// Path: src/main/java/burp/HTTPParser.java
// public static String getResponseHeaderValue(IResponseInfo responseInfo, String headerName) {
//     headerName = headerName.toLowerCase().replace(":", "");
//     for (String header : responseInfo.getHeaders()) {
//         if (header.toLowerCase().startsWith(headerName)) {
//             return header.split(":", 2)[1];
//         }
//     }
//     return null;
// }
// 
// Path: src/main/java/burp/j2ee/CustomScanIssue.java
// public class CustomScanIssue implements IScanIssue {
// 
//     private IHttpService httpService;
//     private URL url;
//     private IHttpRequestResponse httpMessages;
//     private String name;
//     private String detail;
//     private Risk severity;
//     private String remedy;
//     private Confidence confidence = Confidence.Certain;
//     
//     public CustomScanIssue(
//             IHttpService httpService,
//             URL url,
//             IHttpRequestResponse httpMessages,
//             String name,
//             String detail,
//             String remedy,
//             Risk severity,
//             Confidence confidence) {
//         this.httpService = httpService;
//         this.url = url;
//         this.httpMessages = httpMessages;
//         this.name = "J2EEScan - " + name;
//         this.detail = detail;
//         this.remedy = remedy;
//         this.severity = severity;
//         this.confidence = confidence;
//     }      
//     
// 
//     @Override
//     public URL getUrl() {
//         return url;
//     }
// 
//     @Override
//     public String getIssueName() {
//         return name;
//     }
// 
//     @Override
//     public int getIssueType() {
//         return 0;
//     }
// 
//     @Override
//     public String getSeverity() {
//         return severity.toString();
//     }
// 
//     @Override
//     // "Certain", "Firm" or "Tentative"
//     public String getConfidence() {
//         return confidence.toString();
//     }
// 
//     @Override
//     public String getIssueBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getRemediationBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getIssueDetail() {
//         return detail;
//     }
// 
//     @Override
//     public String getRemediationDetail() {
//         return remedy;
//     }
// 
//     @Override
//     public IHttpRequestResponse[] getHttpMessages() {
//         return new IHttpRequestResponse[]{httpMessages};
//     }
// 
//     @Override
//     public IHttpService getHttpService() {
//         return httpService;
//     }
// 
// }
// 
// Path: src/main/java/burp/j2ee/IssuesHandler.java
// public class IssuesHandler {
//     
//         
//         /**
//          * 
//          * Verify for a specific protocol - host a specific
//          * issue has been already detected
//          * 
//          * @param callbacks IBurpExtenderCallbacks
//          * @param vulnerabilityName vulnerability to check if it's present into the issues
//          * @param protocol (http/https)
//          * @param host the hostname 
//          * 
//          */
//         public static boolean isvulnerabilityFound(IBurpExtenderCallbacks callbacks, 
//                 String vulnerabilityName,
//                 String protocol,
//                 String host) {
// 
//         IScanIssue[] allIssues;
// 
//         allIssues = callbacks.getScanIssues(protocol + "://" + host);
//         
//         for (IScanIssue a : allIssues) {
// 
//             if (a.getIssueName().contains(vulnerabilityName)) {
//                 return true;
//             }
//         }
//         
//         return false;
//     }
// }


import static burp.HTTPParser.getResponseHeaderValue;
import burp.IBurpExtenderCallbacks;
import burp.IExtensionHelpers;
import burp.IHttpRequestResponse;
import burp.IRequestInfo;
import burp.IResponseInfo;
import burp.IScanIssue;
import burp.IScannerInsertionPoint;
import burp.j2ee.Confidence;
import burp.j2ee.CustomScanIssue;
import burp.j2ee.IssuesHandler;
import burp.j2ee.Risk;
import burp.j2ee.issues.IModule;
import java.io.PrintWriter;
import java.net.URL;
import java.util.ArrayList;
import java.util.LinkedHashSet;
import java.util.List;
package burp.j2ee.issues.impl;


/**
 *
 * Test for NodeJS Response Splitting
 *
 * Reference:
 * https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
 * http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
 * http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
 *
 */
public class NodeJSResponseSplitting implements IModule {

    private static final String TITLE = "NodeJS Response Splitting";
    private static final String DESCRIPTION = "J2EEscan identified a vulnerable installation"
            + " of NodeJS. A Response Splitting vulnerability has been found.<br /><br />"
            + "<b>References</b>:<br /><br />"
            + "http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf<br />"
            + "https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/";

    private static final String REMEDY = "Update the software with the last security patches";

    private static final byte[] NODEJS_INJ = "%c4%8d%c4%8aInjectionHeader:%2020%c4%8d%c4%8a".getBytes();

    private PrintWriter stderr;

    @Override
    public List<IScanIssue> scan(IBurpExtenderCallbacks callbacks, IHttpRequestResponse baseRequestResponse, IScannerInsertionPoint insertionPoint) {

        List<IScanIssue> issues = new ArrayList<>();

        IExtensionHelpers helpers = callbacks.getHelpers();
        IRequestInfo reqInfo = helpers.analyzeRequest(baseRequestResponse);

        URL url = reqInfo.getUrl();
        String host = url.getHost();

        String protocol = url.getProtocol();

        // skip if the NodeJS has not been found on the system
// Path: src/main/java/burp/HTTPParser.java
// public static String getResponseHeaderValue(IResponseInfo responseInfo, String headerName) {
//     headerName = headerName.toLowerCase().replace(":", "");
//     for (String header : responseInfo.getHeaders()) {
//         if (header.toLowerCase().startsWith(headerName)) {
//             return header.split(":", 2)[1];
//         }
//     }
//     return null;
// }
// 
// Path: src/main/java/burp/j2ee/CustomScanIssue.java
// public class CustomScanIssue implements IScanIssue {
// 
//     private IHttpService httpService;
//     private URL url;
//     private IHttpRequestResponse httpMessages;
//     private String name;
//     private String detail;
//     private Risk severity;
//     private String remedy;
//     private Confidence confidence = Confidence.Certain;
//     
//     public CustomScanIssue(
//             IHttpService httpService,
//             URL url,
//             IHttpRequestResponse httpMessages,
//             String name,
//             String detail,
//             String remedy,
//             Risk severity,
//             Confidence confidence) {
//         this.httpService = httpService;
//         this.url = url;
//         this.httpMessages = httpMessages;
//         this.name = "J2EEScan - " + name;
//         this.detail = detail;
//         this.remedy = remedy;
//         this.severity = severity;
//         this.confidence = confidence;
//     }      
//     
// 
//     @Override
//     public URL getUrl() {
//         return url;
//     }
// 
//     @Override
//     public String getIssueName() {
//         return name;
//     }
// 
//     @Override
//     public int getIssueType() {
//         return 0;
//     }
// 
//     @Override
//     public String getSeverity() {
//         return severity.toString();
//     }
// 
//     @Override
//     // "Certain", "Firm" or "Tentative"
//     public String getConfidence() {
//         return confidence.toString();
//     }
// 
//     @Override
//     public String getIssueBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getRemediationBackground() {
//         return null;
//     }
// 
//     @Override
//     public String getIssueDetail() {
//         return detail;
//     }
// 
//     @Override
//     public String getRemediationDetail() {
//         return remedy;
//     }
// 
//     @Override
//     public IHttpRequestResponse[] getHttpMessages() {
//         return new IHttpRequestResponse[]{httpMessages};
//     }
// 
//     @Override
//     public IHttpService getHttpService() {
//         return httpService;
//     }
// 
// }
// 
// Path: src/main/java/burp/j2ee/IssuesHandler.java
// public class IssuesHandler {
//     
//         
//         /**
//          * 
//          * Verify for a specific protocol - host a specific
//          * issue has been already detected
//          * 
//          * @param callbacks IBurpExtenderCallbacks
//          * @param vulnerabilityName vulnerability to check if it's present into the issues
//          * @param protocol (http/https)
//          * @param host the hostname 
//          * 
//          */
//         public static boolean isvulnerabilityFound(IBurpExtenderCallbacks callbacks, 
//                 String vulnerabilityName,
//                 String protocol,
//                 String host) {
// 
//         IScanIssue[] allIssues;
// 
//         allIssues = callbacks.getScanIssues(protocol + "://" + host);
//         
//         for (IScanIssue a : allIssues) {
// 
//             if (a.getIssueName().contains(vulnerabilityName)) {
//                 return true;
//             }
//         }
//         
//         return false;
//     }
// }


// Path: src/main/java/burp/j2ee/issues/impl/NodeJSResponseSplitting.java
import static burp.HTTPParser.getResponseHeaderValue;
import burp.IBurpExtenderCallbacks;
import burp.IExtensionHelpers;
import burp.IHttpRequestResponse;
import burp.IRequestInfo;
import burp.IResponseInfo;
import burp.IScanIssue;
import burp.IScannerInsertionPoint;
import burp.j2ee.Confidence;
import burp.j2ee.CustomScanIssue;
import burp.j2ee.IssuesHandler;
import burp.j2ee.Risk;
import burp.j2ee.issues.IModule;
import java.io.PrintWriter;
import java.net.URL;
import java.util.ArrayList;
import java.util.LinkedHashSet;
import java.util.List;

package burp.j2ee.issues.impl;


/**
 *
 * Test for NodeJS Response Splitting
 *
 * Reference:
 * https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
 * http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
 * http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
 *
 */
public class NodeJSResponseSplitting implements IModule {

    private static final String TITLE = "NodeJS Response Splitting";
    private static final String DESCRIPTION = "J2EEscan identified a vulnerable installation"
            + " of NodeJS. A Response Splitting vulnerability has been found.<br /><br />"
            + "<b>References</b>:<br /><br />"
            + "http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf<br />"
            + "https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/";

    private static final String REMEDY = "Update the software with the last security patches";

    private static final byte[] NODEJS_INJ = "%c4%8d%c4%8aInjectionHeader:%2020%c4%8d%c4%8a".getBytes();

    private PrintWriter stderr;

    @Override
    public List<IScanIssue> scan(IBurpExtenderCallbacks callbacks, IHttpRequestResponse baseRequestResponse, IScannerInsertionPoint insertionPoint) {

        List<IScanIssue> issues = new ArrayList<>();

        IExtensionHelpers helpers = callbacks.getHelpers();
        IRequestInfo reqInfo = helpers.analyzeRequest(baseRequestResponse);

        URL url = reqInfo.getUrl();
        String host = url.getHost();

        String protocol = url.getProtocol();

        // skip if the NodeJS has not been found on the system
        if (!IssuesHandler.isvulnerabilityFound(callbacks,