Replacement rules in requests with Content-Type: multipart/form-data about autorepeater HOT 7 OPEN

@rsmith31415 I'm not actually sure how Burp Suite manages it internally. They may have some functionality implemented that's not exposed through the Burp Extender API. In the interim while I implement parsing multipart forms the "replace string" replacement should cover any cases where the param replacement wouldn't work.

from autorepeater.

Thanks for the new issue. Hopefully I'll have time to look into this tomorrow during the day.

from autorepeater.

@rsmith31415 So I've began looking into this and unfortunately Burp's Extender API doesn't cleanly handle multipart form parameters so I'm going to need to implement a good bit of logic to handle these.

from autorepeater.

@M00r3 Interesting. I'm sure there are parsers for multipart/form-data available in java. Hopefully, they provide enough flexibility to construct a new request in the more difficult case of removing a parameter completely.

from autorepeater.

@rsmith31415 I've done a fair bit of research and it seems like the only reasonable way to fix this is to implement some code that does multipart form handling myself. I'm assuming implementing this will take a bit of time so in the interim I'm going to fix the exception that gets thrown and fix the bug in the regular full body string replace where bytes without valid characters get stomped which should allow AutoRepeater to still do the performs the same actions as the replace parameter functionality.

from autorepeater.

@M00r3 Do you think that's the way Burp Suite deals with every type of content type? It looks like a lot of work and it is very likely this specific content type won't be an isolated case.

from autorepeater.

I'm marking this "won't fix" for the time being because the "Request String" replacement largely covers the functionality this bug fix would provide. I'm hoping that either Burp's API just automatically fixes this issue or that I can find a better HTTP parser to replacement Burp's API with.

from autorepeater.