Skip to content

Add create_repeater_tab_http2 for HTTP/2 targets#91

Open
humurabbi wants to merge 1 commit into
PortSwigger:mainfrom
humurabbi:feat/http2-repeater-tab
Open

Add create_repeater_tab_http2 for HTTP/2 targets#91
humurabbi wants to merge 1 commit into
PortSwigger:mainfrom
humurabbi:feat/http2-repeater-tab

Conversation

@humurabbi
Copy link
Copy Markdown

Summary

  • New tool create_repeater_tab_http2: takes pseudoHeaders + headers + requestBody (the same schema as send_http2_request) and constructs an HTTP/2 request via HttpRequest.http2Request, then dispatches it to Repeater. Modern web targets default to HTTP/2 — the existing create_repeater_tab produces a tab that has to be flipped from the Inspector's HTTP/2 view back to HTTP/1.1 to read cleanly, which is enough friction to encourage callers to skip Repeater entirely.
  • Shared helper buildHttp2HeaderList: the pseudo-header ordering (:scheme, :method, :path, :authority), : prefix normalization, and lowercase header conversion previously lived inline in send_http2_request. It's extracted so send_http2_request and create_repeater_tab_http2 stay in lock-step.
  • Tool description for create_repeater_tab updated to point at the HTTP/2 variant for modern targets. Schema unchanged.
  • This mirrors the existing send_http1_request / send_http2_request split — two narrow tools rather than one overloaded one.

Test plan

  • ./gradlew test passes
  • New create repeater tab http2 should build http2 request test verifies pseudo-header ordering, lowercase header names, body pass-through, and Repeater dispatch
  • Existing send_http2_request tests continue to pass (the inline header-construction path was refactored to call the new helper)

Manual verification

  • Called create_repeater_tab_http2 against an HTTP/2 host; the resulting Repeater tab renders natively in the Inspector's HTTP/2 view, no manual switching required.
  • Called create_repeater_tab with the updated description; the tool still constructs HTTP/1.1 requests as before.

Note on dependencies

This PR is independent of #90 (the Site Map visibility / newline normalization change). They touch overlapping files but not overlapping lines.

The existing create_repeater_tab tool only constructs HTTP/1.1
requests, which on HTTP/2 servers renders awkwardly in Repeater
(callers have to flip the Inspector view from HTTP/2 to HTTP/1.1 to
read the request cleanly). Modern web targets speak HTTP/2 by default,
so a dedicated HTTP/2 path avoids the friction.

This mirrors the send_http1_request / send_http2_request split:

  * create_repeater_tab keeps the raw-content schema for HTTP/1.1
    targets. Its description is updated to point clients at the new
    HTTP/2 variant.
  * create_repeater_tab_http2 takes pseudoHeaders + headers +
    requestBody, the same schema as send_http2_request, so an LLM that
    can already issue HTTP/2 requests can also park them in Repeater
    without re-encoding.

The HTTP/2 header-list construction (pseudo-header ordering, lowercase
normalization, prepending of any missing :scheme/:method/:path/:
authority) is extracted into a buildHttp2HeaderList helper shared by
send_http2_request and create_repeater_tab_http2, so the two stay in
lock-step.

Adds a test that verifies create_repeater_tab_http2 dispatches an
HTTP/2 request to Repeater with the correct pseudo-header order and
lowercase regular headers.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant