Skip to content

Commit 33244f6

Browse files
committed
style: rubocop auto-corrections + add Notes metadata
1 parent db6dbf4 commit 33244f6

File tree

1 file changed

+11
-15
lines changed

1 file changed

+11
-15
lines changed

modules/auxiliary/scanner/http/redoc_exposed.rb

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -24,36 +24,36 @@ def initialize(info = {})
2424
'Notes' => {
2525
'Stability' => [CRASH_SAFE], # GET requests only; should not crash or disrupt the target service
2626
'Reliability' => [], # Does not establish sessions; leaving this empty is acceptable
27-
'SideEffects' => [] # Add IOC_IN_LOGS if server logs may record these requests
27+
'SideEffects' => [IOC_IN_LOGS] # Requests may be logged by the target web server
2828
},
2929
'DefaultOptions' => {
3030
'RPORT' => 80
31-
# SSL is registered by default; set here only if you want a non-default value
32-
# 'SSL' => false
3331
}
3432
)
3533
)
3634

3735
register_options(
3836
[
37+
# Mark as required and surface the built-in defaults here
3938
OptString.new('REDOC_PATHS', [
40-
false,
41-
'Comma-separated list of paths to probe (overrides defaults)',
42-
nil
39+
true,
40+
'Comma-separated list of paths to probe',
41+
'/redoc,/redoc/,/docs,/api/docs,/openapi'
4342
])
4443
]
4544
)
4645
end
4746

4847
# returns true if the response looks like a ReDoc page
4948
def redoc_like?(res)
50-
return false unless res && res.code.between?(200, 403)
49+
# Accept only 2xx or 403 (exclude redirects; many 3xx lack HTML to analyze)
50+
return false unless res && (res.code.between?(200, 299) || res.code == 403)
5151

5252
# Prefer DOM checks
5353
doc = res.get_html_document
5454
if doc && (doc.at_css('redoc, redoc-, #redoc') ||
55-
doc.css('script[src*="redoc"]').any? ||
56-
doc.css('script[src*="redoc.standalone"]').any?)
55+
doc.css('script[src*="redoc"]').any? ||
56+
doc.css('script[src*="redoc.standalone"]').any?)
5757
return true
5858
end
5959

@@ -72,12 +72,8 @@ def check_path(path)
7272
def run_host(ip)
7373
vprint_status("#{ip} - scanning for ReDoc")
7474

75-
paths =
76-
if datastore['REDOC_PATHS'].to_s.empty?
77-
['/redoc', '/redoc/', '/docs', '/api/docs', '/openapi']
78-
else
79-
datastore['REDOC_PATHS'].split(',').map(&:strip)
80-
end
75+
# REDOC_PATHS is required and has defaults; always use it directly
76+
paths = datastore['REDOC_PATHS'].split(',').map(&:strip)
8177

8278
hit = paths.find { |p| check_path(p) }
8379
if hit

0 commit comments

Comments
 (0)