module Xssmaze::Store

Overview

Central registry for the state the stored mazes accumulate.

Stored mazes are the one part of the lab that remembers a scanner run, and they used to remember it forever: a second run read the first run's payloads back out and reported them as its own finding, two tools pointed at one instance contaminated each other, and a long fuzz grew the process without bound. Every collection is capped and reachable by name from here, so a harness can wipe the lab between runs (POST /reset) instead of restarting it.

The vulnerabilities themselves are untouched — the cap and the reset are the only new behaviour.

Defined in:

store.cr

Constant Summary

MAX_ENTRIES = 20

How many entries a bounded collection keeps. Deep enough that a scanner posting a handful of payloads still watches a list build up, shallow enough that a fuzzer cannot grow the process.

Class Method Summary

• .group(name : String) : Group
• .json_no_store(env) : Nil

  Same headers as Xssmaze::Server.json_no_store, spelled out rather than called: the store is required before the server and has no business reaching up into the HTTP layer for three header assignments.

• .list(name : String) : List

  Register-or-fetch.

• .names : Array(String)
• .reset(name : String) : Int32 | Nil

  Clears one collection and reports how many entries went away, or nil when nothing is registered under that name — the route answers 400 for that.

• .reset_all : Hash(String, Int32)
• .single(name : String) : Single
• .sizes : Hash(String, Int32)
• .total : Int32

Class Method Detail