False positives for PUT request about skipfish

[GoogleCodeExporter]

Actually, skipfish only complains about PUT if the request is treated 
*differently* 
from GET: the response must be HTTP 2xx *and* the returned page must be 
different 
than for GET.

The reason it does the check this way is because it may not always be possible 
to 
reliably verify the outcome of PUT; for example, the server may be only 
configured to 
return certain types of files.

Please let me know if you're observing something else, or if you see an obvious 
case 
where this check fails for some other reason?

Original comment by [email protected] on 25 Mar 2010 at 11:32

[GoogleCodeExporter]

Ping?

Original comment by [email protected] on 28 Mar 2010 at 5:41

[GoogleCodeExporter]

Sorry about the late feedback. I now understand why skipfish see a different 
result
when using PUT and GET. The URL in question is a PHP search script that is 
fetching
the search term from $_GET or $_POST. A PUT request doesn't populate $_GET or 
$_POST,
and hence the returned page is different. It's a false positive, but not 
something
skipfish easily can fix, I guess. You can close the bug.

Thx for your time and effort.

Original comment by [email protected] on 30 Mar 2010 at 7:52

[GoogleCodeExporter]

Yeah, sounds like something that is relatively unlikely to occur elsewhere - 
well, if 
it is a common script, we could try to account for it specifically? Is this 
something 
developed in house, or available publicly and used by others?

Original comment by [email protected] on 30 Mar 2010 at 8:29

• Changed state: WontFix

[GoogleCodeExporter]

The search script is part of PivotX. You should be able to see "PUT request 
accepted"
problem by running 

./skipfish -o pivotx.net -I /search/ http://pivotx.net/search/

Maybe be mod_rewrite is causing the problem?

http://pivotx.net/search/whatever is equal to 
http://pivotx.net/index.php?q=whatever

Original comment by [email protected] on 30 Mar 2010 at 10:30

[GoogleCodeExporter]

Here too: http://skipfish.vps.leoschabel.de/dfglfa/

It's Joomla.

Original comment by leoschabel on 3 Apr 2010 at 6:01