Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

retry-https considered harmful: use original result when retry-https encounters an error #357

Merged
merged 1 commit into from
Jul 1, 2022

Conversation

Nirusu
Copy link
Contributor

@Nirusu Nirusu commented Jun 25, 2022

Use original result when retry-https encounters an error

How to Test

Start with retry-https disable and find a page that redirects to a SSO page -> get a nice "Too many redirects" error.
Now enable retry-https and rescan -> you should still get the "Too many redirects" error, not a timeout or "tls oversized record received with length 20527"

Notes & Caveats

Currently, whenever any error is encountered and retry-https is enabled, the original, often still useful error is thrown away and instead you get either timeouts or "tls oversized record received with length 20527" when it fails, too. Especially with errors like "Too many redirects", which still can be useful given that the body and HTTP headers are still included, this retry behavior is infuriating and harmful at best, given that the retry error usually is super useless unless this port actually uses HTTPS.

Therefore, let's keep the original error when retry-https fails too, and only use retry-https' result when it actually succeeds.

@dadrian dadrian merged commit 50cb798 into zmap:master Jul 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants