Skip to content

Commit ee4617b

Browse files
hansotthansott
authored
Merge pull request #630 from AikidoSec/fix-protect-wrappers
Add missing AwsSDKVersion2 import
2 parents e4986e3 + c694754 commit ee4617b

File tree

5 files changed

+107
-26
lines changed

5 files changed

+107
-26
lines changed

‎library/agent/protect.test.ts‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
import { readdir, readFile } from "fs/promises";
2+
import { join } from "path";
3+
import * as t from "tap";
4+
5+
t.test("check that all sources and sinks are imported", async (t) => {
6+
// -----
7+
8+
const skipCheckList = [
9+
"Function", // Function sink is disabled for now because functionName.constructor === Function is false after patching global
10+
];
11+
12+
const noWrapperAllowList = ["Lambda"];
13+
14+
// -----
15+
16+
const sourceText = await readFile(join(__dirname, "protect.ts"), "utf-8");
17+
const importDeclarations =
18+
sourceText.match(/import\s+(?:[^'"]|\n)+?\s+from\s+['"][^'"]+['"]/g) || [];
19+
20+
const getWrappersFunctionContent =
21+
sourceText
22+
.match(/export function getWrappers\(\)\s*\{([\s\S]*?)^\}/m)?.[1]
23+
?.trim() ?? "";
24+
25+
const allSourceFiles = await readdir(join(__dirname, "../sources"), {
26+
withFileTypes: true,
27+
});
28+
29+
const allSinkFiles = await readdir(join(__dirname, "../sinks"), {
30+
withFileTypes: true,
31+
});
32+
33+
const allFiles = [...allSourceFiles, ...allSinkFiles]
34+
.filter(
35+
(file) =>
36+
file.isFile() &&
37+
file.name.endsWith(".ts") &&
38+
!file.name.endsWith(".test.ts") &&
39+
!file.name.endsWith(".tests.ts")
40+
)
41+
.map((file) => file.name.replace(/\.ts$/, ""));
42+
43+
for (const file of allFiles) {
44+
if (skipCheckList.includes(file)) {
45+
t.comment(`Skipping ${file} as it is in the allowlist.`);
46+
continue;
47+
}
48+
49+
const importDeclaration = importDeclarations.find(
50+
(declaration) =>
51+
declaration.includes(`"../sources/${file}"`) ||
52+
declaration.includes(`"../sinks/${file}"`)
53+
);
54+
55+
t.ok(
56+
importDeclaration,
57+
`Import for ${file} is missing in protect.ts: ${importDeclaration}`
58+
);
59+
60+
if (noWrapperAllowList.includes(file)) {
61+
t.comment(
62+
`Skipping getWrappers check for ${file} as it is in the noWrapperAllowList.`
63+
);
64+
continue;
65+
}
66+
67+
const includesInGetWrappers = getWrappersFunctionContent.includes(
68+
`new ${file}()`
69+
);
70+
t.ok(
71+
includesInGetWrappers,
72+
`getWrappers function does not include ${file} in its return value`
73+
);
74+
}
75+
});

‎library/agent/protect.ts‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ import { SQLite3 } from "../sinks/SQLite3";
3939
import { XmlMinusJs } from "../sources/XmlMinusJs";
4040
import { Hapi } from "../sources/Hapi";
4141
import { Shelljs } from "../sinks/Shelljs";
42-
import { NodeSQLite } from "../sinks/NodeSqlite";
42+
import { NodeSQLite } from "../sinks/NodeSQLite";
4343
import { BetterSQLite3 } from "../sinks/BetterSQLite3";
4444
import { isDebugging } from "../helpers/isDebugging";
4545
import { shouldBlock } from "../helpers/shouldBlock";
@@ -48,6 +48,7 @@ import { Fastify } from "../sources/Fastify";
4848
import { Koa } from "../sources/Koa";
4949
import { ClickHouse } from "../sinks/ClickHouse";
5050
import { Prisma } from "../sinks/Prisma";
51+
import { AwsSDKVersion2 } from "../sinks/AwsSDKVersion2";
5152

5253
function getLogger(): Logger {
5354
if (isDebugging()) {
@@ -141,6 +142,7 @@ export function getWrappers() {
141142
new ClickHouse(),
142143
new Prisma(),
143144
// new Function(), Disabled because functionName.constructor === Function is false after patching global
145+
new AwsSDKVersion2(),
144146
];
145147
}
146148

‎library/sinks/NodeSQLite.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import * as t from "tap";
22
import { runWithContext, type Context } from "../agent/Context";
3-
import { NodeSQLite } from "./NodeSqlite";
3+
import { NodeSQLite } from "./NodeSQLite";
44
import { isPackageInstalled } from "../helpers/isPackageInstalled";
55
import { createTestAgent } from "../helpers/createTestAgent";
66

library/sinks/NodeSqlite.ts renamed to library/sinks/NodeSQLite.ts

File renamed without changes.

‎library/sinks/Undici.tests.ts‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -108,99 +108,103 @@ export function createUndiciTests(undiciPkgName: string, port: number) {
108108
Agent: UndiciAgent,
109109
} = require(undiciPkgName) as typeof import("undici-v6");
110110

111-
await request("https://app.aikido.dev");
111+
await request("https://ssrf-redirects.testssandbox.com");
112112
t.same(agent.getHostnames().asArray(), [
113-
{ hostname: "app.aikido.dev", port: 443, hits: 1 },
113+
{ hostname: "ssrf-redirects.testssandbox.com", port: 443, hits: 1 },
114114
]);
115115
agent.getHostnames().clear();
116116

117-
await fetch("https://app.aikido.dev");
117+
await fetch("https://ssrf-redirects.testssandbox.com");
118118
t.same(agent.getHostnames().asArray(), [
119-
{ hostname: "app.aikido.dev", port: 443, hits: 1 },
119+
{ hostname: "ssrf-redirects.testssandbox.com", port: 443, hits: 1 },
120120
]);
121121
agent.getHostnames().clear();
122122

123123
await request({
124124
protocol: "https:",
125-
hostname: "app.aikido.dev",
125+
hostname: "ssrf-redirects.testssandbox.com",
126126
port: 443,
127127
});
128128
t.same(agent.getHostnames().asArray(), [
129-
{ hostname: "app.aikido.dev", port: 443, hits: 1 },
129+
{ hostname: "ssrf-redirects.testssandbox.com", port: 443, hits: 1 },
130130
]);
131131
agent.getHostnames().clear();
132132

133133
await request({
134134
protocol: "https:",
135-
hostname: "app.aikido.dev",
135+
hostname: "ssrf-redirects.testssandbox.com",
136136
port: "443",
137137
});
138138
t.same(agent.getHostnames().asArray(), [
139-
{ hostname: "app.aikido.dev", port: "443", hits: 1 },
139+
{ hostname: "ssrf-redirects.testssandbox.com", port: "443", hits: 1 },
140140
]);
141141
agent.getHostnames().clear();
142142

143143
await request({
144144
protocol: "https:",
145-
hostname: "app.aikido.dev",
145+
hostname: "ssrf-redirects.testssandbox.com",
146146
port: undefined,
147147
});
148148
t.same(agent.getHostnames().asArray(), [
149-
{ hostname: "app.aikido.dev", port: 443, hits: 1 },
149+
{ hostname: "ssrf-redirects.testssandbox.com", port: 443, hits: 1 },
150150
]);
151151
agent.getHostnames().clear();
152152

153153
await request({
154154
protocol: "http:",
155-
hostname: "app.aikido.dev",
155+
hostname: "ssrf-redirects.testssandbox.com",
156156
port: undefined,
157157
});
158158
t.same(agent.getHostnames().asArray(), [
159-
{ hostname: "app.aikido.dev", port: 80, hits: 1 },
159+
{ hostname: "ssrf-redirects.testssandbox.com", port: 80, hits: 1 },
160160
]);
161161
agent.getHostnames().clear();
162162

163163
await request({
164164
protocol: "https:",
165-
hostname: "app.aikido.dev",
165+
hostname: "ssrf-redirects.testssandbox.com",
166166
port: "443",
167167
});
168168
t.same(agent.getHostnames().asArray(), [
169-
{ hostname: "app.aikido.dev", port: "443", hits: 1 },
169+
{ hostname: "ssrf-redirects.testssandbox.com", port: "443", hits: 1 },
170170
]);
171171
agent.getHostnames().clear();
172172

173-
await request(new URL("https://app.aikido.dev"));
173+
await request(new URL("https://ssrf-redirects.testssandbox.com"));
174174
t.same(agent.getHostnames().asArray(), [
175-
{ hostname: "app.aikido.dev", port: 443, hits: 1 },
175+
{ hostname: "ssrf-redirects.testssandbox.com", port: 443, hits: 1 },
176176
]);
177177
agent.getHostnames().clear();
178178

179-
await request(require("url").parse("https://app.aikido.dev"));
179+
await request(
180+
require("url").parse("https://ssrf-redirects.testssandbox.com")
181+
);
180182
t.same(agent.getHostnames().asArray(), [
181-
{ hostname: "app.aikido.dev", port: "443", hits: 1 },
183+
{ hostname: "ssrf-redirects.testssandbox.com", port: "443", hits: 1 },
182184
]);
183185
agent.getHostnames().clear();
184186

185187
await request({
186-
origin: "https://app.aikido.dev",
188+
origin: "https://ssrf-redirects.testssandbox.com",
187189
} as URL);
188190
t.same(agent.getHostnames().asArray(), [
189-
{ hostname: "app.aikido.dev", port: "443", hits: 1 },
191+
{ hostname: "ssrf-redirects.testssandbox.com", port: "443", hits: 1 },
190192
]);
191193
agent.getHostnames().clear();
192194

193-
await request(require("url").parse("https://app.aikido.dev"));
195+
await request(
196+
require("url").parse("https://ssrf-redirects.testssandbox.com")
197+
);
194198
t.same(agent.getHostnames().asArray(), [
195-
{ hostname: "app.aikido.dev", port: "443", hits: 1 },
199+
{ hostname: "ssrf-redirects.testssandbox.com", port: "443", hits: 1 },
196200
]);
197201
agent.getHostnames().clear();
198202

199203
await request({
200-
origin: "https://app.aikido.dev",
204+
origin: "https://ssrf-redirects.testssandbox.com",
201205
} as URL);
202206
t.same(agent.getHostnames().asArray(), [
203-
{ hostname: "app.aikido.dev", port: "443", hits: 1 },
207+
{ hostname: "ssrf-redirects.testssandbox.com", port: "443", hits: 1 },
204208
]);
205209
agent.getHostnames().clear();
206210

0 commit comments

Comments
 (0)