Skip to content

Commit af6e0fa

Browse files
authored
Merge pull request #499 from owasp-noir/fix/prevent-duplicate-path-params
fix: Prevent duplicate path params from being added
2 parents 0721dd7 + 5e28e3b commit af6e0fa

File tree

1 file changed

+13
-3
lines changed

1 file changed

+13
-3
lines changed

src/models/noir.cr

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,10 @@ class NoirRunner
279279
new_endpoint.url = new_endpoint.url.gsub("{#{match[1]}}", new_value)
280280
end
281281

282-
new_endpoint.params << Param.new(param, "", "path")
282+
new_param = Param.new(param, "", "path")
283+
unless new_endpoint.params.includes?(new_param)
284+
new_endpoint.params << new_param
285+
end
283286
end
284287

285288
scans = endpoint.url.scan(/\/:([^\/]+)/).flatten
@@ -289,7 +292,10 @@ class NoirRunner
289292
new_endpoint.url = new_endpoint.url.gsub(":#{match[1]}", new_value)
290293
end
291294

292-
new_endpoint.params << Param.new(match[1], "", "path")
295+
new_param = Param.new(match[1], "", "path")
296+
unless new_endpoint.params.includes?(new_param)
297+
new_endpoint.params << new_param
298+
end
293299
end
294300

295301
scans = endpoint.url.scan(/\/<([^>]+)>/).flatten
@@ -299,7 +305,11 @@ class NoirRunner
299305
if new_value != ""
300306
new_endpoint.url = new_endpoint.url.gsub("<#{match[1]}>", new_value)
301307
end
302-
new_endpoint.params << Param.new(param, "", "path")
308+
309+
new_param = Param.new(param, "", "path")
310+
unless new_endpoint.params.includes?(new_param)
311+
new_endpoint.params << new_param
312+
end
303313
end
304314

305315
final << new_endpoint

0 commit comments

Comments
 (0)