aikido-zen 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f254d2813587d13946fc4c61856481a71f1489f326fd8bec1ab72c8e641b693e
-  data.tar.gz: 3a938c013d75088f131736b91b6388396e993ef54d1b1e53990a961aee6e73b6
+  metadata.gz: 51eaea8541cd36bd28a72265eb65c03d603ca04200e4445c1ce9ef5f1eda161e
+  data.tar.gz: dbb1085f145533d7c432950e0960b35eae89f9b5c389d17971273fd16ae02da6
 SHA512:
-  metadata.gz: 42128d2fa8f5cb702bbb03bde4fdb737ece7cb2b66500d8ed5e52ab982febc5e41f19c74584ad3b63330a4a7b25080577c12a2b959615ad6d3a6c6153eb8e68f
-  data.tar.gz: 633d0a6370b76a478a613f712316e5fbe11be8d6491714b1b511333571e2dea89025b96a9e59444e64633be06eaea226694fe4eeeab4837b6d2f023aa9b130d0
+  metadata.gz: 298cd2aee853100f077036d8982c04cbcaafafda4554e279f855586bf379d68227005c7eb1869a7c64941e0fe2c06b7d0fb9cdf0f22232d1c9c4ad6b98b5d383
+  data.tar.gz: 4f8fa891bc625d17ed21e0c78ecee44af8fb6784202243982748fa6df86dbdb333f3242cc7890e28bef7cb9ce700b6567600e6ba4a5448af002915852db0c7e8

data/.simplecov

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Due to dependency resolution, on Ruby 2.x we're stuck with a _very_ old
+# SimpleCov version, and it doesn't really give us any benefit to run coverage
+# in separate ruby versions since we don't branch on ruby version in the code.
+return if RUBY_VERSION < "3.0"
+
+SimpleCov.start do
+  # Make sure SimpleCov waits until after the tests
+  # are finished to generate the coverage reports.
+  self.external_at_exit = true
+
+  enable_coverage :branch
+  minimum_coverage line: 95, branch: 85
+
+  add_filter "/test/"
+end
+
+# vim: ft=ruby

data/CHANGELOG.md

@@ -2,4 +2,20 @@
 
 ## [Unreleased]
 
+## 0.1.1
+
+### Fixed
+
+- Avoid an error when sending the initial heartbeat if the Aikido server hasn't
+  received stats yet.
+- Fix the SSRF scanner to ensure the port in the user-supplied payload matches
+  the port in the request.
+- Don't break the HTTP.rb sink when a Zen context isn't set.
+- Don't break the Typhoeus sink when a Zen context isn't set.
+- Don't break the PG sink outside of Rails.
+- Updated [libzen](https://github.com/AikidoSec/zen-internals) to v0.1.31 to
+  prevent flagging false positives in SQL queries with comments.
+
+## 0.1.0
+
 - Initial version

data/lib/aikido/zen/agent.rb

@@ -65,7 +65,9 @@ module Aikido::Zen
 
       poll_for_setting_updates
 
-      @worker.delay(@config.initial_heartbeat_delay) { send_heartbeat if stats.any? }
+      @worker.delay(@config.initial_heartbeat_delay) do
+        send_heartbeat if @collector.stats.any?
+      end
     end
 
     # Clean up any ongoing threads, and reset the state. Called automatically

data/lib/aikido/zen/internals.rb

@@ -31,6 +31,8 @@ module Aikido::Zen
       attach_function :detect_sql_injection_native, :detect_sql_injection,
         [:string, :string, :int], :int
     rescue LoadError, FFI::NotFoundError => err
+      # :nocov:
+
       # Emit an $stderr warning at startup.
       warn "Zen could not load its binary extension #{libzen_name}: #{err}"
 
@@ -38,6 +40,8 @@ module Aikido::Zen
         attempt = format("%p for SQL injection", query)
         raise InternalsError.new(attempt, "loading", Internals.libzen_name)
       end
+
+      # :nocov:
     else
       # Analyzes the SQL query to detect if the provided user input is being
       # passed as-is without escaping.

data/lib/aikido/zen/scanners/ssrf_scanner.rb

@@ -112,7 +112,8 @@ module Aikido::Zen
         is_port_relevant = input_uri.port != input_uri.default_port
         return false if is_port_relevant && input_uri.port != conn_uri.port
 
-        conn_uri.hostname == input_uri.hostname
+        conn_uri.hostname == input_uri.hostname &&
+          conn_uri.port == input_uri.port
       end
 
       def private_ip?(hostname)
@@ -128,8 +129,11 @@ module Aikido::Zen
       # * The input itself, if it already looks like a URI.
       # * The input prefixed with http://
       # * The input prefixed with https://
+      # * The input prefixed with the scheme of the request's URI, to consider
+      #   things like an FTP request (to "ftp://localhost") with a plain host
+      #   as a user-input ("localhost").
       #
-      # @return [Set<URI>]
+      # @return [Array<URI>] a list of unique URIs based on the above criteria.
       def uris_from_input
         input = @input.to_s
 
@@ -138,10 +142,12 @@ module Aikido::Zen
         # valid hostname. We should do the same for the input.
         input = format("[%s]", input) if unescaped_ipv6?(input)
 
-        [input, "http://#{input}", "https://#{input}"]
-          .map { |candidate| as_uri(candidate) }
-          .compact
-          .uniq
+        [
+          input,
+          "http://#{input}",
+          "https://#{input}",
+          "#{@request_uri.scheme}://#{input}"
+        ].map { |candidate| as_uri(candidate) }.compact.uniq
       end
 
       def as_uri(string)

data/lib/aikido/zen/sinks/http.rb

@@ -66,7 +66,7 @@ module Aikido::Zen
 
           response
         ensure
-          context["ssrf.request"] = prev_request
+          context["ssrf.request"] = prev_request if context
         end
       end
     end

data/lib/aikido/zen/sinks/pg.rb

@@ -7,6 +7,17 @@ module Aikido::Zen
     module PG
       SINK = Sinks.add("pg", scanners: [Scanners::SQLInjectionScanner])
 
+      # For some reason, the ActiveRecord pg adapter does not wrap exceptions in
+      # StatementInvalid, which leads to inconsistent handling. This guarantees
+      # that all Zen errors are wrapped in a StatementInvalid, so documentation
+      # can be consistent.
+      WRAP_EXCEPTIONS = if defined?(ActiveRecord::StatementInvalid)
+        <<~RUBY
+          rescue Aikido::Zen::SQLInjectionError
+            raise ActiveRecord::StatementInvalid
+        RUBY
+      end
+
       module Extensions
         %i[
           send_query exec sync_exec async_exec
@@ -16,12 +27,7 @@ module Aikido::Zen
             def #{method}(query, *)
               SINK.scan(query: query, dialect: :postgresql, operation: :#{method})
               super
-            rescue Aikido::Zen::SQLInjectionError
-              # The pg adapter does not wrap exceptions in StatementInvalid, which
-              # leads to inconsistent handling. This guarantees that all Aikido
-              # errors are wrapped in a StatementInvalid, so documentation can be
-              # consistent.
-              raise ActiveRecord::StatementInvalid
+            #{WRAP_EXCEPTIONS}
             end
           RUBY
         end
@@ -33,12 +39,7 @@ module Aikido::Zen
             def #{method}(_, query, *)
               SINK.scan(query: query, dialect: :postgresql, operation: :#{method})
               super
-            rescue Aikido::Zen::SQLInjectionError
-              # The pg adapter does not wrap exceptions in StatementInvalid, which
-              # leads to inconsistent handling. This guarantees that all Aikido
-              # errors are wrapped in a StatementInvalid, so documentation can be
-              # consistent.
-              raise ActiveRecord::StatementInvalid
+            #{WRAP_EXCEPTIONS}
             end
           RUBY
         end

data/lib/aikido/zen/sinks/typhoeus.rb

@@ -66,7 +66,7 @@ module Aikido::Zen
             operation: "request"
           )
         ensure
-          context["ssrf.request"] = nil
+          context["ssrf.request"] = nil if context
         end
 
         true

data/lib/aikido/zen/version.rb

@@ -2,9 +2,9 @@
 
 module Aikido
   module Zen
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
 
     # The version of libzen_internals that we build against.
-    LIBZEN_VERSION = "0.1.30"
+    LIBZEN_VERSION = "0.1.31"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Nicolas Sanguinetti
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-11-15 00:00:00.000000000 Z
+date: 2024-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -60,6 +60,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".ruby-version"
+- ".simplecov"
 - ".standard.yml"
 - CHANGELOG.md
 - LICENSE