ProxymanApp / ProxymanApp/Proxyman

Domains in Hide List are still displayed if they are also ran through the Scripting Tool

Open
#1,791 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
No language data
Stars
7k
Forks
237
PR merge metrics
No merged PRs in 30d

Description

Description

I've been doing some insecure HTTP audits recently and noticed that if domains that I've configured in the Block/Hide List to be hidden are also ran through a Script I have enabled, they are still being displayed in the Proxy log and aren't hidden. It feels like if a domain is in the Hide List it should always be hidden even if it also gets filtered by a Script that's enabled.

Maybe the Hide List functionality needs to be moved to the last step of the Proxy Log display code? Allow Scripts to be run but then check the Hide List after that to determine if the the call should display in the Proxy Log?

Maybe I'm missing something and there's a workaround I can use in my script to keep the calls hidden? Thanks!

Steps to Reproduce

  1. Create a Hide List rule for a domain or a group of domains (Using an OCSP HTTP regex hide list for this example but any domain list should work.)
^https?:\/\/((ocsp2\.apple\.com)|(ocsp\.digicert\.com)|(ocsp\.r2m0.\.amazontrust\.com)|(ocsp\.pki\.goog)|(globessl\.ocsp\.sectigo\.com)|(ocsp\.usertrust\.com)|(ocsp2\.globalsign\.com)|(r3\.o\.lencr\.org)|(ocsp\.rootca1\.amazontrust\.com)|(ocsp\.sectigo\.com)|(static\.ess\.apple\.com)).*
Screenshot 2023-10-01 at 11 01 06 AM
  1. Note that all calls caught in this rule are then hidden correctly and not displayed in the Proxy Log

  2. Create a simple script that will interact with those calls in the hide list and enable it. (Using a simple HTTP calls colored red script)

^http:\/\/.*
async function onRequest(context, url, request) {
  request.color = "red";

  return request;
}
Screenshot 2023-10-01 at 11 00 12 AM
  1. Trigger the calls that will be ran through the script and are also on the hide list.

  2. Note that the calls that are caught and ran through the script are no longer hidden from the proxy log and are colored red even though they are on the Hide List.

Screenshot 2023-10-01 at 11 01 54 AM

Expected Behavior

Hide calls from the proxy log that are a part of a Hide List rule even if they are caught in a script.

Environment

Proxyman Pro 4.12.0 (49300)
macOS Sonoma 14.0

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the interaction between a Hide List rule and an enabled Scripting Tool using the issue's steps, then trace how matching requests are processed before appearing in the Proxy log. Done means scripts still run, but requests matching a Hide List rule remain hidden and are not displayed in the log.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, macos
Domain
desktop, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.