* Treat carriage return as whitespace in strutils.is_xml
is_xml() skipped only tab, LF and space before checking for the
opening "<", so a response body that started with a leading CR
or CRLF (which is what HTTP frames look like, and what some
Windows-side XML producers emit) was not detected as XML.
The XML/HTML content view's auto-detection score then dropped
to 0 instead of the usual 0.4 for those bodies.
XML 1.0 §2.3 defines whitespace as (#x20 | #x9 | #xD | #xA), so
\r (0x0D) belongs in the skip set alongside the other three.
Adds the missing byte plus three assertions in the existing
test_is_xml: \r<foo and \r\n<foo are now recognised, and a
sanity check that \r\nfoo is still rejected.
* [autofix.ci] apply automated fixes
* simplify wording
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Maximilian Hils <git@maximilianhils.com>
* Copy issuer's SubjectKeyIdentifier into leaf AuthorityKeyIdentifier
mitmproxy.certs.dummy_cert previously built the leaf's
AuthorityKeyIdentifier with `from_issuer_public_key()`, which always
derives the keyIdentifier as the SHA-1 of the issuer's BIT STRING public
key. This violates RFC 5280 §4.2.1.2:
The value of the subject key identifier MUST be the value placed in
the key identifier field of the authority key identifier extension of
certificates issued by the subject of this certificate.
Whenever the issuer's stored SKI was generated by any other method
(RFC 7093 truncated SHA-256/384/512, hardware-rooted CAs, or any custom
value), the recomputed AKI mismatches the issuer's SKI and strict TLS
chain builders (`X509_V_FLAG_X509_STRICT`, Python `ssl`, Go
`crypto/x509`) reject the chain with "authority and subject key
identifier mismatch".
The most common modern trigger: cert-manager >=1.18 and Go >=1.25
default to truncated SHA-256 SKIs for FIPS 140-3 compliance, so any
mitmproxy deployment fed a CA from those toolchains breaks.
Fix: prefer the issuer's stored SKI extension verbatim
(AuthorityKeyIdentifier.from_issuer_subject_key_identifier), and only
fall back to the previous behavior when the issuer cert has no SKI
extension at all.
Adds two regression tests:
- test_aki_copies_issuer_ski_non_sha1 verifies that a CA with a
truncated SHA-256 SKI (as produced by cert-manager / Go 1.25+) yields
a leaf whose AKI is byte-equal to the issuer's stored SKI.
- test_aki_falls_back_when_issuer_has_no_ski verifies the SKI-absent
fallback still produces the previous AKI value.
* [autofix.ci] apply automated fixes
* shorten changelog
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Maximilian Hils <git@maximilianhils.com>
* fix: avoid IndexError in is_mostly_bin for short tails
`is_mostly_bin` looks up to 4 bytes past the 100-byte cutoff to find a
clean UTF-8 character boundary. when the input is just over 100 bytes
and starts with a continuation byte at index 100, the lookahead reads
past the end of the buffer.
cap the loop end at `len(s)`. existing fallback to `s[:100]` still
covers the case where every byte in the lookahead window is a
continuation byte.
fixes#8188
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Julio César Suástegui <juliosuas@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: include addon options in --options output
* add changelog entry for #4423
* explain why we do this dance
* fix: tests
---------
Co-authored-by: Maximilian Hils <git@maximilianhils.com>
fix: display failed CONNECT requests in mitmdump (#7083)
Handle HttpConnectErrorHook in the dumper addon so that failed CONNECT
requests (e.g. DNS resolution errors) are logged to the terminal.
* cleanup: removed unused functions/classes and scripts
* changes: revert save_settings() removal .. may be a missing call in export(), flagged in PR for maintainer input.
* fix: restore missing test and clean up bits.py references
* added: add changelog for #8095 under unreleased, removal of several dead functions
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* Fix modify_body crash when replacement contains backslash sequences
When using modify_body with replacement strings containing backslashes
(e.g., \n, \x00, \u003), re.sub() interprets them as escape sequences,
causing a PatternError.
Using a lambda function for the replacement argument treats the string
literally, avoiding regex escape interpretation.
Fixes#7579
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Hugh <HueCodes@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* Add ZIP content view for issue #8051
- Implement ZipContentview with ZIP file parsing
- Display file metadata (names, sizes, compression methods, dates, comments)
- Add comprehensive test suite with 12 test cases covering all scenarios
- Register view in contentviews module
- Achieve 100% test coverage
Fixes#8051
* [autofix.ci] apply automated fixes
* Add coverage tests for ZIP content view exception handling
- Add test_view_zip_invalid_date_time to cover ValueError exception
- Add test_view_zip_overflow_date_time to cover OverflowError exception
- Add test_view_zip_general_exception to cover general Exception handler
- Achieves 100% code coverage for _view_zip.py
* Update ZIP content view to match unzip -l and unzip -l -v formats
- Standard view now matches unzip -l format with Length, Date, Time, Name columns
- Added verbose view matching unzip -l -v format with compression details
- Updated tests to assert against new table-like output format
- Added comprehensive test coverage for both standard and verbose views
- Handles edge cases: empty archives, different compression methods, invalid dates
* Fix lint errors: remove unused variables
- Remove unused max_date and max_time variables from ZIP content views
- Fix import ordering in test file
* Fix PR feedback: separator hyphen count and CRC spacing
* Fix PR feedback: separator hyphen count and CRC spacing
* Simplify ZIP contentview per maintainer feedback
* Add test cases for ZIP contentview
* Simplify ZIP contentview: compact one-line format per file
* Simplify ZIP contentview: use yaml_dumps for safe filename output
- Output just filenames as YAML list (no size info)
- Use yaml_dumps() to avoid template injection risk
- Remove try/catch, let framework handle exceptions
- Return '(empty zip file)' for empty archives
- Reduce test suite to minimal golden test with edge cases
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* Partially Revert "Web: harden `xsrf_token` usage (#7491)"
This reverts commit b761cb46c4.
The reason for this revert is that it's incompatible with Vite's
server (https://github.com/mitmproxy/mitmproxy/issues/7969).
We keep the parts that are compatible, and add an additional
`Sec-Fetch-Site` check for for all requests.
* use type imports for Vite compatibility
* make flow columns work with function name minification
* make modals work with function name minification
* vite: move assets
* web: switch builds to vite
* move to vite
* vite: move css and js
* update CHANGELOG
* [autofix.ci] apply automated fixes
* fix test failures
* fix static viewer
* obtain xsrf cookie lazily
* split js/css bundles into app/vendor
* [autofix.ci] apply automated fixes
* update compiled assets
* fix nits
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix mitmweb --web-host with ipv6
When using `--web-host ::1` the `web_url` was `http://::1:8081` instead
of `http://[::1]:8081`. This lead for the wrong URL to be written in the
logs, and the wrong URL to be opened with `--web-open-browser`.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat: Make TCP inactivity timeout configurable (currently fixed at 10 minutes) #7909
* docs: updated CHANGELOG
* [autofix.ci] apply automated fixes
* fix: add tests
* fix: testcase
* fix nits:
- We currently only add command line flags for the most important options. `--set tcp_timeout=10` is the recommended approach for now.
- Move timeout to the "wait for close" part specifically.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Maximilian Hils <github@maximilianhils.com>
Co-authored-by: Maximilian Hils <git@maximilianhils.com>
* update to Python 3.14
* [autofix.ci] apply automated fixes
* fix python 3.14 compatibility
* bump minimum required zstandard version
0.15 was causing CI issues with Python 3.14.
* Revert "Bump hypothesis dependency (#7865)"
This reverts commit 0981668515.
windows-curses has no abi3 wheels, which blocks adoption of Python 3.14. Kill it with fire.
* remove compression from HAR tests
* add `build-essential` to build jobs
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* add custom htpasswd parser
This PR migrates us off passlib, which is unmaintained.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* do not escape non-ascii characters in the JSON contentview
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* Add new feature: storing of request and response streaming bodies
* Fix unit test by regenerating the options file with options_js.py
* Add test cases with store_streamed_bodies True and False
* Update Changelog
* Update Changelog with pull request ID
* [autofix.ci] apply automated fixes
* Update test with a dedicated test case for store_streamed_bodies
* Remove unnecessary option store_streamed_bodies from options.py
* Update docstrings for store_streamed_bodies and stream_large_bodies.
* Update docstring for store_streamed_bodies since it is not used anywhere in practice here.
* Fix typo in test_http.py
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
