module

Xssmaze::Store

Central registry for the state the stored mazes accumulate.

Stored mazes are the one part of the lab that remembers a scanner run, and they used to remember it forever: a second run read the first run's payloads back out and reported them as its own finding, two tools pointed at one instance contaminated each other, and a long fuzz grew the process without bound. Every collection is capped and reachable by name from here, so a harness can wipe the lab between runs (POST /reset) instead of restarting it.

The vulnerabilities themselves are untouched — the cap and the reset are the only new behaviour.

Constants

MAX_ENTRIES = 20

How many entries a bounded collection keeps. Deep enough that a scanner posting a handful of payloads still watches a list build up, shallow enough that a fuzzer cannot grow the process.

Class methods

group(name : String) : Group
Source
json_no_store(env) : Nil

Same headers as Xssmaze::Server.json_no_store, spelled out rather than called: the store is required before the server and has no business reaching up into the HTTP layer for three header assignments.

Source
list(name : String) : List

Register-or-fetch. Maze files call these at require time, so every collection shows up in sizes before the first request rather than appearing halfway through a run.

Source
names
Source
reset(name : String) : Int32 | Nil

Clears one collection and reports how many entries went away, or nil when nothing is registered under that name — the route answers 400 for that.

Source
reset_all
Source
single(name : String) : Single
Source
sizes
Source
total
Source

Nested types