ProxymanApp / ProxymanApp/Proxyman
Domains in Hide List are still displayed if they are also ran through the Scripting Tool
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 7k
- Forks
- 237
- PR merge metrics
- No merged PRs in 30d
Description
Description
I've been doing some insecure HTTP audits recently and noticed that if domains that I've configured in the Block/Hide List to be hidden are also ran through a Script I have enabled, they are still being displayed in the Proxy log and aren't hidden. It feels like if a domain is in the Hide List it should always be hidden even if it also gets filtered by a Script that's enabled.
Maybe the Hide List functionality needs to be moved to the last step of the Proxy Log display code? Allow Scripts to be run but then check the Hide List after that to determine if the the call should display in the Proxy Log?
Maybe I'm missing something and there's a workaround I can use in my script to keep the calls hidden? Thanks!
Steps to Reproduce
- Create a Hide List rule for a domain or a group of domains (Using an OCSP HTTP regex hide list for this example but any domain list should work.)
^https?:\/\/((ocsp2\.apple\.com)|(ocsp\.digicert\.com)|(ocsp\.r2m0.\.amazontrust\.com)|(ocsp\.pki\.goog)|(globessl\.ocsp\.sectigo\.com)|(ocsp\.usertrust\.com)|(ocsp2\.globalsign\.com)|(r3\.o\.lencr\.org)|(ocsp\.rootca1\.amazontrust\.com)|(ocsp\.sectigo\.com)|(static\.ess\.apple\.com)).*
-
Note that all calls caught in this rule are then hidden correctly and not displayed in the Proxy Log
-
Create a simple script that will interact with those calls in the hide list and enable it. (Using a simple HTTP calls colored red script)
^http:\/\/.*
async function onRequest(context, url, request) {
request.color = "red";
return request;
}
-
Trigger the calls that will be ran through the script and are also on the hide list.
-
Note that the calls that are caught and ran through the script are no longer hidden from the proxy log and are colored red even though they are on the Hide List.
Expected Behavior
Hide calls from the proxy log that are a part of a Hide List rule even if they are caught in a script.
Environment
Proxyman Pro 4.12.0 (49300)
macOS Sonoma 14.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the interaction between a Hide List rule and an enabled Scripting Tool using the issue's steps, then trace how matching requests are processed before appearing in the Proxy log. Done means scripts still run, but requests matching a Hide List rule remain hidden and are not displayed in the log.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, macos
- Domain
- desktop, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100