fix(http): isolate project cache entries by URL scheme (http vs https)

[usernametooshort]

Summary

Fixes #6866 — the project cache (-project) serves HTTPS responses for HTTP requests because cache keys do not include the URL scheme.

Root Cause

dump() calls req.request.Clone().Dump() which produces raw HTTP/1.1 request bytes:

GET / HTTP/1.1
Host: example.com
...

The scheme (http:// vs https://) is NOT included. So ProjectFile.Get() hashes the dump and gets the same key for both http://example.com and https://example.com.

Fix

Prefix the dumped bytes with the full URL (including scheme) before returning from dump(). This makes the hash include the scheme, producing distinct cache entries.

Behaviour

• Before: http://example.com with -project returns cached https://example.com response — false positive
• After: separate cache entries per scheme, no cross-contamination

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No security issues found

Highlights

• Adds URL scheme (http:// vs https://) to project cache keys to prevent cross-scheme cache collisions
• Improves template cleanup with orphaned file removal and metadata regeneration
• Maintains existing path traversal protections in installer code

Hardening Notes

• The cache fix only applies to standard HTTP requests (req.request != nil). Raw requests using the rawRequest path call rawhttp.DumpRequestRaw with reqURL parameter but don't explicitly prepend the scheme. This may be intentional if DumpRequestRaw includes the full URL in its output, but should be verified through integration testing.
• The installer code maintains secure path handling with filepath.Clean() normalization and prefix validation to prevent path traversal (lines 297-299, 436, 449, 460, 485 in template.go).

_{Comment @pdneo help for available commands. · Open in Neo}