Skip to content

v0.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Nov 15:28
· 8 commits to main since this release
v0.1.2
63321d8

This release has no Apple Silicon binary, because a GitHub outage cancelled that build. Use v0.1.4 instead.

If you installed the scanner before this release, stop it with Ctrl+C and run the line the page gives you again. The page warns you when your scanner is out of date.

Added

  • python serve.py builds Trawl if it needs to, serves it at localhost:8000 and opens it.
  • Trawl now tells you where it stopped. A file that reaches a limit gets a note on the page and in the writeup saying what went unread.
  • A compressed stream that is damaged still gives up what came before the damage, the way a browser shows an image with a broken end. Trawl uses its own inflate for this.
  • PDF streams are read through filter arrays, predictors, LZW early change and comments.
  • Long SQLite values are searched whole, including ones split across overflow pages.
  • A build check in CI fails if the site holds a source map, a secret, a private path or a debug call.

Fixed

  • A very small image could crash the results page. A 101-byte PNG was enough.
  • Small hostile files could freeze the tab, exhaust memory or kill the analysis.
  • Decoy flags and signatures could use up a scan's limits and hide a real find after them.
  • Repairing a PNG's height analysed an empty file.
  • "Extract everything" returned the wrong bytes for a hit read column by column.
  • RSA attacks ran on the page and could stall it. They now run in the background worker.
  • A crafted ZIP could take minutes to read.

Security

  • The scanner only accepts its pairing token in a header, no longer in a URL.
  • In local mode, local access now covers only the service you named. A redirect or a DNS change after the scan can't send the scanner to your other local services.
  • A scan no longer guesses file names on a site it was redirected to, and says when it was redirected.
  • Google Cloud's IPv6 metadata address is now refused in every mode, alongside the others.
  • Text a file controls can't add images or links to the writeup.
  • Workflow actions are pinned to commits, the wasm-pack download is checked against a hash, and checkouts no longer keep a token where a build script could read it.

Full changelog

Assets 8
Loading