diff --git a/pkg/ffuf/request.go b/pkg/ffuf/request.go index 8cce6612..de93cbfe 100644 --- a/pkg/ffuf/request.go +++ b/pkg/ffuf/request.go @@ -172,10 +172,12 @@ func injectKeyword(input string, keyword string, startOffset int, endOffset int) prefix := inputslice[:startOffset] suffix := inputslice[endOffset+1:] - inputslice = append(prefix, keywordslice...) - inputslice = append(inputslice, suffix...) + var outputslice []rune + outputslice = append(outputslice, prefix...) + outputslice = append(outputslice, keywordslice...) + outputslice = append(outputslice, suffix...) - return string(inputslice) + return string(outputslice) } // scrubTemplates removes all template (§) strings from the request struct diff --git a/pkg/ffuf/request_test.go b/pkg/ffuf/request_test.go index 7c55f780..414993d7 100644 --- a/pkg/ffuf/request_test.go +++ b/pkg/ffuf/request_test.go @@ -215,6 +215,23 @@ func TestInjectKeyword(t *testing.T) { t.Errorf("injectKeyword offset validation failed") } + input = "id=§a§&sort=desc" + offsetTuple = templateLocations("§", input) + expected = "id=FUZZ&sort=desc" + + result = injectKeyword(input, "FUZZ", offsetTuple[0], offsetTuple[1]) + if result != expected { + t.Errorf("injectKeyword returned unexpected result: " + result) + } + + input = "feature=aaa&thingie=bbb&array[§0§]=baz" + offsetTuple = templateLocations("§", input) + expected = "feature=aaa&thingie=bbb&array[FUZZ]=baz" + + result = injectKeyword(input, "FUZZ", offsetTuple[0], offsetTuple[1]) + if result != expected { + t.Errorf("injectKeyword returned unexpected result: " + result) + } } func TestScrubTemplates(t *testing.T) {