Skip to content

Fix: crash when using --json without --data on URLs without query params - #439

Open
xyaz1313 wants to merge 1 commit into
s0md3v:masterfrom
xyaz1313:fix/json-no-params-crash
Open

Fix: crash when using --json without --data on URLs without query params#439
xyaz1313 wants to merge 1 commit into
s0md3v:masterfrom
xyaz1313:fix/json-no-params-crash

Conversation

@xyaz1313

Copy link
Copy Markdown

Problem

When running XSStrike with --json flag against a URL without query parameters, the tool crashes with:

AttributeError: 'str' object has no attribute 'keys'

Reproduction:

python xsstrike.py -u https://example.net --json

Root Cause

In xsstrike.py line 141-143:

elif jsonData:
    headers['Content-type'] = 'application/json'
    paramData = converter(paramData)  # paramData is None here

When paramData is None and jsonData is True:

  1. converter(None) calls json.dumps(None) → returns "null" (a string)
  2. getParams() sees jsonData is set, does params = dataparams = "null"
  3. scan() line 53: list(params.keys())[0] → crashes because strings don't have .keys()

Fix

Only convert paramData when it's actually provided:

elif jsonData and paramData:

This way, when --json is used without --data, paramData stays None, getParams() correctly returns None, and the "No parameters to test" error message is shown gracefully.

Fixes #438

When running XSStrike with --json flag against a URL without query
parameters (e.g., python xsstrike.py -u https://example.net --json),
the tool crashes with:

  AttributeError: 'str' object has no attribute 'keys'

This happens because converter(None) returns the string "null", which
getParams() then assigns directly to params when jsonData is set.
The fix: only call converter() when paramData is actually provided.

Fixes s0md3v#438
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AttributeError: 'str' object has no attribute 'keys' on JSON export.

1 participant