Skip to content

Handle invalid JSON body payload sources#260

Open
marksmith wants to merge 2 commits intomainfrom
ignore-invalid-json-body-payload-sources
Open

Handle invalid JSON body payload sources#260
marksmith wants to merge 2 commits intomainfrom
ignore-invalid-json-body-payload-sources

Conversation

@marksmith
Copy link
Copy Markdown
Collaborator

@marksmith marksmith commented Mar 27, 2026

This change handles invalid JSON body payload sources, not extracting body payload sources if the JSON-encoded body could not be parsed. This prevents an ActionDispatch::Http::Parameters::ParseError from being raised and propagating, causing the Aikido::Zen::Middleware::RequestTracker and Aikido::Zen::Middleware::AttackWaveProtector middleware to fail after the application has already processed the request.

The susceptibility of other payload sources has been investigated and discussed internally.

Summary by Aikido

Security Issues: 0 Quality Issues: 0 Resolved Issues: 0

🔧 Refactors

  • Ignored invalid JSON body payload sources and added test coverage

More info

{
query: req.query_parameters,
body: req.request_parameters,
body: body,
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe safer to put the other calls also in the begin ... rescue block? (req.path_parameters, ...)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants