fix: harden address parsing edge cases

webscan/lib/poc_executor.go

@@ -374,15 +374,17 @@ func optimizeCookies(rawCookie string) string {
 	var output strings.Builder
 
 	// 解析Cookie键值对
-	pairs := strings.Split(rawCookie, "; ")
+	pairs := strings.Split(rawCookie, ";")
 	for _, pair := range pairs {
+		pair = strings.TrimSpace(pair)
 		nameVal := strings.SplitN(pair, "=", 2)
 		if len(nameVal) < 2 {
 			continue
 		}
+		name := strings.TrimSpace(nameVal[0])
 
 		// 跳过Cookie属性
-		switch strings.ToLower(nameVal[0]) {
+		switch strings.ToLower(name) {
 		case "expires", "max-age", "path", "domain",
 			"version", "comment", "secure", "samesite", "httponly":
 			continue
@@ -392,9 +394,9 @@ func optimizeCookies(rawCookie string) string {
 		if output.Len() > 0 {
 			output.WriteString("; ")
 		}
-		output.WriteString(nameVal[0])
+		output.WriteString(name)
 		output.WriteString("=")
-		output.WriteString(strings.Join(nameVal[1:], "="))
+		output.WriteString(nameVal[1])
 	}
 
 	return output.String()

webscan/lib/poc_executor_test.go

@@ -181,6 +181,16 @@ func TestOptimizeCookies(t *testing.T) {
 			raw:  "sid=simple",
 			want: "sid=simple",
 		},
+		{
+			name: "分号后无空格",
+			raw:  "token=xyz;user=admin;Path=/app;HttpOnly",
+			want: "token=xyz; user=admin",
+		},
+		{
+			name: "键名周围空格",
+			raw:  " token =xyz; user =admin; Path =/",
+			want: "token=xyz; user=admin",
+		},
 		{
 			name: "空字符串",
 			raw:  "",