Skip to content

[pull] dev from projectdiscovery:dev#268

Merged
pull[bot] merged 6 commits intojynychen:devfrom
projectdiscovery:dev
Mar 24, 2026
Merged

[pull] dev from projectdiscovery:dev#268
pull[bot] merged 6 commits intojynychen:devfrom
projectdiscovery:dev

Conversation

@pull
Copy link

@pull pull bot commented Mar 24, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

usernametooshort and others added 6 commits March 5, 2026 19:40
The time_delay analyzer's reqSender rebuilt follow-up requests from
gr.Component.Rebuild() which clones the component's base request.  That
base request is parsed from rule.BaseRequest *before* post-parse header
injection happens (custom -H flags, auth provider headers, cookies).
As a result every follow-up request was sent without the headers that the
original triggering request carried, including Cookie/Authorization —
the server rejected them or ran the SQL in an unauthenticated context.

Fix: after Rebuild(), copy the complete header set from gr.Request (the
original fuzz-generated request, which has all headers) into the rebuilt
request.  This mirrors the same approach used everywhere else in the
request pipeline and makes the time_delay analyzer behave consistently.

Fixes #7106
…-custom-headers

fix(fuzz): propagate custom headers to time_delay analyzer follow-up requests
@pull pull bot locked and limited conversation to collaborators Mar 24, 2026
@pull pull bot added the ⤵️ pull label Mar 24, 2026
@pull pull bot merged commit c8a9853 into jynychen:dev Mar 24, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants