Skip to content

Flexible version of send HTTP request#1110

Merged
mike-hunhoff merged 2 commits intomandiant:masterfrom
saniyafatima07:http
Jan 30, 2026
Merged

Flexible version of send HTTP request#1110
mike-hunhoff merged 2 commits intomandiant:masterfrom
saniyafatima07:http

Conversation

@saniyafatima07
Copy link
Contributor

The previous version of issue - #1099 is rigid.
So, made the regex slightly flexible which covers the issue - test_fix262 #2843 (capa)

@saniyafatima07
Copy link
Contributor Author

saniyafatima07 commented Jan 29, 2026

@mike-hunhoff Made the regex a bit flexible.
Ran the test case which was failing, it passes now.
Could you please review if this fix works?

Thank you for you time!

Copy link
Collaborator

@mike-hunhoff mike-hunhoff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work @saniyafatima07

@mike-hunhoff
Copy link
Collaborator

@saniyafatima07 lints are failing for send HTTP request:

 send HTTP request
  FAIL: rule format incorrect: use scripts/capafmt.py or adjust as follows
  rule:
    meta:
      name: send HTTP request
      namespace: communication/http/client
      authors:
        - moritz.raabe@mandiant.com
        - mehunhoff@google.com
      scopes:
        static: function
        dynamic: span of calls
      mbc:
        - Communication::HTTP Communication::Send Request [C0002.003]
      examples:
        - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145D60
        - 6A352C3E55E8AE5ED39DC1BE7FB964B1:0x100026E0
    features:
      - or:
        - and:
          - or:
            - api: wininet.HttpOpenRequest
            - api: wininet.InternetConnect
          - or:
            - api: wininet.HttpSendRequest
            - api: wininet.HttpSendRequestEx
        - and:
          - api: winhttp.WinHttpSendRequest
          - api: winhttp.WinHttpWriteData
          - optional:
            - or:
              - api: winhttp.WinHttpOpenRequest
              - api: winhttp.WinHttpConnect
        - and:
          - match: send data on socket
-         - and: 
?               -
+         - and:
-             - string: /^(GET|POST|PUT|PATCH|HEAD|DELETE)/i
? --
+           - string: /^(GET|POST|PUT|PATCH|HEAD|DELETE)/i
-             - string: /HTTP\/1\.\d/i
? --
+           - string: /HTTP\/1\.\d/i
        - and:
          - format: dotnet
          - or:
            - api: System.Net.WebRequest::GetResponse
            - api: System.Net.WebRequest::GetResponseAsync
            - api: System.Net.Http.HttpClient::PostAsync
            - api: System.Net.Http.HttpClient::GetAsync
            - api: System.Net.Http.HttpClient::GetByteArrayAsync
            - api: System.Net.Http.HttpClient::GetStreamAsync
            - api: System.Net.Http.HttpClient::GetStringAsync
            - api: System.Net.Http.HttpClient::Send
            - api: System.Net.Http.HttpClient::SendAsync
            - api: System.Net.Http.HttpClientHandler::Send
            - api: System.Net.Http.HttpClientHandler::SendAsync
            - class: System.Net.Http.HttpRequestMessage

@saniyafatima07
Copy link
Contributor Author

saniyafatima07 commented Jan 30, 2026

@mike-hunhoff I have fixed the lint error. I forgot to run the lint test during final push, apologies for that.
I wiill make sure to run it in the upcoming prs.
Thank you!

@mike-hunhoff mike-hunhoff merged commit 7f70ec1 into mandiant:master Jan 30, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants