From 4d1a2c422182240369750649b4c2d934d2346d6c Mon Sep 17 00:00:00 2001
From: anant <170962632+antcybersec@users.noreply.github.com>
Date: Mon, 2 Nov 2026 17:48:10 +0530
Subject: [PATCH] fix(runner): keep the full Location header with -location

---
 runner/location_test.go | 56 +++++++++++++++++++++++++++++++++++++++++
 runner/runner.go        |  6 ++---
 2 files changed, 59 insertions(+), 3 deletions(-)
 create mode 100644 runner/location_test.go

diff --git a/runner/location_test.go b/runner/location_test.go
new file mode 100644
index 00000000..8a20df84
--- /dev/null
+++ b/runner/location_test.go
@@ -0,0 +1,56 @@
+package runner
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// -location used to keep only the part of the header before the first ";".
+func TestLocationKeepsSemicolons(t *testing.T) {
+	const location = "/app/login;jsessionid=ABC123?next=/home"
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Location", location)
+		w.WriteHeader(http.StatusFound)
+	}))
+	t.Cleanup(srv.Close)
+
+	var (
+		mu      sync.Mutex
+		results []Result
+	)
+	options := &Options{
+		Threads:   1,
+		RateLimit: 10,
+		Retries:   0,
+		Timeout:   5,
+		Methods:   http.MethodGet,
+		Delay:     -1,
+		Location:  true,
+		NoColor:   true,
+		OnResult: func(r Result) {
+			if r.Err != nil || r.URL == "" {
+				return
+			}
+			mu.Lock()
+			results = append(results, r)
+			mu.Unlock()
+		},
+		InputTargetHost: []string{srv.URL},
+	}
+
+	r, err := New(options)
+	require.NoError(t, err)
+	defer r.Close()
+	r.RunEnumeration()
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	require.Len(t, results, 1)
+	require.Equal(t, location, results[0].Location)
+	require.Contains(t, results[0].str, "["+location+"]")
+}
diff --git a/runner/runner.go b/runner/runner.go
index 96f7e8c0..d8f8819a 100644
--- a/runner/runner.go
+++ b/runner/runner.go
@@ -2189,9 +2189,9 @@ retry:
 	if scanopts.OutputLocation {
 		builder.WriteString(" [")
 		if !scanopts.OutputWithNoColor {
-			builder.WriteString(aurora.Magenta(resp.GetHeaderPart("Location", ";")).String())
+			builder.WriteString(aurora.Magenta(resp.GetHeader("Location")).String())
 		} else {
-			builder.WriteString(resp.GetHeaderPart("Location", ";"))
+			builder.WriteString(resp.GetHeader("Location"))
 		}
 		builder.WriteRune(']')
 	}
@@ -2781,7 +2781,7 @@ retry:
 		ChainStatusCodes: chainStatusCodes,
 		Chain:            chainItems,
 		StatusCode:       resp.StatusCode,
-		Location:         resp.GetHeaderPart("Location", ";"),
+		Location:         resp.GetHeader("Location"),
 		ContentType:      resp.GetHeaderPart("Content-Type", ";"),
 		Title:            title,
 		str:              builder.String(),