|
| 1 | +id: 0a170678-7c39-4433-8e73-0c2bbea8ce37 |
| 2 | +name: Detect Stack Traces |
| 3 | +function: VIEW_FILTER |
| 4 | +location: PROXY_HTTP_HISTORY |
| 5 | +source: |+ |
| 6 | + /** |
| 7 | + * Detects stack traces and exception messages in error responses for Java, Python, PHP, .NET, Node.js, Ruby, and Go. |
| 8 | + * @author whoamins |
| 9 | + **/ |
| 10 | + |
| 11 | + if (!requestResponse.hasResponse()) { |
| 12 | + return false; |
| 13 | + } |
| 14 | + |
| 15 | + var response = requestResponse.response(); |
| 16 | + |
| 17 | + if (response.statusCode() < 400) { |
| 18 | + return false; |
| 19 | + } |
| 20 | + |
| 21 | + String body = response.bodyToString(); |
| 22 | + |
| 23 | + // Java stack traces |
| 24 | + if (body.matches("(?s).*\\bat [a-zA-Z][a-zA-Z0-9_.]*\\.[a-zA-Z][a-zA-Z0-9_]*\\([^)]*\\.java:\\d+\\).*") || |
| 25 | + body.contains("Exception in thread") || |
| 26 | + body.matches("(?s).*(Exception|Error):\\s+.*\\n.*at .*")) { |
| 27 | + return true; |
| 28 | + } |
| 29 | + |
| 30 | + // Python tracebacks |
| 31 | + if (body.contains("Traceback (most recent call last)") || |
| 32 | + body.matches("(?s).*File \"[^\"]+\\.py\", line \\d+.*")) { |
| 33 | + return true; |
| 34 | + } |
| 35 | + |
| 36 | + // PHP errors |
| 37 | + if (body.matches("(?s).*Fatal error:.*in /.*\\.php.*line \\d+.*") || |
| 38 | + body.matches("(?s).*Warning:.*in /.*\\.php.*line \\d+.*") || |
| 39 | + body.matches("(?s).*Parse error:.*in /.*\\.php.*line \\d+.*") || |
| 40 | + body.matches("(?s).*in /[^ ]+\\.php on line \\d+.*")) { |
| 41 | + return true; |
| 42 | + } |
| 43 | + |
| 44 | + // .NET stack traces |
| 45 | + if (body.contains("System.") && |
| 46 | + body.matches("(?s).*Exception:.*") && |
| 47 | + (body.matches("(?s).*at [a-zA-Z][a-zA-Z0-9_.]*\\.[a-zA-Z][a-zA-Z0-9_]*\\(.*\\) in .*:\\d+.*") || |
| 48 | + body.matches("(?s).*at [a-zA-Z][a-zA-Z0-9_.]*\\.[a-zA-Z][a-zA-Z0-9_]*\\(.*\\).*"))) { |
| 49 | + return true; |
| 50 | + } |
| 51 | + |
| 52 | + // Node.js/JavaScript stack traces |
| 53 | + if (body.matches("(?s).*Error:.*\\n.*at .* \\([^)]*:\\d+:\\d+\\).*") || |
| 54 | + body.matches("(?s).*at .* \\(/[^)]+:\\d+:\\d+\\).*") || |
| 55 | + (body.contains("Error:") && body.matches("(?s).*at .*\\.js:\\d+:\\d+.*"))) { |
| 56 | + return true; |
| 57 | + } |
| 58 | + |
| 59 | + // Ruby stack traces |
| 60 | + if (body.matches("(?s).*from /[^ ]+\\.rb:\\d+:in `.*'.*") || |
| 61 | + body.matches("(?s).*Error.*:.*\\n.*\\.rb:\\d+.*") || |
| 62 | + body.contains("(backtrace)")) { |
| 63 | + return true; |
| 64 | + } |
| 65 | + |
| 66 | + // Go panic stack traces |
| 67 | + if (body.matches("(?s).*panic:.*\\n.*goroutine \\d+.*") || |
| 68 | + body.matches("(?s).*goroutine \\d+ \\[.*\\]:.*") || |
| 69 | + (body.contains("panic:") && body.matches("(?s).*/.*\\.go:\\d+.*"))) { |
| 70 | + return true; |
| 71 | + } |
| 72 | + |
| 73 | + return false; |
0 commit comments