[liangzaihuanyv]

Summary

Preserve each Burp XML history item's explicit http/https protocol when deriving its target URL. This uses metadata already present in the existing XML match; it does not infer TLS from additional port numbers or change the supported XML matcher.

Problem

The Burp XML import path currently extracts the port and base64 request but drops <protocol>. An origin-form request with Host: example.test therefore imports an HTTPS item on port 8443 as http://example.test:8443/.... An explicit HTTP item on port 443 is likewise inferred as HTTPS.

A global --force-ssl works for an HTTPS-only import, but cannot preserve a history containing both HTTP and HTTPS items. This is distinct from a plain raw request file that has no transport metadata.

For example, the existing XML format can contain:

<items><item>
  <port>8443</port><protocol>https</protocol>
  <request base64="true"><![CDATA[R0VUIC8/aWQ9MSBIVFRQLzEuMQ0KSG9zdDogZXhhbXBsZS50ZXN0DQoNCg==]]></request>
</item></items>

The decoded request is GET /?id=1 HTTP/1.1 with Host: example.test. Its imported target should be https://example.test:8443/?id=1, not HTTP.

Changes

• Carry the recognized protocol and XML port alongside each decoded request.
• Fill missing scheme/port before the existing default inference and --force-ssl handling.
• Preserve explicit request-target/Host values and legacy behavior for missing or unrecognized protocol metadata.
• Add 16 regression/control tests for non-default ports, mixed histories, per-item context reset, precedence, scope, data/header/cookie retention, and the real log-import consumer.

No change to plain Burp/WebScarab logs, the XML matcher, or other target sources is intended.

Validation

On Windows, CPython 3.12.10, using stdlib unittest with an external runner that denies socket/DNS calls:

• Same 16 added tests on the unmodified production baseline: 9 assertion failures, 7 passes, no setup errors or skips.
• With this change, 469 tests passed across test_common, test_option, test_targeturl, and test_target_parsing (the 16 new tests are included, not additional).
• Additional offline checks used real _setMultipleTargets / _setRequestFromFile -> parseTargetUrl with mixed HTTP/HTTPS metadata and with/without --force-ssl; no target requests or core stubs were used.
• Pyflakes on the two changed files, git diff --check, and static Python 3.8 / compatible-grammar parsing passed.

This is focused local validation, not the full suite or the upstream OS/Python matrix. Python 2.7/PyPy, Python 3.8/3.14, live-target, DBMS, smoke, vulnerability and API tests were not run locally. No claim of a demonstrated injection finding or security vulnerability is made.

Contribution note

The implementation and tests were prepared with AI assistance, including a separate review of the scoped changes and test evidence.

[stamparm]

thank you for the report. i needed to do some adjustments on our own