henvic / httpretty Goto Github PK

$ go test -run TestOutgoingTLSInvalidCertificate
--- FAIL: TestOutgoingTLSInvalidCertificate (0.02s)
    client_test.go:1342: logged HTTP request * Request to https://127.0.0.1:42873
        > GET / HTTP/1.1
        > Host: example.com
        > User-Agent: Robot/0.1 [email protected]
        
        * tls: failed to verify certificate: x509: certificate signed by unknown authority
        ; want ^\* Request to https://127.0.0.1:42873
        > GET / HTTP/1\.1
        > Host: example\.com
        > User-Agent: Robot/0\.1 crawler@example\.com
        
        \* x509: .+
FAIL

Seems Go1.20 changes the error message again.

Hi. Thanks for the library.
I noticed one point, it's looks like a bug or unexpected behavior.
This code is truncates the http response body that is used for http the response consumer https://github.com/henvic/httpretty/blob/main/printer.go#L276 and breaks the response.
Is this a bug or not?

Currently, the TLS information prints after the response header, although it should be printed before the request header.

Making a request with a query parameter with value foo & bar results in something like this being printed:

> POST /mypath?label=foo+%!+(MISSING)bar HTTP/1.1

This is because the & character gets %-encoded when in a URL, and color.Format() interprets anything passed to it as a format string. Any value that could potentially have a literal % character in it (any dynamic or user-defined value, really) should never be used a sprintf format string.

io.ReadFull should be used instead of calling *bufio.Reader.Read when getting content to print from on the logger printer, as more than one Read call might be required to fill the whole printing buffer.

This can be done both by identifying Content-Type and by inspecting file magic numbers to identify if a file is "binary" or not. Decide what to use (probably both).

Maybe we can introduce an internal Formatter implementation that identifies the file by matching mime-type and this might be good at first (and use a second step to identify other cases to avoid printing rubbish). However, we might want to identify it earlier and avoid some processing.

From https://travis-ci.org/henvic/httpretty/jobs/645236419

--- FAIL: TestOutgoingTLSBadClientCertificate (0.03s)
262    client_test.go:1411: logged HTTP request * Request to https://127.0.0.1:35251
263        * Client certificate:
264        *  subject: CN=User,OU=User,O=Client,L=Rotterdam,ST=Zuid-Holland,C=NL
265        *  start date: Sat Jan 25 20:12:36 UTC 2020
266        *  expire date: Mon Jan  1 20:12:36 UTC 2120
267        *  issuer: CN=User,OU=User,O=Client,L=Rotterdam,ST=Zuid-Holland,C=NL
268        > GET / HTTP/1.1
269        > Host: example.com
270        > User-Agent: Robot/0.1 [email protected]
271        
272        * readLoopPeekFailLocked: remote error: tls: bad certificate
273        ; want * Request to https://127.0.0.1:35251
274        * Client certificate:
275        *  subject: CN=User,OU=User,O=Client,L=Rotterdam,ST=Zuid-Holland,C=NL
276        *  start date: Sat Jan 25 20:12:36 UTC 2020
277        *  expire date: Mon Jan  1 20:12:36 UTC 2120
278        *  issuer: CN=User,OU=User,O=Client,L=Rotterdam,ST=Zuid-Holland,C=NL
279        > GET / HTTP/1.1
280        > Host: example.com
281        > User-Agent: Robot/0.1 [email protected]
282        
283        * remote error: tls: bad certificate

I have a module that calls an API with a custom authorization header. I would like to sanitize it rather than hide it, but currently doesn't appear I can do so. The ability to add additional headers for sanitization would be a great addition.

On cli/cli#306 (review) @mislav asked me for

a way to avoid certain request/response headers being printed; perhaps accept a func that takes a header name and returns a boolean that indicates whether to print or not?

This might be achieved with a function similar to SetFilter and SetBodyFilter. It might take a slice and store the data in a map[string]struct{} to be checked when printing headers.

Probably can be called FilterHeader or FilterHeaders.