diff options
Diffstat (limited to 'PLAN.md')
| -rw-r--r-- | PLAN.md | 30 |
1 files changed, 25 insertions, 5 deletions
@@ -253,11 +253,31 @@ truncated, matching the Detail view's own labels) so the exported file carries the same trust information the UI already shows, not a blanker claim. -Still open from the expanded "worth considering" list: bulk export -(HAR, for interop with other tools), copy-as-curl, and scope/target -filtering (to keep noise - trackers, CDNs, unrelated third-party -hosts - out of history and search). All requested explicitly; none -started yet. +Shipped since: bulk export. `E` from the history list exports the +current view (respecting an active search filter - explicitly the +filtered set, not always everything, unlike `X` clear-all which is +deliberately the opposite) as a HAR 1.2 file, chosen specifically for +interop: DevTools, Burp, Postman, and others can all import it, which a +mitmux-specific format couldn't do. Building it means parsing each +entry's raw request/response bytes back into structured HAR fields +(method, url, headers, status, body) via the same net/http parsing the +capture path and prettyResponse already use - reused, not +reimplemented. A binary body is base64-encoded (HAR's "encoding" field) +rather than passed through as a JSON string, which would silently +corrupt it: encoding/json replaces invalid UTF-8 with U+FFFD by +default, exactly the failure mode that would quietly corrupt an +exported image or protobuf body with no error anywhere. An entry that +fails to fetch (daemon round trip) or parse (a deliberately malformed +Repeater request, say) is skipped rather than aborting the whole +export - the status line reports how many, so a partial export is +visible, not silent. + +Still open from the expanded "worth considering" list: import (no path +back in yet - HAR export was prioritized as the more common daily need, +getting captured evidence OUT for a report or another tool, over +bringing traffic IN), copy-as-curl, and scope/target filtering (to keep +noise - trackers, CDNs, unrelated third-party hosts - out of history +and search). All requested explicitly; none started yet. Skipped deliberately (from the research, matches this tool's stated scope): active/passive vulnerability scanning, plugin marketplace, |