fix(runner): honor -omit-body for stored responses when a matcher or filter is set

runner/runner.go

@@ -339,6 +339,7 @@ func New(options *Options) (*Runner, error) {
 	scanopts.OutputLocation = options.Location
 	scanopts.OutputContentLength = options.ContentLength
 	scanopts.StoreResponse = options.StoreResponse
+	scanopts.OmitBody = options.OmitBody
 	scanopts.StoreResponseDirectory = options.StoreResponseDir
 	scanopts.OutputServerHeader = options.OutputServerHeader
 	scanopts.ResponseHeadersInStdout = options.ResponseHeadersInStdout
@@ -1366,8 +1367,8 @@ func (r *Runner) RunEnumeration() {
 				var responsePath, screenshotPath, screenshotPathRel string
 				// store response
 				if r.scanopts.StoreResponse || r.scanopts.StoreChain {
-					if r.scanopts.OmitBody {
-						resp.Raw = strings.ReplaceAll(resp.Raw, resp.ResponseBody, "")
+					if r.scanopts.OmitBody && resp.Response != nil {
+						resp.Raw = resp.Response.RawHeaders
 					}
 
 					responsePath = fileutilz.AbsPathOrDefault(filepath.Join(responseBaseDir, domainResponseFile))
@@ -2594,7 +2595,7 @@ retry:
 
 		if !r.options.HasMatcherOrFilter() {
 			if r.options.OmitBody {
-				resp.Raw = strings.ReplaceAll(resp.Raw, string(resp.Data), "")
+				resp.Raw = resp.RawHeaders
 			}
 			responsePath = fileutilz.AbsPathOrDefault(filepath.Join(responseBaseDir, domainResponseFile))
 			// URL.EscapedString returns that can be used as filename

runner/runner_test.go

@@ -13,7 +13,9 @@ import (
 	"math/big"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -550,6 +552,61 @@ func TestStoreResponse_withMatcherSetsFlag(t *testing.T) {
 	require.True(t, opts.HasMatcherOrFilter())
 }
 
+// -ob stores the status line and headers only, with or without a matcher.
+// Cutting the body text out of the raw response missed bodies the charset
+// decoding had changed, and cut a short body such as "OK" out of the status line.
+func TestStoreResponse_omitBodyStoresHeadersOnly(t *testing.T) {
+	tests := []struct {
+		name, contentType, body, marker string
+	}{
+		{"latin-1 body", "text/html; charset=iso-8859-1", "caf\xe9 response-body-marker", "response-body-marker"},
+		{"short body", "text/plain", "OK", ""},
+	}
+	for _, tt := range tests {
+		for _, matchCode := range []string{"", "200"} {
+			t.Run(fmt.Sprintf("%s, -mc %q", tt.name, matchCode), func(t *testing.T) {
+				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					w.Header().Set("Content-Type", tt.contentType)
+					_, _ = io.WriteString(w, tt.body)
+				}))
+				t.Cleanup(srv.Close)
+
+				dir := t.TempDir()
+				options := &Options{
+					Threads:               1,
+					RateLimit:             10,
+					Retries:               0,
+					Timeout:               5,
+					Methods:               http.MethodGet,
+					Delay:                 -1,
+					StoreResponse:         true,
+					StoreResponseDir:      dir,
+					OmitBody:              true,
+					OutputMatchStatusCode: matchCode,
+					InputTargetHost:       []string{srv.URL},
+				}
+				require.NoError(t, options.ValidateOptions())
+
+				r, err := New(options)
+				require.NoError(t, err)
+				defer r.Close()
+				r.RunEnumeration()
+
+				files, err := filepath.Glob(filepath.Join(dir, "response", "*", "*.txt"))
+				require.NoError(t, err)
+				require.Len(t, files, 1)
+				stored, err := os.ReadFile(files[0])
+				require.NoError(t, err)
+				require.Contains(t, string(stored), "HTTP/1.1 200 OK\r\n")
+				require.Contains(t, string(stored), "Content-Type: "+tt.contentType+"\r\n")
+				if tt.marker != "" {
+					require.NotContains(t, string(stored), tt.marker)
+				}
+			})
+		}
+	}
+}
+
 func TestProtocolValidation(t *testing.T) {
 	for _, proto := range []string{"", "http11", "http2", "http3", "HTTP11", "HTTP2", "HTTP3"} {
 		opts := &Options{Protocol: proto}