Update to latest QA tests (v1.0.5)

.github/workflows/qa-tests.yml

@@ -49,7 +49,7 @@ jobs:
           cp firewall-node/.github/workflows/Dockerfile.qa zen-demo-nodejs/Dockerfile
 
       - name: Run Firewall QA Tests
-        uses: AikidoSec/firewall-tester-action@releases/v1
+        uses: AikidoSec/firewall-tester-action@v1.0.4
         with:
           dockerfile_path: ./zen-demo-nodejs/Dockerfile
           app_port: 3000

library/sources/http-server/checkIfRequestIsBlocked.ts

@@ -40,6 +40,14 @@ export function checkIfRequestIsBlocked(
   // Also ensures that the statistics are only counted once
   res[checkedBlocks] = true;
 
+  const isBypassedIP =
+    context.remoteAddress &&
+    agent.getConfig().isBypassedIP(context.remoteAddress);
+
+  if (isBypassedIP) {
+    return false;
+  }
+
   if (!ipAllowedToAccessRoute(context, agent)) {
     res.statusCode = 403;
     res.setHeader("Content-Type", "text/plain");
@@ -54,14 +62,6 @@ export function checkIfRequestIsBlocked(
     return true;
   }
 
-  const isBypassedIP =
-    context.remoteAddress &&
-    agent.getConfig().isBypassedIP(context.remoteAddress);
-
-  if (isBypassedIP) {
-    return false;
-  }
-
   if (
     context.remoteAddress &&
     !agent.getConfig().isAllowedIPAddress(context.remoteAddress).allowed

library/vulnerabilities/ssrf/inspectDNSLookupCalls.ts

@@ -183,6 +183,17 @@ function wrapDNSLookupCallback(
       }
     }
 
+    const isBypassedIP =
+      context &&
+      context.remoteAddress &&
+      agent.getConfig().isBypassedIP(context.remoteAddress);
+
+    if (isBypassedIP) {
+      // If the IP address is allowed, we don't need to block the request
+      // Just call the original callback to allow the DNS lookup
+      return callback(err, addresses, family);
+    }
+
     if (!found) {
       if (imdsIpResult.isIMDS) {
         // Stored SSRF attack executed during another request (context set)
@@ -211,17 +222,6 @@ function wrapDNSLookupCallback(
       return callback(err, addresses, family);
     }
 
-    const isBypassedIP =
-      context &&
-      context.remoteAddress &&
-      agent.getConfig().isBypassedIP(context.remoteAddress);
-
-    if (isBypassedIP) {
-      // If the IP address is allowed, we don't need to block the request
-      // Just call the original callback to allow the DNS lookup
-      return callback(err, addresses, family);
-    }
-
     // Used to get the stack trace of the calling location
     // We don't throw the error, we just use it to get the stack trace
     const stackTraceError = callingLocationStackTrace || new Error();