Skip to content

CHANGELOG.md

Latest commit

 

History

History
144 lines (104 loc) · 10.5 KB

CHANGELOG.md

File metadata and controls

144 lines (104 loc) · 10.5 KB
Raw

Changelog

All notable changes to Dalfox are recorded here. The format follows Keep a Changelog, and the project follows Semantic Versioning.

The previous Go implementation lives on the v2 branch and continues to receive security backports per SECURITY.md.

3.2.0

Mass-scan workflow features, wider DOM-XSS coverage, and CSP / false-positive fixes.

Added

  • --state-file: resume an interrupted mass scan, skipping completed targets (#1275).
  • --baseline: report only findings new since a previous run (#1279).
  • --dedup-urls: signature-level target deduplication for large URL lists (#1278).
  • Session-loss detection: warn when auth dies mid-scan instead of reporting zero findings (#1277, #1285).
  • New DOM-XSS sinks: drag-drop, async clipboard, FileReader, setAttributeNS, indirect eval, DOMParser (#1257, #1258).
  • HTTP QUERY method support (RFC 10008) (#1220).
  • MCP: max_payloads_per_param and a synchronous wait mode (#1223).
  • More dalfox payload selectors (special chars, functions, awesome-alert, ...) (#1271).
  • Findings now carry separate confidence / detection-method / impact axes (#1246).

Fixed

  • CSP analysis: default-src no longer overrides script-src, wildcard origins match deeper subdomains, and enforcing <meta> policies win over report-only (#1266, #1267, #1268).
  • No more verified [V] for HTML-tag echoes in application/javascript bodies (#1286).
  • Absent multipart params are now injected, and empty JSON body values no longer garble the request (#1260, #1261, #1263).
  • SARIF output emits a matching rule and correct ruleIndex per finding CWE (#1262).
  • Config files are validated, and an explicit CLI flag now beats a config value even when it equals the default (#1228, #1270, #1280).
  • Server / MCP: validated method / encoders at the API boundary, deterministic scan listing order, and an honest cancelled response (#1269, #1264, #1237, #1229).
  • --deep-scan runs the preflight probe again, --limit-result-type no longer hides the findings it limited on, and -i reads every file argument (#1212).
  • Honest redirect evidence, working --sxss discovery, bare -p seeding when discovery is skipped, and no stdin hang when a target is given (#1242, #1221, #1241).
  • WAF: sink keywords match on identifier boundaries, and blocking statuses boost confidence even with an empty body (#1259, #1265).
  • Windows binary no longer overflows the main thread stack at startup (#1294).

Performance

  • One shared HTML parse per AST DOM phase (#1256).

Documentation

  • Korean translation and a redesigned docs site (#1224, #1230).
  • Documented the R/V/A detection model across every surface (#1255).

3.1.2

  • Reject non-http(s) URL schemes instead of mangling them into malformed targets.
  • Suppressed false [R] for inert javascript: reflections and false [V] for on* on hidden inputs (#1183).
  • Resource-safety, REST / MCP parity, and hot-path performance fixes in the async scan front-ends (#1190).
  • Bounded query-discovery memory during parameter mining.
  • Documentation accuracy fixes across --scan-timeout, MCP encoders, server flags, and WAF values.

3.1.1

  • Unified the scan target parameter on target for server / MCP (url kept as a REST alias) (#1152).
  • Unified debug logging through a single stderr macro and structured server / MCP loggers.
  • Restored reflected-XSS recall in raw-JS-expression and regex-literal contexts (#1161).
  • Demoted inert URL-scheme and javascript: self-link reflections (#1153).
  • url / file / pipe now apply config files, global flags, and an explicit -i.
  • --output write failures report via stderr and a non-zero exit code.
  • Bounded request fan-out with a per-parameter payload cap and DOM-phase early exit (#1155, #1156).

3.1.0

A feature release: out-of-band XSS, external / modern DOM-sink analysis, CSP awareness, HAR input, and rate limiting.

Added

  • --blind-oob: out-of-band (blind) XSS detection via an interactsh server. CLI-only.
  • --analyze-external-js: fetches same-origin <script src> bundles and runs them through AST DOM-XSS analysis (#1094).
  • --detect-outdated-libs: flags known-vulnerable front-end library versions (#1074).
  • --input-type har: accepts a HAR / proxy export as a scan source (#1095).
  • --rate-limit: a requests-per-second token bucket shared across all workers and targets (#1096).
  • --retries / --retry-delay: opt-in exponential-backoff retries for 5xx and transient transport errors.
  • --insecure: configurable TLS certificate validation (#1111).
  • CSP / Trusted Types awareness, filter-aware JS breakout synthesis, and attribute-decode WAF-bypass mutations.
  • Wider DOM-XSS coverage (Document.parseHTMLUnsafe(), window.open(), more JS sink names).
  • scan_timeout for server / MCP jobs, and scan meta in SARIF / Markdown / TOML output.

Changed

  • --waf-evasion now uses randomized jitter and an escalating cooldown instead of a fixed slow preset.
  • Refactored the REST server into a dedicated subsystem with an extracted job domain.

Fixed

  • Cut reflected-XSS false positives with ~31% fewer requests (#1117).
  • Require a payload's handler/sink to survive on the marker element before verifying [V] (#1118).
  • Clear DOM taint on sanitized reassignment, removing a class of DOM-XSS false positives (#1087).
  • --encoders accepts htmlpad, unicode, and zwsp; --blind-oob no longer swallows the target URL.
  • Parse-DoS hardening against deeply nested hostile JS, plus closed xssmaze WAF-facade gaps.

Security & Reliability

  • Capped body reads and reflection-scan work to prevent OOM and hangs on hostile responses.
  • REST responses set an explicit Content-Type with nosniff; the server warns on non-loopback binds without auth.
  • Fixed a per-job scope leak and added rate-limit / concurrency caps for server and MCP scans.

3.0.2

  • Switched the rustls backend to ring, fixing source builds (AUR, cargo install, musl).
  • Repaired .deb / .rpm generation and the release matrix, which had dropped most v3.0.1 artifacts.
  • Hardened the docs site: self-hosted assets, robots.txt, security.txt, and a tighter CSP.

3.0.1

  • DOM-XSS coverage for jQuery selector-to-HTML sinks, dynamic import(), and fetch() / XHR sources.
  • NetScaler and cookie-based WAF fingerprints; orthogonal bypass expansion to avoid combinatorial blow-up.
  • Native .deb / .rpm packages, musl binaries, and Snapcraft / AUR distribution.
  • Explicit -p / -d targets are always tested, regardless of --skip-* flags (XSSMaze 92.7% → 98.2%).
  • Workers shut down gracefully instead of panicking on a closed semaphore.

3.0.0

Dalfox v3 is a complete rewrite in Rust, replacing the legacy Go implementation (now on the v2 branch) with an asynchronous architecture and a modern CLI structure.

Added

  • AST-based JS analysis: oxc-powered static analysis for DOM-XSS, replacing headless browsers.
  • MCP server (dalfox mcp): exposes Dalfox tools to AI coding assistants over stdio.
  • Async REST API server: axum with job queueing, cancellation, and webhook notifications.
  • TOML / JSON config files, plus markdown, sarif, and toml output formats.
  • --dry-run, --stream-findings, --max-payloads-per-param, and --scan-timeout.

Changed

  • All target paths consolidated under a single scan subcommand (url / file / pipe kept as aliases).
  • Standardized exit codes (0 clean, 1 findings, 2 errors) for CI integration.
  • Per-target progress bars, with banners suppressed for machine-readable modes.

Removed

  • The Chromium / chromedp headless engine and all headless-related flags.
  • Legacy non-XSS checkers (BAV), to focus strictly on XSS.
  • --found-action, --grep, --report, and --max-cpu.

Security & Reliability

  • Constant-time API key comparison and strict JSONP callback validation in the REST server.
  • Excluded local cookie file loaders (--cookie-from-raw) from the MCP tool interface.
  • Panic isolation (catch_unwind) to prevent scanner and MCP thread crashes.