + " >= ? AND " + HISTORYID + " <= ? AND SESSIONID = ? AND (HISTTYPE = " + HistoryReference.TYPE_MANUAL + " OR HISTTYPE = " + HistoryReference.TYPE_HIDDEN + ")");
            psReadCache = getConnection().prepareStatement("SELECT * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND " + HISTORYID + " >= ? AND " + HISTORYID + " <= ? AND SESSIONID = ?)");
        }
        psReadCache.setString(1, reqMsg.getRequestHeader().getURI().toString());
        psReadCache.setString(2, reqMsg.getRequestHeader().getMethod());
        if (bodiesAsBytes) {
            psReadCache.setBytes(3, reqMsg.getRequestBody().getBytes());
        } else {
            psReadCache.setString(3, new String(reqMsg.getRequestBody().getBytes()));
        }
        psReadCache.setInt(4, ref.getHistoryId());
        psReadCache.setInt(5, ref.getHistoryId() + 200);
        psReadCache.setLong(6, ref.getSessionId());
        ResultSet rs = psReadCache.executeQuery();
        RecordHistory rec = null;
        try {
            do {
                rec = build(rs);
                // and the result should NOT be NOT_MODIFIED for rendering by browser
                if (rec != null && rec.getHttpMessage().equals(reqMsg) && rec.getHttpMessage().getResponseHeader().getStatusCode() != HttpStatusCode.NOT_MODIFIED) {
                    return rec;
                }
            } while (rec != null);
        } finally {
            try {
                rs.close();
                psReadCache.close();
            } catch (Exception e) {
                // ZAP: Log exceptions
                log.warn(e.getMessage(), e);
            }
        }
        if (isExistStatusCode) {
            //            psReadCache = getConnection().prepareStatement("SELECT TOP 1 * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND SESSIONID = ? AND STATUSCODE != 304 AND (HISTTYPE = " + HistoryReference.TYPE_MANUAL + " OR HISTTYPE = " + HistoryReference.TYPE_HIDDEN  + ")");
            psReadCache = getConnection().prepareStatement("SELECT TOP 1 * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND SESSIONID = ? AND STATUSCODE != 304");
        } else {
            //            psReadCache = getConnection().prepareStatement("SELECT * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND SESSIONID = ? AND (HISTTYPE = " + HistoryReference.TYPE_MANUAL + " OR HISTTYPE = " + HistoryReference.TYPE_HIDDEN  + ")");
            psReadCache = getConnection().prepareStatement("SELECT * FROM HISTORY WHERE URI = ? AND METHOD = ? AND REQBODY = ? AND SESSIONID = ?");
        }
        psReadCache.setString(1, reqMsg.getRequestHeader().getURI().toString());
        psReadCache.setString(2, reqMsg.getRequestHeader().getMethod());
        if (bodiesAsBytes) {
            psReadCache.setBytes(3, reqMsg.getRequestBody().getBytes());
        } else {
            psReadCache.setString(3, new String(reqMsg.getRequestBody().getBytes()));
        }
        psReadCache.setLong(4, ref.getSessionId());
        rs = psReadCache.executeQuery();
        rec = null;
        try {
            do {
                rec = build(rs);
                if (rec != null && rec.getHttpMessage().equals(reqMsg) && rec.getHttpMessage().getResponseHeader().getStatusCode() != HttpStatusCode.NOT_MODIFIED) {
                    return rec;
                }
            } while (rec != null);
        } finally {
            try {
                rs.close();
                psReadCache.close();
            } catch (Exception e) {
                // ZAP: Log exceptions
                log.warn(e.getMessage(), e);
            }
        }
        return null;
    } catch (SQLException e) {
        throw new DatabaseException(e);
    }
}