alibaba / alibaba/anyproxy

Anyproxy 的 requestBody 和 downloadBody 提供了一个错误的数据

Open
#613 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
7.9k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

如题所示,Anyproxy 的 requestBody 和 downloadBody 提供了一个错误的数据

#### Which platform are you running AnyProxy

Ubuntu LTS 20.04 arm64 (使用 termux 运行在 Android 12 上)

#### The version of the AnyProxy

4.1.3

#### Your expected behavior of AnyProxy

requestBody 应该提供正确的数据,错误原因大致与下面的类似。

downloadBody 接口应该提供正确的二进制数据,如图:

![image](https://github.com/alibaba/anyproxy/assets/63852815/8a6c86ff-1288-4417-867d-1fea6585e69a)

#### The actual behavior of AnyProxy

anyproxy 提供了一个错误的数据,如图:

![image](https://github.com/alibaba/anyproxy/assets/63852815/e3d02f88-eb31-43c6-ab14-c6e30f551bf1)

与原数据的差异为 anyproxy 提供的数据里包含了很多的 `EF BF BD`,猜测应该是接口检测到非 ascii 数据自动将其转换为了 `EF BF BD`。

#### The log of the error

```bash
[AnyProxy Log][2023-09-17 00:59:19]: received https CONNECT request ag-api.wds-stellarium.com
[AnyProxy Log][2023-09-17 00:59:19]: will forward to local https server
[AnyProxy Log][2023-09-17 00:59:19]: [internal https]proxy server for ag-api.wds-stellarium.com established
[AnyProxy Log][2023-09-17 00:59:19]: received request to: GET ag-api.wds-stellarium.com//ag-api.wds-stellarium.com/api/data/user
https://ag-api.wds-stellarium.com/api/data/user
Hacked!
{
url:'https://ag-api.wds-stellarium.com/api/data/user',
requestOptions:{
hostname:'ag-api.wds-stellarium.com',
port:443,
path:'/api/data/user',
method:'GET',
headers:{
'Content-Type':'application/vnd.msgpack',
Accept:'application/vnd.msgpack',
'X-Platform':'google-play',
Authorization:'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOiIyMDg4MjgzIiwibGMiOiIyNTYiLCJwZiI6Ikdvb2dsZVBsYXkiLCJndiI6Ikdvb2dsZVBsYXkiLCJsZCI6IjA5LzE2LzIwMjMgMDU6MDA6MDAiLCJuYmYiOjE2OTQ4ODEyNTMsImV4cCI6MTY5NDk2NzY1MywiaWF0IjoxNjk0ODgxMjUzLCJpc3MiOiJzaXJpdXMua21zMy5jb20iLCJhdWQiOiJzaXJpdXMifQ.rtj8J26G2BHCow-YNmAsh4p9Z65RFtnBKer8472f4-Q',
'X-MasterData-Version':'1694772159_1694772159',
'X-FM':'0',
Host:'ag-api.wds-stellarium.com',
'Accept-Encoding':'gzip,identity',
Connection:'Keep-Alive,TE',
'Keep-Alive':'timeout=21',
TE:'identity',
'User-Agent':'BestHTTP/2v2.8.5',
'Content-Length':'13',
Cookie:'ApplicationGatewayAffinityCORS=c52c784d19fcf9ba400d7df8213486d0;ApplicationGatewayAffinity=c52c784d19fcf9ba400d7df8213486d0'
}
},
protocol:'https'
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

No source files or tests are named; start from the requestBody and downloadBody entry points and reproduce the reported application/vnd.msgpack response on AnyProxy 4.1.3. Compare the returned bytes with the original binary data and confirm that the interfaces no longer introduce EF BF BD substitutions.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.