The Path for Testing Path Traversal Vulnerabilities with Httpx

[C1ph3rX13]

I have noticed an odd behavior in the httpx module.

import requests
httpx.get("http://127.0.0.1/../../../../replay")

Which should typically send the request to the following path: /../../../../replay. Instead, it requests "http://127.0.0.1/replay" and modifies the specified input.

But I want to use the httpx to send HTTP requests but do not want the URL to be modified.

[lovelydinosaur]

Yo. 🤘

Sure, httpx handles path traversal which is what we'd typically want.
Same as browser behaviour, and also requests.

If you want to break past that constraint a good place to start would be working with httpcore directly.

Taking a look at the HTTPTransport class is also instructive if you want to dig into the design here...

httpx/httpx/_transports/default.py

Lines 215 to 222 in e63b659

	req = httpcore.Request(
	method=request.method,
	url=httpcore.URL(
	scheme=request.url.raw_scheme,
	host=request.url.raw_host,
	port=request.url.port,
	target=request.url.raw_path,
	),

...if we wanted to also expose similar functionality in httpx we'd need a way of allowing URLs to be constructed with an explicitly unescaped target specified.

[C1ph3rX13]

    with requests.Session() as s:
        prep_resp = requests.Request(method='GET', url=replay_url, headers=headers)
        prep = prep_resp.prepare()
        prep.url = replay_url
        download_resp = s.send(prep, verify=False)

A way of allowing URLs to be constructed with an explicitly unescaped target specified by using request

It would be great if httpx could implement this function

[Ark-kun]

What I find problematic is that raw_path has the same problem. Raw is supposed to be raw. Yet it's cnanged and normalized just the same.

>>> httpx.URL(host="example.org", raw_path=b"/a/b/c/../../secret")
URL('//example.org/a/secret')

explicitly unescaped target specified.

target breaks HTTPS proxies that issue CONNECT requests.

[berezhinskiy]

@C1ph3rX13 Have you found any technique to preserve the exact request-target with ../ using httpx without writing a custom transport? Any pointers or examples would be hugely appreciated.

[zrquan]

Try target extension.

httpx.Client().get("http://localhost:8000", extensions={"target": "/../../../api"})

[berezhinskiy]

Thank you so much. This works perfectly!