@ Override public HttpMessage handleShortcut ( HttpMessage msg ) throws ApiException { // We've to look at the name and verify if the challenge has // been registered by one of the executed plugins // ---------------- // http://<zap_IP>/json/xxe/other/NGFrteu568sgToo100 // ---------------- try { String path = msg . getRequestHeader ( ) . getURI ( ) . getPath ( ) ; String challenge = path . substring ( path . indexOf ( getPrefix ( ) ) + getPrefix ( ) . length ( ) + 1 ) ; if ( challenge . charAt ( challenge . length ( ) - 1 ) == ' ' ) { challenge = challenge . substring ( 0 , challenge . length ( ) - 1 ) ; } RegisteredCallback rcback = regCallbacks . get ( challenge ) ; String response ; if ( rcback != null ) { rcback . getPlugin ( ) . notifyCallback ( challenge , rcback . getAttackMessage ( ) ) ; response = API_RESPONSE_OK ; // OK we consumed it so it's time to clean regCallbacks . remove ( challenge ) ; } else { response = API_RESPONSE_KO ; // Maybe we've a lot of dirty entries cleanExpiredCallbacks ( ) ; } // Build the response msg . setResponseHeader ( API . getDefaultResponseHeader ( "text/html" , response . length ( ) ) ) ; msg . getResponseHeader ( ) . setHeader ( "Access-Control-Allow-Origin" , "*" ) ; msg . setResponseBody ( response ) ; } catch ( URIException | HttpMalformedHeaderException e ) { logger . warn ( e . getMessage ( ) , e ) ; } return msg ; }
Handles the given message which might contain a challenge request .