Merge pull request #210 from AikidoSec/composer-packages

Added support for extracting composer packages from composer.lock

Author: tudor-timcu

lib/php-extension/Packages.cpp

@@ -1,6 +1,6 @@
 #include "Includes.h"
 
-std::string GetPackageVersion(const std::string& packageName) {
+std::string GetPhpPackageVersion(const std::string& packageName) {
     zval return_value;
     CallPhpFunctionWithOneParam("phpversion", packageName, &return_value);
     if (Z_TYPE(return_value) == IS_STRING) {
@@ -9,7 +9,7 @@ std::string GetPackageVersion(const std::string& packageName) {
     return "";
 }
 
-unordered_map<std::string, std::string> GetPackages() {
+unordered_map<std::string, std::string> GetPhpPackages() {
     unordered_map<std::string, std::string> packages;
 
     zval extensions_array;
@@ -27,11 +27,67 @@ unordered_map<std::string, std::string> GetPackages() {
 
     ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(extensions_array), index, key, extension) {
         if (extension && Z_TYPE_P(extension) == IS_STRING) {
-            packages[Z_STRVAL_P(extension)] = GetPackageVersion(Z_STRVAL_P(extension));
-            AIKIDO_LOG_INFO("Found package %s version %s\n", Z_STRVAL_P(extension), packages[Z_STRVAL_P(extension)].c_str());
+            packages[Z_STRVAL_P(extension)] = GetPhpPackageVersion(Z_STRVAL_P(extension));
         }
     } ZEND_HASH_FOREACH_END();
 
     zval_ptr_dtor(&extensions_array);
+    return packages;
+}
+
+std::string GetComposerPackageVersion(const std::string& version) {
+    if (version.empty()) {
+        return version;
+    }
+    
+    if (version[0] == 'v') {
+        return version.substr(1);
+    }
+    
+    return version;
+}
+
+unordered_map<std::string, std::string> GetComposerPackages() {
+    unordered_map<std::string, std::string> packages;
+
+    std::string docRoot = server.GetVar("DOCUMENT_ROOT");
+    if (docRoot.empty()) {
+        return packages;
+    }
+    std::string composerLockPath = docRoot + "/../composer.lock";
+
+    std::ifstream composerLockFile(composerLockPath);
+    if (!composerLockFile.is_open()) {
+        return packages;
+    }
+
+    try {
+        json composerLockData = json::parse(composerLockFile);
+        if (!composerLockData.contains("packages")) {
+            return packages;
+        }
+
+        const auto& composerLockPackages = composerLockData["packages"];
+
+        for (const auto& composerLockPackage : composerLockPackages) {
+            if (!composerLockPackage.contains("name") || !composerLockPackage.contains("version")) {
+                continue;
+            }
+            packages[composerLockPackage["name"]] = GetComposerPackageVersion(composerLockPackage["version"]);
+        }
+    } catch (const std::exception& e) {
+        AIKIDO_LOG_ERROR("Error parsing composer.lock: %s\n", e.what());
+        return packages;
+    }
+
+    return packages;
+}
+
+unordered_map<std::string, std::string> GetPackages() {
+    unordered_map<std::string, std::string> packages = GetPhpPackages();
+    unordered_map<std::string, std::string> composerPackages = GetComposerPackages();
+
+    packages.insert(composerPackages.begin(), composerPackages.end());
+
     return packages;
 }

lib/request-processor/aikido_types/config.go

@@ -7,24 +7,24 @@ import (
 )
 
 type EnvironmentConfigData struct {
-	SocketPath                string            `json:"socket_path"`                  // '/run/aikido-{version}/aikido-{datetime}-{randint}.sock'
-	SAPI                      string            `json:"sapi"`                         // '{php-sapi}'
+	SocketPath                string `json:"socket_path"`                  // '/run/aikido-{version}/aikido-{datetime}-{randint}.sock'
+	SAPI                      string `json:"sapi"`                         // '{php-sapi}'
+	TrustProxy                bool   `json:"trust_proxy"`                  // default: true
+	LocalhostAllowedByDefault bool   `json:"localhost_allowed_by_default"` // default: true
+	CollectApiSchema          bool   `json:"collect_api_schema"`           // default: true
+}
+
+type AikidoConfigData struct {
+	Token                     string            `json:"token"`                        // default: ''
+	LogLevel                  string            `json:"log_level"`                    // default: 'WARN'
+	Blocking                  bool              `json:"blocking"`                     // default: false
 	TrustProxy                bool              `json:"trust_proxy"`                  // default: true
 	LocalhostAllowedByDefault bool              `json:"localhost_allowed_by_default"` // default: true
 	CollectApiSchema          bool              `json:"collect_api_schema"`           // default: true
+	DiskLogs                  bool              `json:"disk_logs"`                    // default: false
 	Packages                  map[string]string `json:"packages"`                     // default: {}
 }
 
-type AikidoConfigData struct {
-	Token                     string `json:"token"`                        // default: ''
-	LogLevel                  string `json:"log_level"`                    // default: 'WARN'
-	Blocking                  bool   `json:"blocking"`                     // default: false
-	TrustProxy                bool   `json:"trust_proxy"`                  // default: true
-	LocalhostAllowedByDefault bool   `json:"localhost_allowed_by_default"` // default: true
-	CollectApiSchema          bool   `json:"collect_api_schema"`           // default: true
-	DiskLogs                  bool   `json:"disk_logs"`                    // default: false
-}
-
 type RateLimiting struct {
 	Enabled        bool
 	MaxRequests    int

lib/request-processor/grpc/client.go

@@ -33,7 +33,6 @@ func Init() {
 	log.Debugf("Current connection state: %s\n", conn.GetState().String())
 
 	SendAikidoConfig()
-	OnPackages(globals.EnvironmentConfig.Packages)
 	startCloudConfigRoutine()
 }
 
@@ -62,6 +61,7 @@ func SendAikidoConfig() {
 	}
 
 	log.Debugf("Aikido config sent via socket!")
+	OnPackages(globals.AikidoConfig.Packages)
 }
 
 /* Send outgoing domain to Aikido Agent via gRPC */