aikido-zen 0.1.0-x86_64-linux → 0.1.1-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f0b2a3174ea5cb98412aad7981aa6b669490e4c125cb23d179419027a349c7d
-  data.tar.gz: 6009a16031c7935f9243b99ef64d9735d692f705d18ba612dc214eafffb1aa7b
+  metadata.gz: 71dff796247be7898e6fa9a68e66a0289c3435e45721b21a4e93ca94e486f130
+  data.tar.gz: c6f2ade140275a39b8371f9068a7b8b4b96666a903248e0d1e54eeab8e85603d
 SHA512:
-  metadata.gz: ecf36ae3339b10fbf6b34c5baaeb071cb7d4c5785ddfb593af1145bd4063f617d9869ddad3a99361ebfeaea914bd9d32c2a7c53dad6a4772b453dc23f96f200d
-  data.tar.gz: f0c4833d629ebdf1ec2ad07df541bc02c88e96c57a76a14537bbf6df875eccd0c5440b1f2f6831c5cfb77336514365fe6deecf6a6c25466d5e0576e1c2478006
+  metadata.gz: d8cd7c12e2b35fb7f6be3708345d445e0ba4f92f2c453db3f404ba40c8489ac709d65e710a1660e1ac7139799493a8879944ec996c1af1d29d5487add7cbf221
+  data.tar.gz: 1283b73ee94eae915fcb7298ed00319fcef545153421dda1512e7f551d81fa003c47c16ce8892eefc8de7b97d3382a245565b72dd305c708fada87305a1f001d

data/.simplecov

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Due to dependency resolution, on Ruby 2.x we're stuck with a _very_ old
+# SimpleCov version, and it doesn't really give us any benefit to run coverage
+# in separate ruby versions since we don't branch on ruby version in the code.
+return if RUBY_VERSION < "3.0"
+
+SimpleCov.start do
+  # Make sure SimpleCov waits until after the tests
+  # are finished to generate the coverage reports.
+  self.external_at_exit = true
+
+  enable_coverage :branch
+  minimum_coverage line: 95, branch: 85
+
+  add_filter "/test/"
+end
+
+# vim: ft=ruby

data/CHANGELOG.md

@@ -2,4 +2,20 @@
 
 ## [Unreleased]
 
+## 0.1.1
+
+### Fixed
+
+- Avoid an error when sending the initial heartbeat if the Aikido server hasn't
+  received stats yet.
+- Fix the SSRF scanner to ensure the port in the user-supplied payload matches
+  the port in the request.
+- Don't break the HTTP.rb sink when a Zen context isn't set.
+- Don't break the Typhoeus sink when a Zen context isn't set.
+- Don't break the PG sink outside of Rails.
+- Updated [libzen](https://github.com/AikidoSec/zen-internals) to v0.1.31 to
+  prevent flagging false positives in SQL queries with comments.
+
+## 0.1.0
+
 - Initial version

data/lib/aikido/zen/agent.rb

@@ -65,7 +65,9 @@ module Aikido::Zen
 
       poll_for_setting_updates
 
-      @worker.delay(@config.initial_heartbeat_delay) { send_heartbeat if stats.any? }
+      @worker.delay(@config.initial_heartbeat_delay) do
+        send_heartbeat if @collector.stats.any?
+      end
     end
 
     # Clean up any ongoing threads, and reset the state. Called automatically

data/lib/aikido/zen/internals.rb

@@ -31,6 +31,8 @@ module Aikido::Zen
       attach_function :detect_sql_injection_native, :detect_sql_injection,
         [:string, :string, :int], :int
     rescue LoadError, FFI::NotFoundError => err
+      # :nocov:
+
       # Emit an $stderr warning at startup.
       warn "Zen could not load its binary extension #{libzen_name}: #{err}"
 
@@ -38,6 +40,8 @@ module Aikido::Zen
         attempt = format("%p for SQL injection", query)
         raise InternalsError.new(attempt, "loading", Internals.libzen_name)
       end
+
+      # :nocov:
     else
       # Analyzes the SQL query to detect if the provided user input is being
       # passed as-is without escaping.

data/lib/aikido/zen/scanners/ssrf_scanner.rb

@@ -112,7 +112,8 @@ module Aikido::Zen
         is_port_relevant = input_uri.port != input_uri.default_port
         return false if is_port_relevant && input_uri.port != conn_uri.port
 
-        conn_uri.hostname == input_uri.hostname
+        conn_uri.hostname == input_uri.hostname &&
+          conn_uri.port == input_uri.port
       end
 
       def private_ip?(hostname)
@@ -128,8 +129,11 @@ module Aikido::Zen
       # * The input itself, if it already looks like a URI.
       # * The input prefixed with http://
       # * The input prefixed with https://
+      # * The input prefixed with the scheme of the request's URI, to consider
+      #   things like an FTP request (to "ftp://localhost") with a plain host
+      #   as a user-input ("localhost").
       #
-      # @return [Set<URI>]
+      # @return [Array<URI>] a list of unique URIs based on the above criteria.
       def uris_from_input
         input = @input.to_s
 
@@ -138,10 +142,12 @@ module Aikido::Zen
         # valid hostname. We should do the same for the input.
         input = format("[%s]", input) if unescaped_ipv6?(input)
 
-        [input, "http://#{input}", "https://#{input}"]
-          .map { |candidate| as_uri(candidate) }
-          .compact
-          .uniq
+        [
+          input,
+          "http://#{input}",
+          "https://#{input}",
+          "#{@request_uri.scheme}://#{input}"
+        ].map { |candidate| as_uri(candidate) }.compact.uniq
       end
 
       def as_uri(string)

data/lib/aikido/zen/sinks/http.rb

@@ -66,7 +66,7 @@ module Aikido::Zen
 
           response
         ensure
-          context["ssrf.request"] = prev_request
+          context["ssrf.request"] = prev_request if context
         end
       end
     end

data/lib/aikido/zen/sinks/pg.rb

@@ -7,6 +7,17 @@ module Aikido::Zen
     module PG
       SINK = Sinks.add("pg", scanners: [Scanners::SQLInjectionScanner])
 
+      # For some reason, the ActiveRecord pg adapter does not wrap exceptions in
+      # StatementInvalid, which leads to inconsistent handling. This guarantees
+      # that all Zen errors are wrapped in a StatementInvalid, so documentation
+      # can be consistent.
+      WRAP_EXCEPTIONS = if defined?(ActiveRecord::StatementInvalid)
+        <<~RUBY
+          rescue Aikido::Zen::SQLInjectionError
+            raise ActiveRecord::StatementInvalid
+        RUBY
+      end
+
       module Extensions
         %i[
           send_query exec sync_exec async_exec
@@ -16,12 +27,7 @@ module Aikido::Zen
             def #{method}(query, *)
               SINK.scan(query: query, dialect: :postgresql, operation: :#{method})
               super
-            rescue Aikido::Zen::SQLInjectionError
-              # The pg adapter does not wrap exceptions in StatementInvalid, which
-              # leads to inconsistent handling. This guarantees that all Aikido
-              # errors are wrapped in a StatementInvalid, so documentation can be
-              # consistent.
-              raise ActiveRecord::StatementInvalid
+            #{WRAP_EXCEPTIONS}
             end
           RUBY
         end
@@ -33,12 +39,7 @@ module Aikido::Zen
             def #{method}(_, query, *)
               SINK.scan(query: query, dialect: :postgresql, operation: :#{method})
               super
-            rescue Aikido::Zen::SQLInjectionError
-              # The pg adapter does not wrap exceptions in StatementInvalid, which
-              # leads to inconsistent handling. This guarantees that all Aikido
-              # errors are wrapped in a StatementInvalid, so documentation can be
-              # consistent.
-              raise ActiveRecord::StatementInvalid
+            #{WRAP_EXCEPTIONS}
             end
           RUBY
         end

data/lib/aikido/zen/sinks/typhoeus.rb

@@ -66,7 +66,7 @@ module Aikido::Zen
             operation: "request"
           )
         ensure
-          context["ssrf.request"] = nil
+          context["ssrf.request"] = nil if context
         end
 
         true

data/lib/aikido/zen/version.rb

@@ -2,9 +2,9 @@
 
 module Aikido
   module Zen
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
 
     # The version of libzen_internals that we build against.
-    LIBZEN_VERSION = "0.1.30"
+    LIBZEN_VERSION = "0.1.31"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: x86_64-linux
 authors:
 - Nicolas Sanguinetti
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-11-15 00:00:00.000000000 Z
+date: 2024-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -63,6 +63,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".ruby-version"
+- ".simplecov"
 - ".standard.yml"
 - CHANGELOG.md
 - LICENSE
@@ -95,7 +96,7 @@ files:
 - lib/aikido/zen/errors.rb
 - lib/aikido/zen/event.rb
 - lib/aikido/zen/internals.rb
-- lib/aikido/zen/libzen-v0.1.30.x86_64.so
+- lib/aikido/zen/libzen-v0.1.31.x86_64.so
 - lib/aikido/zen/middleware/check_allowed_addresses.rb
 - lib/aikido/zen/middleware/set_context.rb
 - lib/aikido/zen/middleware/throttler.rb