aikido-zen 0.1.0-arm64-linux → 0.1.1-arm64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a05b927790518de64cf697fe043ec22ccbe1b759905c02e9c60591c4761d78b
-  data.tar.gz: b185c54f7410fe10d296f3c5e76707e0cc9cc4884c41f06f6899f6b5ba53be43
+  metadata.gz: 31bd721c8bf4bee4a140897184340b717fe53b7df7cd48cf7d31fb32ee8a5710
+  data.tar.gz: cac854f8a57916caca2ed97c3090d552b5d6f812abd6cbd4f3f16354eccb8c2c
 SHA512:
-  metadata.gz: 00ff11282a036d8ea41a0c4cf3ef96f8f7f440249d648fe68d21710f5f33dbbd04380625ede4a9c8bd622d24c5b90c9c1f6d76a9121e0181e58f10af078307b5
-  data.tar.gz: bde69f052b425bac88e3efb6a932d68383bce5dc430b4606b3d05b442a7a00f1e4cc58330d4b8740784fa4410f55715d10b0f645db6851767f16a91e6e00a3d4
+  metadata.gz: b8434d5cb98769ab4446b91d346448fdd92e08fedb5f722b099484a2a8a03dccb4a7c27ef1f8e84770e5374c5124081d30c08d59198947fe93bf73e2aad7a64e
+  data.tar.gz: 5e67365f580302b3c98befe7bce01d72391ff363f6c5aa4ad2c5356bc9675f4308b87f70cf86e137a5aee6e914e258e76330902c0e207aac2329c2e081415622

data/.simplecov

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Due to dependency resolution, on Ruby 2.x we're stuck with a _very_ old
+# SimpleCov version, and it doesn't really give us any benefit to run coverage
+# in separate ruby versions since we don't branch on ruby version in the code.
+return if RUBY_VERSION < "3.0"
+
+SimpleCov.start do
+  # Make sure SimpleCov waits until after the tests
+  # are finished to generate the coverage reports.
+  self.external_at_exit = true
+
+  enable_coverage :branch
+  minimum_coverage line: 95, branch: 85
+
+  add_filter "/test/"
+end
+
+# vim: ft=ruby

data/CHANGELOG.md

@@ -2,4 +2,20 @@
 
 ## [Unreleased]
 
+## 0.1.1
+
+### Fixed
+
+- Avoid an error when sending the initial heartbeat if the Aikido server hasn't
+  received stats yet.
+- Fix the SSRF scanner to ensure the port in the user-supplied payload matches
+  the port in the request.
+- Don't break the HTTP.rb sink when a Zen context isn't set.
+- Don't break the Typhoeus sink when a Zen context isn't set.
+- Don't break the PG sink outside of Rails.
+- Updated [libzen](https://github.com/AikidoSec/zen-internals) to v0.1.31 to
+  prevent flagging false positives in SQL queries with comments.
+
+## 0.1.0
+
 - Initial version

data/lib/aikido/zen/agent.rb

@@ -65,7 +65,9 @@ module Aikido::Zen
 
       poll_for_setting_updates
 
-      @worker.delay(@config.initial_heartbeat_delay) { send_heartbeat if stats.any? }
+      @worker.delay(@config.initial_heartbeat_delay) do
+        send_heartbeat if @collector.stats.any?
+      end
     end
 
     # Clean up any ongoing threads, and reset the state. Called automatically

data/lib/aikido/zen/internals.rb

@@ -31,6 +31,8 @@ module Aikido::Zen
       attach_function :detect_sql_injection_native, :detect_sql_injection,
         [:string, :string, :int], :int
     rescue LoadError, FFI::NotFoundError => err
+      # :nocov:
+
       # Emit an $stderr warning at startup.
       warn "Zen could not load its binary extension #{libzen_name}: #{err}"
 
@@ -38,6 +40,8 @@ module Aikido::Zen
         attempt = format("%p for SQL injection", query)
         raise InternalsError.new(attempt, "loading", Internals.libzen_name)
       end
+
+      # :nocov:
     else
       # Analyzes the SQL query to detect if the provided user input is being
       # passed as-is without escaping.

data/lib/aikido/zen/scanners/ssrf_scanner.rb

@@ -112,7 +112,8 @@ module Aikido::Zen
         is_port_relevant = input_uri.port != input_uri.default_port
         return false if is_port_relevant && input_uri.port != conn_uri.port
 
-        conn_uri.hostname == input_uri.hostname
+        conn_uri.hostname == input_uri.hostname &&
+          conn_uri.port == input_uri.port
       end
 
       def private_ip?(hostname)
@@ -128,8 +129,11 @@ module Aikido::Zen
       # * The input itself, if it already looks like a URI.
       # * The input prefixed with http://
       # * The input prefixed with https://
+      # * The input prefixed with the scheme of the request's URI, to consider
+      #   things like an FTP request (to "ftp://localhost") with a plain host
+      #   as a user-input ("localhost").
       #
-      # @return [Set<URI>]
+      # @return [Array<URI>] a list of unique URIs based on the above criteria.
       def uris_from_input
         input = @input.to_s
 
@@ -138,10 +142,12 @@ module Aikido::Zen
         # valid hostname. We should do the same for the input.
         input = format("[%s]", input) if unescaped_ipv6?(input)
 
-        [input, "http://#{input}", "https://#{input}"]
-          .map { |candidate| as_uri(candidate) }
-          .compact
-          .uniq
+        [
+          input,
+          "http://#{input}",
+          "https://#{input}",
+          "#{@request_uri.scheme}://#{input}"
+        ].map { |candidate| as_uri(candidate) }.compact.uniq
       end
 
       def as_uri(string)

data/lib/aikido/zen/sinks/http.rb

@@ -66,7 +66,7 @@ module Aikido::Zen
 
           response
         ensure
-          context["ssrf.request"] = prev_request
+          context["ssrf.request"] = prev_request if context
         end
       end
     end

data/lib/aikido/zen/sinks/pg.rb

@@ -7,6 +7,17 @@ module Aikido::Zen
     module PG
       SINK = Sinks.add("pg", scanners: [Scanners::SQLInjectionScanner])
 
+      # For some reason, the ActiveRecord pg adapter does not wrap exceptions in
+      # StatementInvalid, which leads to inconsistent handling. This guarantees
+      # that all Zen errors are wrapped in a StatementInvalid, so documentation
+      # can be consistent.
+      WRAP_EXCEPTIONS = if defined?(ActiveRecord::StatementInvalid)
+        <<~RUBY
+          rescue Aikido::Zen::SQLInjectionError
+            raise ActiveRecord::StatementInvalid
+        RUBY
+      end
+
       module Extensions
         %i[
           send_query exec sync_exec async_exec
@@ -16,12 +27,7 @@ module Aikido::Zen
             def #{method}(query, *)
               SINK.scan(query: query, dialect: :postgresql, operation: :#{method})
               super
-            rescue Aikido::Zen::SQLInjectionError
-              # The pg adapter does not wrap exceptions in StatementInvalid, which
-              # leads to inconsistent handling. This guarantees that all Aikido
-              # errors are wrapped in a StatementInvalid, so documentation can be
-              # consistent.
-              raise ActiveRecord::StatementInvalid
+            #{WRAP_EXCEPTIONS}
             end
           RUBY
         end
@@ -33,12 +39,7 @@ module Aikido::Zen
             def #{method}(_, query, *)
               SINK.scan(query: query, dialect: :postgresql, operation: :#{method})
               super
-            rescue Aikido::Zen::SQLInjectionError
-              # The pg adapter does not wrap exceptions in StatementInvalid, which
-              # leads to inconsistent handling. This guarantees that all Aikido
-              # errors are wrapped in a StatementInvalid, so documentation can be
-              # consistent.
-              raise ActiveRecord::StatementInvalid
+            #{WRAP_EXCEPTIONS}
             end
           RUBY
         end

data/lib/aikido/zen/sinks/typhoeus.rb

@@ -66,7 +66,7 @@ module Aikido::Zen
             operation: "request"
           )
         ensure
-          context["ssrf.request"] = nil
+          context["ssrf.request"] = nil if context
         end
 
         true

data/lib/aikido/zen/version.rb

@@ -2,9 +2,9 @@
 
 module Aikido
   module Zen
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
 
     # The version of libzen_internals that we build against.
-    LIBZEN_VERSION = "0.1.30"
+    LIBZEN_VERSION = "0.1.31"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: arm64-linux
 authors:
 - Nicolas Sanguinetti
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-11-15 00:00:00.000000000 Z
+date: 2024-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -63,6 +63,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".ruby-version"
+- ".simplecov"
 - ".standard.yml"
 - CHANGELOG.md
 - LICENSE
@@ -95,7 +96,7 @@ files:
 - lib/aikido/zen/errors.rb
 - lib/aikido/zen/event.rb
 - lib/aikido/zen/internals.rb
-- lib/aikido/zen/libzen-v0.1.30.aarch64.so
+- lib/aikido/zen/libzen-v0.1.31.aarch64.so
 - lib/aikido/zen/middleware/check_allowed_addresses.rb
 - lib/aikido/zen/middleware/set_context.rb
 - lib/aikido/zen/middleware/throttler.rb