[GH-ISSUE #2857] [Feature] Derive API surfaces from retained Fiddler SAZ captures #1016

New issue

Open

opened 2026-10-15 18:30:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:30:22 +00:00

Owner

Originally created by @zhangguiping-xydt on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2857

Before submitting

I searched open and closed issues and pull requests for a related proposal.
I understand the contribution scope must be reviewed before integration.
This request contains no credentials, private samples, or sensitive target data.

Area

Evidence, artifacts, or reconstruction — offline web capture analysis.

Current limitation

REA can inspect native Fiddler SAZ archives, and can derive an API surface from HAR Evidence, but the two capabilities do not compose for SAZ. An analyst with an existing SAZ must read individual sessions or convert it to HAR outside REA before asking which endpoints, methods, response statuses, and content types appear in the capture.

Observed on main 94072364c: the compiled CLI successfully inspects the repository-documented public Clearinet Encodings.saz corpus (9 sessions). Passing that resulting Evidence to inspect-analysis-view with view: {"kind":"api-surface"} returns unsupported_target with api-surface does not support capture format saz.

Desired outcome and success criteria

Extend the existing api-surface view to retained and portable SAZ Evidence:

Group recorded absolute request URLs by method, origin and the existing conservative path-template rules.
Include reported response status codes and MIME type essences; leave missing, malformed or ambiguous response facts unknown.
Preserve parent Evidence identity, record ordinals, capture limitations, pagination, exclusions and inferred-template classification.
Work after the selected archive has been removed, without decoding it again.
Keep the current refusal for unretained explicit sensitive-value declarations.

This is a new supported input format for the existing view, not a report that SAZ reading itself is broken.

Expected interaction with targets

Read existing files or captured data. Initial capture inspection uses the existing bounded local decoder process and private temporary workspace. The new view itself reads retained Evidence only; it launches no process, reopens no archive, contacts no service and replays no requests.

Target and scope details

Use the already supported raw HTTP/XML SAZ profile. Read the producer's parsed request method/URL, textual response status, and ordered response headers. Do not parse raw HTTP/body/XML bytes again. Retain the shared projection budget and existing grouping rules.

Only recorded absolute URLs establish an origin. Origin-form paths, CONNECT authority targets and asterisk targets remain explicitly excluded; do not invent a scheme from Host or session metadata. Multiple Content-Type declarations remain unknown rather than selecting one silently. No native mitmproxy or qlog API-surface support, schema inference, endpoint replay, new tool, or new provider is proposed.

Verification available so far

I have observed results through the built CLI on main.

Verification details

The baseline invocation is:

rea inspect-web-network-capture /absolute/path/Encodings.saz saz --format json
rea inspect-analysis-view /absolute/path/view-request.json --format json

The second request contains the complete first Evidence as source: {"kind":"inline","evidence": ...} and view: {"kind":"api-surface"}.

Planned verification: focused SAZ interpretation and unchanged HAR regressions; compiled CLI and stdio MCP using recorded public SAZ data; independent ZIP/HTTP aggregation for expected facts; retained/portable views after source removal; malformed/duplicate Content-Type, absent responses, unsupported request targets, sensitive-value refusal and existing resource-budget coverage. Preserve the original archive hash.

Alternatives considered

Export SAZ to HAR in Fiddler: adds another tool/workflow and loses the direct link to the selected archive's member coordinates.
Read every retained session: already possible, but duplicates the aggregation the HAR view provides.

References

Existing HAR API-surface view: #1891.
Native SAZ inspection: #2409.
Existing documented public sample: github.com/ericlaw1979/Clearinet@b6faf78cde/Test/data/Encodings.saz.

Originally created by @zhangguiping-xydt on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2857 ### Before submitting - [x] I searched open and closed issues and pull requests for a related proposal. - [x] I understand the contribution scope must be reviewed before integration. - [x] This request contains no credentials, private samples, or sensitive target data. ### Area Evidence, artifacts, or reconstruction — offline web capture analysis. ### Current limitation REA can inspect native Fiddler SAZ archives, and can derive an API surface from HAR Evidence, but the two capabilities do not compose for SAZ. An analyst with an existing SAZ must read individual sessions or convert it to HAR outside REA before asking which endpoints, methods, response statuses, and content types appear in the capture. Observed on main `94072364c`: the compiled CLI successfully inspects the repository-documented public Clearinet `Encodings.saz` corpus (9 sessions). Passing that resulting Evidence to `inspect-analysis-view` with `view: {"kind":"api-surface"}` returns `unsupported_target` with `api-surface does not support capture format saz.` ### Desired outcome and success criteria Extend the existing `api-surface` view to retained and portable SAZ Evidence: - Group recorded absolute request URLs by method, origin and the existing conservative path-template rules. - Include reported response status codes and MIME type essences; leave missing, malformed or ambiguous response facts unknown. - Preserve parent Evidence identity, record ordinals, capture limitations, pagination, exclusions and inferred-template classification. - Work after the selected archive has been removed, without decoding it again. - Keep the current refusal for unretained explicit sensitive-value declarations. This is a new supported input format for the existing view, not a report that SAZ reading itself is broken. ### Expected interaction with targets Read existing files or captured data. Initial capture inspection uses the existing bounded local decoder process and private temporary workspace. The new view itself reads retained Evidence only; it launches no process, reopens no archive, contacts no service and replays no requests. ### Target and scope details Use the already supported raw HTTP/XML SAZ profile. Read the producer's parsed request method/URL, textual response status, and ordered response headers. Do not parse raw HTTP/body/XML bytes again. Retain the shared projection budget and existing grouping rules. Only recorded absolute URLs establish an origin. Origin-form paths, CONNECT authority targets and asterisk targets remain explicitly excluded; do not invent a scheme from Host or session metadata. Multiple Content-Type declarations remain unknown rather than selecting one silently. No native mitmproxy or qlog API-surface support, schema inference, endpoint replay, new tool, or new provider is proposed. ### Verification available so far I have observed results through the built CLI on main. ### Verification details The baseline invocation is: ```sh rea inspect-web-network-capture /absolute/path/Encodings.saz saz --format json rea inspect-analysis-view /absolute/path/view-request.json --format json ``` The second request contains the complete first Evidence as `source: {"kind":"inline","evidence": ...}` and `view: {"kind":"api-surface"}`. Planned verification: focused SAZ interpretation and unchanged HAR regressions; compiled CLI and stdio MCP using recorded public SAZ data; independent ZIP/HTTP aggregation for expected facts; retained/portable views after source removal; malformed/duplicate Content-Type, absent responses, unsupported request targets, sensitive-value refusal and existing resource-budget coverage. Preserve the original archive hash. ### Alternatives considered - Export SAZ to HAR in Fiddler: adds another tool/workflow and loses the direct link to the selected archive's member coordinates. - Read every retained session: already possible, but duplicates the aggregation the HAR view provides. ### References - Existing HAR API-surface view: #1891. - Native SAZ inspection: #2409. - Existing documented public sample: https://github.com/ericlaw1979/Clearinet/blob/b6faf78cde1e72042980364f180ceb34b77d1434/Test/data/Encodings.saz.

bsakaguchi added the

area: runtime

enhancement

labels

2026-10-15 18:30:22 +00:00

bsakaguchi referenced this issue

2026-10-17 21:07:51 +00:00

[PR #1016] [MERGED] fix(ci): avoid slow Azure archive for the native cross compiler #2583

bsakaguchi referenced this issue

2026-10-17 21:07:58 +00:00

[PR #1030] [MERGED] feat(ghidra): support native x86 PE applications on Windows #2594

bsakaguchi added