3.2.3
A credential-leak fix, large scan-performance cuts, and wider XSS coverage.
- Security: a scanned page could choose where Dalfox sent the operator's
-Hheaders and--cookies. Cross-origin<form action>targets are no longer probed during parameter discovery (GHSA-mph2-gf5w-6f9f, #1460, #1461). Thanks to the DREAM Security Research Team — Arad Inbar, Adiel Sol, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel and Shir Sadon — for the report. - Security:
--follow-redirectsnow stops when a chain leaves the origin it started on, with a carve-out for the same-hosthttp->httpsupgrade. Previously a redirect off-target leaked custom credential headers on the first hop and the fullCookie/Authorizationon the second (GHSA-69jp-6fh7-wjpm, #1460, #1461). - Scans no longer run through the environment's
HTTP_PROXY/HTTPS_PROXY, which the docs already said they didn't (#1441). - Much faster scans: payload requests now run concurrently within a parameter, batches ramp instead of jumping to a full
--workerswindow, and endpoints that uniformly escape their echo exit early instead of running the whole catalog (#1440, #1442, #1457). - New injection surfaces: GraphQL and XML / SOAP request bodies (#1426, #1427).
- Wider DOM-XSS AST coverage — Promise combinators, optional chaining, static bracket paths, more sinks and sources — with fewer false positives (#1426, #1444).
- Detects the sub-not-gsub angle filter: a doubled
<<svg ...>>opens a real tag where a one-shotstr::replaceonly ate the first<(#1445). - Fewer escaped-echo
[R]false positives, and quote inference is scoped to tag / element content (#1457, #1458). - A batch of server / MCP lifecycle, CLI / config, raw-HTTP / HAR import, and PoC-reproduction fixes (#[1405](https://github.com/hahwul/dalfox/pull/1405)-[#1425](https://github.com/1405-/issues/1425), #1438).
New Contributors
- @NotAFlightRisk made their first contribution in https://github.com/hahwul/dalfox/pull/1441
Full Changelog: https://github.com/hahwul/dalfox/compare/v3.2.2...v3.2.3
