fix(runner): honor -omit-body for stored responses when a matcher or filter is set

runner/runner.go

@@ -339,6 +339,7 @@ func New(options *Options) (*Runner, error) {
 	scanopts.OutputLocation = options.Location
 	scanopts.OutputContentLength = options.ContentLength
 	scanopts.StoreResponse = options.StoreResponse
+	scanopts.OmitBody = options.OmitBody
 	scanopts.StoreResponseDirectory = options.StoreResponseDir
 	scanopts.OutputServerHeader = options.OutputServerHeader
 	scanopts.ResponseHeadersInStdout = options.ResponseHeadersInStdout
@@ -1366,8 +1367,8 @@ func (r *Runner) RunEnumeration() {
 				var responsePath, screenshotPath, screenshotPathRel string
 				// store response
 				if r.scanopts.StoreResponse || r.scanopts.StoreChain {
-					if r.scanopts.OmitBody {
-						resp.Raw = strings.ReplaceAll(resp.Raw, resp.ResponseBody, "")
+					if r.scanopts.OmitBody && resp.Response != nil {
+						resp.Raw = strings.ReplaceAll(resp.Raw, string(resp.Response.Data), "")
 					}
 
 					responsePath = fileutilz.AbsPathOrDefault(filepath.Join(responseBaseDir, domainResponseFile))

runner/runner_test.go

@@ -13,7 +13,9 @@ import (
 	"math/big"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -550,6 +552,43 @@ func TestStoreResponse_withMatcherSetsFlag(t *testing.T) {
 	require.True(t, opts.HasMatcherOrFilter())
 }
 
+func TestStoreResponse_withMatcherOmitsBody(t *testing.T) {
+	const body = "response-body-marker"
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, body)
+	}))
+	t.Cleanup(srv.Close)
+
+	dir := t.TempDir()
+	options := &Options{
+		Threads:               1,
+		RateLimit:             10,
+		Retries:               0,
+		Timeout:               5,
+		Methods:               http.MethodGet,
+		Delay:                 -1,
+		StoreResponse:         true,
+		StoreResponseDir:      dir,
+		OmitBody:              true,
+		OutputMatchStatusCode: "200",
+		InputTargetHost:       []string{srv.URL},
+	}
+	require.NoError(t, options.ValidateOptions())
+
+	r, err := New(options)
+	require.NoError(t, err)
+	defer r.Close()
+	r.RunEnumeration()
+
+	files, err := filepath.Glob(filepath.Join(dir, "response", "*", "*.txt"))
+	require.NoError(t, err)
+	require.Len(t, files, 1)
+	stored, err := os.ReadFile(files[0])
+	require.NoError(t, err)
+	require.Contains(t, string(stored), "HTTP/1.1 200 OK")
+	require.NotContains(t, string(stored), body)
+}
+
 func TestProtocolValidation(t *testing.T) {
 	for _, proto := range []string{"", "http11", "http2", "http3", "HTTP11", "HTTP2", "HTTP3"} {
 		opts := &Options{Protocol: proto}