burp-paramalyzer
burp-paramalyzer copied to clipboard
Cookies tab doesn't honor the defined scope
Hello,
the "Cookies" tab will list all cookies stored in the Proxy History, even if the corresponding messages aren't in scope. The bug is in method firstPass(), where isInScope() is checked only for parameters.
private void firstPass(IExtensionHelpers helpers, IHttpRequestResponse[] messages) {
[...]
// Analyze response for cookies
if(messages[i].getResponse() != null) {
IResponseInfo responseInfo = helpers.analyzeResponse(messages[i].getResponse());
List<String> headers = responseInfo.getHeaders();
for (String header: headers){
if (startsWithIgnoreCase(header, "set-cookie:")) {
processCookieHeader(header);
}
}
}
[...]