DALFOX Files

3.2.0

Mass-scan workflow features, wider DOM-XSS coverage, and CSP / false-positive fixes.

Added

• --state-file: resume an interrupted mass scan, skipping completed targets (#1275).
• --baseline: report only findings new since a previous run (#1279).
• --dedup-urls: signature-level target deduplication for large URL lists (#1278).
• Session-loss detection: warn when auth dies mid-scan instead of reporting zero findings (#1277, #1285).
• New DOM-XSS sinks: drag-drop, async clipboard, FileReader, setAttributeNS, indirect eval, DOMParser (#1257, #1258).
• HTTP QUERY method support (RFC 10008) (#1220).
• MCP: max_payloads_per_param and a synchronous wait mode (#1223).
• More dalfox payload selectors (special chars, functions, awesome-alert, ...) (#1271).
• Findings now carry separate confidence / detection-method / impact axes (#1246).

Fixed

• CSP analysis: default-src no longer overrides script-src, wildcard origins match deeper subdomains, and enforcing <meta> policies win over report-only (#1266, #1267, #1268).
• No more verified [V] for HTML-tag echoes in application/javascript bodies (#1286).
• Absent multipart params are now injected, and empty JSON body values no longer garble the request (#1260, #1261, #1263).
• SARIF output emits a matching rule and correct ruleIndex per finding CWE (#1262).
• Config files are validated, and an explicit CLI flag now beats a config value even when it equals the default (#1228, #1270, #1280).
• Server / MCP: validated method / encoders at the API boundary, deterministic scan listing order, and an honest cancelled response (#1269, #1264, #1237, #1229).
• --deep-scan runs the preflight probe again, --limit-result-type no longer hides the findings it limited on, and -i reads every file argument (#1212).
• Honest redirect evidence, working --sxss discovery, bare -p seeding when discovery is skipped, and no stdin hang when a target is given (#1242, #1221, #1241).
• WAF: sink keywords match on identifier boundaries, and blocking statuses boost confidence even with an empty body (#1259, #1265).
• Windows binary no longer overflows the main thread stack at startup (#1294).

Performance

• One shared HTML parse per AST DOM phase (#1256).

Documentation

• Korean translation and a redesigned docs site (#1224, #1230).
• Documented the R/V/A detection model across every surface (#1255).

New Contributors

• @A-S-Manoj made their first contribution in https://github.com/hahwul/dalfox/pull/1205
• @terminalchai made their first contribution in https://github.com/hahwul/dalfox/pull/1210

Full Changelog: https://github.com/hahwul/dalfox/compare/v3.1.2...v3.2.0