mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-20 06:27:31 +02:00
CyberSecurityUPandClaude Opus 4.8
2502907160
Agents report endpoints as "METHOD /path" (e.g. "GET /api/search"). host_of
split on whitespace/slash and returned the method ("get"/"post") as the host,
so host-relative findings were wrongly quarantined as out-of-scope and the
attack graph grew bogus HOST "get"/HOST "post" nodes — real findings vanished
from the report.
Add scope::strip_leading_method and apply it in host_of and in the graph
finding projection. A host-relative endpoint now resolves to an empty host
(kept in scope, relative to the authorized target) and a method+URL endpoint
resolves to the real host. Covered by new scope tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>