Skip to content

feat: URL to Body Injection #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CodeShellDev merged 2 commits into from
Jan 31, 2026
Merged

feat: URL to Body Injection #224

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5e38c8e
add path as body injection method
CodeShellDev Jan 31, 2026
a4d543e
Merge branch 'v1.5.0' into feat/url-to-body-injection
CodeShellDev Jan 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 53 additions & 18 deletions internals/proxy/middlewares/template.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
jsonutils "github.com/codeshelldev/gotl/pkg/jsonutils"
query "github.com/codeshelldev/gotl/pkg/query"
request "github.com/codeshelldev/gotl/pkg/request"
"github.com/codeshelldev/gotl/pkg/stringutils"
templating "github.com/codeshelldev/gotl/pkg/templating"
"github.com/codeshelldev/secured-signal-api/utils/requestkeys"
)
Expand Down Expand Up @@ -73,32 +74,37 @@ func templateHandler(next http.Handler) http.Handler {
}
}

if modifiedBody {
body.Data = bodyData
if req.URL.Path != "" {
var modified bool
var templated bool

err := body.Write(req)
req.URL.Path, bodyData, modified, templated, err = TemplatePath(req.URL, bodyData, variables)

if err != nil {
logger.Error("Could not write to Request Body: ", err.Error())
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
return
logger.Error("Error Templating Path: ", err.Error())
}

logger.Debug("Applied Body Templating: ", body.Data)
if modified {
logger.Debug("Applied Path Templating: ", req.URL.Path)
}

if templated {
modifiedBody = true
}
}

if req.URL.Path != "" {
var modified bool
if modifiedBody {
body.Data = bodyData

req.URL.Path, modified, err = TemplatePath(req.URL, variables)
err := body.Write(req)

if err != nil {
logger.Error("Error Templating Path: ", err.Error())
logger.Error("Could not write to Request Body: ", err.Error())
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
return
}

if modified {
logger.Debug("Applied Path Templating: ", req.URL.Path)
}
logger.Debug("Applied Body Templating: ", body.Data)
}

next.ServeHTTP(w, req)
Expand Down Expand Up @@ -208,26 +214,55 @@ func TemplateBody(body map[string]any, headers map[string][]string, VARIABLES ma
return templatedData, modified, nil
}

func TemplatePath(reqUrl *url.URL, VARIABLES any) (string, bool, error) {
func TemplatePath(reqUrl *url.URL, data map[string]any, VARIABLES any) (string, map[string]any, bool, bool, error) {
var modified bool
var modifiedBody bool

reqPath, err := url.PathUnescape(reqUrl.Path)

if err != nil {
return reqUrl.Path, modified, err
return reqUrl.Path, data, false, false, err
}

reqPath, err = templating.RenderNormalizedTemplate("path", reqPath, VARIABLES)

if err != nil {
return reqUrl.Path, modified, err
return reqUrl.Path, data, false, false, err
}

parts := strings.Split(reqPath, "/")
newParts := []string{}

for _, part := range parts {
newParts = append(newParts, part)

keyValuePair := strings.SplitN(part, "=", 2)

if len(keyValuePair) != 2 {
continue
}

keyWithoutPrefix, match := strings.CutPrefix(keyValuePair[0], "@")

if !match {
continue
}

value := stringutils.ToType(keyValuePair[1])

data[keyWithoutPrefix] = value
modifiedBody = true

newParts = newParts[:len(newParts) - 1]
}

reqPath = strings.Join(newParts, "/")

if reqUrl.Path != reqPath {
modified = true
}

return reqPath, modified, nil
return reqPath, data, modified, modifiedBody, nil
}

func TemplateQuery(reqUrl *url.URL, data map[string]any, VARIABLES any) (string, map[string]any, bool, error) {
Expand Down