Documentation
¶
Overview ¶
Package webscope is the web scope of a job: which hosts, paths and methods a web tool (a crawler, a DAST scanner) may request. The platform puts it in the job; the SDK refuses every request outside it, whatever the tool does (tool.Context.HTTP), and the sensor maps it onto the flags of a tool that makes its own requests.
A job without a web scope is unrestricted by this package (the target hosts and the egress guard still apply).
Stability: Beta (docs/STABILITY.md).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrOutOfScope = errors.New("outside the job's web scope")
ErrOutOfScope is the error of a request outside the web scope.
Functions ¶
func CleanPath ¶
CleanPath is the path a server sees for u: percent-decoded, dot segments resolved, never empty. A path with an encoded slash, backslash or NUL, a control character, or a dot segment with parameters ("..;") is refused: servers disagree on it.
func HostMatches ¶
HostMatches reports whether host matches the pattern: equal ignoring case and a trailing dot, or, for "*.example.com", example.com and any name under it.
Types ¶
type Scope ¶
type Scope struct {
// Hosts are the hosts a request may go to: a host name or address
// ("app.example.com"), or "*.example.com" for the domain and every
// name under it. Empty: the job's target hosts.
Hosts []string `json:"hosts,omitempty"`
// PathPrefixes are the paths a request may go to ("/app", "/api/v2/").
// A prefix matches itself and the paths under it, at a segment
// boundary. Empty: every path.
PathPrefixes []string `json:"path_prefixes,omitempty"`
// DenyPaths are paths a request never goes to ("/logout", "/admin"),
// whatever PathPrefixes allows. A deny path matches every path that
// starts with it, ignoring case: over-blocking is the safe side.
DenyPaths []string `json:"deny_paths,omitempty"`
// Methods are the HTTP methods a request may use. Empty: GET, HEAD
// and OPTIONS.
Methods []string `json:"methods,omitempty"`
}
Scope is a job's web scope.
Source Files