1709e0cf0a
urllib.parse.quote(path, safe='/?&=') was re-encoding % to %25 in already-encoded attack paths (XXE, XSS, traversal payloads). Replaced with a manual first-? split: path component encoded with safe='/%\' (preserving existing percent sequences and backslash traversal vectors), query string passed through untouched. Covers all 53 attack payloads across 7 simulation modes. Inline comments removed from XXE_PAYLOADS to match the style of all other payload lists. |
||
|---|---|---|
| .. | ||
| ai-threat-detection | ||
| api-rate-limiter | ||
| bug-bounty-platform | ||
| encrypted-p2p-chat | ||
| haskell-reverse-proxy | ||
| honeypot-network | ||
| hsm-emulator | ||
| monitor-the-situation-dashboard | ||