fix: handle encoded POC set values

webscan/lib/eval_misc.go

@@ -21,6 +21,10 @@ func registerMiscDeclarations() []*exprpb.Decl {
 			decls.NewOverload("tongda_date",
 				[]*exprpb.Type{},
 				decls.String)),
+		decls.NewFunction("timestamp_second",
+			decls.NewOverload("timestamp_second_zero",
+				[]*exprpb.Type{},
+				decls.Int)),
 	}
 }
 
@@ -47,5 +51,11 @@ func registerMiscImplementations() []*functions.Overload {
 				return types.String(time.Now().Format("0601"))
 			},
 		},
+		{
+			Operator: "timestamp_second_zero",
+			Function: func(value ...ref.Val) ref.Val {
+				return types.Int(time.Now().Unix())
+			},
+		},
 	}
 }

webscan/lib/eval_test.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/cel-go/common/types"
 )
@@ -1393,3 +1394,19 @@ func TestMakeVarDecl(t *testing.T) {
 		})
 	}
 }
+
+func TestTimestampSecond(t *testing.T) {
+	before := time.Now().Unix()
+	result, err := Evaluate(GetBaseEnv(), "timestamp_second()", map[string]interface{}{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok := result.Value().(int64)
+	if !ok {
+		t.Fatalf("timestamp_second() type = %T, want int64", result.Value())
+	}
+	after := time.Now().Unix()
+	if got < before || got > after {
+		t.Fatalf("timestamp_second() = %d, want [%d, %d]", got, before, after)
+	}
+}

webscan/lib/poc_executor.go

@@ -869,6 +869,10 @@ func cloneMap(tags map[string]string) map[string]string {
 
 // evalset 执行CEL表达式并处理特殊类型结果
 func evalset(env *cel.Env, variableMap map[string]interface{}, k string, expression string) (string, error) {
+	if isPlainLiteral(expression, variableMap) {
+		variableMap[k] = expression
+		return expression, nil
+	}
 	out, err := Evaluate(env, expression, variableMap)
 	if err != nil {
 		variableMap[k] = ""
@@ -915,6 +919,11 @@ func isPlainLiteral(expr string, variableMap map[string]interface{}) bool {
 	if _, exists := variableMap[expr]; exists {
 		return false
 	}
+	// Base64/JWT 常量常包含 +、/、= 或 .，这些字符在 CEL 中也是语法符号。
+	// 先识别编码值，避免把密钥和令牌误当成表达式编译。
+	if isEncodedLiteral(expr) {
+		return true
+	}
 	// 含 CEL 语法特征的需要走 CEL 编译
 	for _, c := range expr {
 		switch c {
@@ -925,6 +934,35 @@ func isPlainLiteral(expr string, variableMap map[string]interface{}) bool {
 	return true
 }
 
+func isEncodedLiteral(value string) bool {
+	if strings.Count(value, ".") == 2 {
+		parts := strings.Split(value, ".")
+		for _, part := range parts {
+			if part == "" || strings.IndexFunc(part, func(r rune) bool {
+				return !isASCIIAlphaNumeric(r) && r != '-' && r != '_'
+			}) >= 0 {
+				return false
+			}
+		}
+		return true
+	}
+
+	if len(value) < 4 || len(value)%4 != 0 {
+		return false
+	}
+	padding := strings.TrimRight(value, "=")
+	if len(value)-len(padding) > 2 {
+		return false
+	}
+	return strings.IndexFunc(padding, func(r rune) bool {
+		return !isASCIIAlphaNumeric(r) && r != '+' && r != '/'
+	}) < 0
+}
+
+func isASCIIAlphaNumeric(r rune) bool {
+	return r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9'
+}
+
 // CheckInfoPoc 检查POC信息并返回别名
 func CheckInfoPoc(infostr string) string {
 	for _, poc := range fingerprint.PocDatas {

webscan/lib/poc_executor_test.go

@@ -865,3 +865,33 @@ func TestCollectVarDeclarations(t *testing.T) {
 		}
 	})
 }
+
+func TestEvalSetTreatsEncodedValuesAsLiterals(t *testing.T) {
+	env := GetBaseEnv()
+	tests := []string{
+		"fsHspZw/92PrS3XrPW+vxw==",
+		"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyJ9.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ",
+	}
+
+	for _, value := range tests {
+		variables := map[string]interface{}{}
+		got, err := evalset(env, variables, "token", value)
+		if err != nil {
+			t.Fatalf("evalset(%q) error = %v", value, err)
+		}
+		if got != value || variables["token"] != value {
+			t.Fatalf("evalset(%q) = %q, stored %v", value, got, variables["token"])
+		}
+	}
+}
+
+func TestEvalSetStillEvaluatesExpressions(t *testing.T) {
+	variables := map[string]interface{}{}
+	got, err := evalset(GetBaseEnv(), variables, "token", "randomLowercase(6)")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 6 {
+		t.Fatalf("randomLowercase result length = %d, want 6", len(got))
+	}
+}

webscan/pocs/ecology-hrmcareerapplyperview-sqli.yaml

@@ -12,7 +12,7 @@ info:
   created: 2025/06/11
 
 set:
-  randstr: randLowercase(6)
+  randstr: randomLowercase(6)
 rules:
   r0:
     request: