fix: harden scan edge cases

webscan/lib/Eval.go

@@ -422,8 +422,19 @@ func RandomStr(randSource *rand.Rand, letterBytes string, n int) string {
 func DoRequest(req *http.Request, redirect bool) (*Response, error) {
 	// 处理请求头
 	if req.Body != nil && req.Body != http.NoBody {
+		body, err := io.ReadAll(req.Body)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", i18n.GetText("webscan_request_body_read_failed"), err)
+		}
+		_ = req.Body.Close()
+		req.Body = io.NopCloser(bytes.NewReader(body))
+		req.GetBody = func() (io.ReadCloser, error) {
+			return io.NopCloser(bytes.NewReader(body)), nil
+		}
+		req.ContentLength = int64(len(body))
+
 		// 设置 Content-Length
-		req.Header.Set("Content-Length", strconv.Itoa(int(req.ContentLength)))
+		req.Header.Set("Content-Length", strconv.FormatInt(req.ContentLength, 10))
 
 		// 如果未指定 Content-Type，设置默认值
 		if req.Header.Get("Content-Type") == "" {
@@ -451,6 +462,11 @@ func DoRequest(req *http.Request, redirect bool) (*Response, error) {
 
 	// 标准TLS连接失败时，尝试国密TLS客户端
 	if err != nil && req.URL.Scheme == "https" {
+		if req.GetBody != nil {
+			if body, bodyErr := req.GetBody(); bodyErr == nil {
+				req.Body = body
+			}
+		}
 		if redirect {
 			if oResp2, err2 := ClientGM.Do(req); err2 == nil {
 				oResp, err = oResp2, nil

webscan/lib/eval_test.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -11,6 +12,12 @@ import (
 	"github.com/google/cel-go/common/types"
 )
 
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
 // =============================================================================
 // eval_encoding.go 测试 - 编码解码函数
 // =============================================================================
@@ -1070,6 +1077,84 @@ func TestGetRespBody(t *testing.T) {
 	}
 }
 
+func TestDoRequestBuffersUnknownLengthBody(t *testing.T) {
+	previous := ClientNoRedirect
+	defer func() { ClientNoRedirect = previous }()
+
+	var gotContentLength string
+	var gotBody string
+	ClientNoRedirect = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		gotContentLength = req.Header.Get("Content-Length")
+		body, err := io.ReadAll(req.Body)
+		if err != nil {
+			return nil, err
+		}
+		gotBody = string(body)
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader("ok")),
+			Request:    req,
+		}, nil
+	})}
+
+	req, err := http.NewRequest(http.MethodPost, "http://example.com", io.NopCloser(strings.NewReader("abc")))
+	if err != nil {
+		t.Fatalf("NewRequest error = %v", err)
+	}
+	req.ContentLength = -1
+
+	if _, err := DoRequest(req, false); err != nil {
+		t.Fatalf("DoRequest error = %v", err)
+	}
+	if gotContentLength != "3" {
+		t.Fatalf("Content-Length = %q, want 3", gotContentLength)
+	}
+	if gotBody != "abc" {
+		t.Fatalf("body = %q, want abc", gotBody)
+	}
+}
+
+func TestDoRequestReplaysBodyForGMTLSFallback(t *testing.T) {
+	previousNR, previousGM := ClientNoRedirect, ClientNoRedirectGM
+	defer func() {
+		ClientNoRedirect = previousNR
+		ClientNoRedirectGM = previousGM
+	}()
+
+	ClientNoRedirect = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		_, _ = io.ReadAll(req.Body)
+		return nil, errors.New("standard tls failed")
+	})}
+
+	var gotBody string
+	ClientNoRedirectGM = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		body, err := io.ReadAll(req.Body)
+		if err != nil {
+			return nil, err
+		}
+		gotBody = string(body)
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader("ok")),
+			Request:    req,
+		}, nil
+	})}
+
+	req, err := http.NewRequest(http.MethodPost, "https://example.com", strings.NewReader("payload"))
+	if err != nil {
+		t.Fatalf("NewRequest error = %v", err)
+	}
+
+	if _, err := DoRequest(req, false); err != nil {
+		t.Fatalf("DoRequest error = %v", err)
+	}
+	if gotBody != "payload" {
+		t.Fatalf("fallback body = %q, want payload", gotBody)
+	}
+}
+
 func TestRandomStr(t *testing.T) {
 	tests := []struct {
 		name       string