fix(http): host var scope across multi-request URLs

In multi-request HTTP templates, request-scoped
host variables could inherit state from the
original input target, and absolute URL requests
could inherit queryparams from input URL.

Fixes #7062

Signed-off-by: Dwi Siswanto <git@dw1.io>

Author: dwisiswant0

pkg/protocols/http/build_request.go

@@ -250,9 +250,13 @@ func (r *requestGenerator) Make(ctx context.Context, input *contextargs.Context,
 		return nil, errkit.Newf("failed to parse url %v while creating http request", reqData)
 	}
 	// while merging parameters first preference is given to target params
-	finalparams := parsed.Params
-	finalparams.Merge(reqURL.Params.Encode())
-	reqURL.Params = finalparams
+	// only merge target params when the evaluated request host matches input host
+	// absolute cross-domain URLs should not inherit query params from the original input
+	if reqURL.Host == parsed.Host {
+		finalparams := parsed.Params
+		finalparams.Merge(reqURL.Params.Encode())
+		reqURL.Params = finalparams
+	}
 	return r.generateHttpRequest(ctx, reqURL, finalVars, payloads)
 }
 

pkg/protocols/http/request.go

@@ -900,7 +900,7 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
 		// In case of interactsh markers and request times out, still send
 		// a callback event so in case we receive an interaction, correlation is possible.
 		// Also, to log failed use-cases.
-		outputEvent := request.responseToDSLMap(&http.Response{}, input.MetaInput.Input, formedURL, convUtil.String(dumpedRequest), "", "", "", 0, generatedRequest.meta)
+		outputEvent := request.responseToDSLMap(&http.Response{}, formedURL, formedURL, convUtil.String(dumpedRequest), "", "", "", 0, generatedRequest.meta)
 		if i := strings.LastIndex(hostname, ":"); i != -1 {
 			hostname = hostname[:i]
 		}
@@ -1024,7 +1024,7 @@ func (request *Request) executeRequest(input *contextargs.Context, generatedRequ
 			}
 		}
 
-		outputEvent := request.responseToDSLMap(respChain.Response(), input.MetaInput.Input, matchedURL, convUtil.String(dumpedRequest), fullResponseStr, bodyStr, headersStr, duration, generatedRequest.meta)
+		outputEvent := request.responseToDSLMap(respChain.Response(), matchedURL, matchedURL, convUtil.String(dumpedRequest), fullResponseStr, bodyStr, headersStr, duration, generatedRequest.meta)
 		// add response fields to template context and merge templatectx variables to output event
 		request.options.AddTemplateVars(input.MetaInput, request.Type(), request.ID, outputEvent)
 		if request.options.HasTemplateCtx(input.MetaInput) {