aikido-zen 1.0.1.beta.3-x86_64-mingw-64 → 1.0.1.beta.5-x86_64-mingw-64

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b137ca8d4f6f67972cf4ebcd10b10d1873e8ab98fae4435d94c7b97ebf065f3a
-  data.tar.gz: 815c22f6be50189e3d59a70e75cc82c379849ef07928fa497b4b37b98a3bf095
+  metadata.gz: c35cec4c784296981a3deb9fe1fd2d34fd6a653fbd6d2d3037c24632bfe0322e
+  data.tar.gz: a6f19f666167e9c39b5c273bea3481b2acf2e2dd817bee5aee9bb9b3da3a0252
 SHA512:
-  metadata.gz: 0e21978ed548096449c9b8a117f637d980f33c0b54e9d77ad3eb9bb55800bd8412d2e3cd88e4e5742d1961383ddf560d3f8fe89f0c661b2a7751646dc93ac98e
-  data.tar.gz: 6b6648a66fc85c6960b95d07a1146e64046e97644b0a040d54337bcc66c0daaec6ea5bbd67a83dae8510d667220ffef6c573266e637e40ad93cbb21de0651d06
+  metadata.gz: 9becfc0eb3e60ac46f8af101d3d6b30bcf3aa8505a8a296378ee1d0dfe278c34b578ec5e5682c59d196b2e72415adfc1d8de218511400aa971d1386bece19817
+  data.tar.gz: 605f53dbf38a95839ccd3effd9a9bc75900bb2b12b0b45553db16182aae66739a4d9bf7114baa34b6ec9c8ff16a05edc318529db9f8ed23aa712e51c0b09879b

data/lib/aikido/zen/rails_engine.rb

@@ -10,8 +10,6 @@ module Aikido::Zen
     end
 
     initializer "aikido.add_middleware" do |app|
-      next unless config.zen.protect?
-
       app.middleware.use Aikido::Zen::Middleware::SetContext
       app.middleware.use Aikido::Zen::Middleware::CheckAllowedAddresses
       # Request Tracker stats do not consider failed request or 40x, so the middleware
@@ -51,20 +49,8 @@ module Aikido::Zen
     end
 
     config.after_initialize do
-      next unless config.zen.protect?
-
-      # Make sure this is run at the end of the initialization process, so
-      # that any gems required after aikido-zen are detected and patched
-      # accordingly.
-      Aikido::Zen.load_sinks!
-
-      # It's important we start after loading sinks, so we can report the installed packages
+      # Start the Aikido Agent only once the application starts.
       Aikido::Zen.start!
-
-      # Agent's bootstrap process has finished —Controllers are patched to block
-      # unwanted requests, sinks are loaded, scanners are running—, so we mark
-      # the agent as installed.
-      Aikido::Zen.middleware_installed!
     end
   end
 end

data/lib/aikido/zen/sinks/async_http.rb

@@ -7,14 +7,6 @@ module Aikido::Zen
   module Sinks
     module Async
       module HTTP
-        def self.load_sinks!
-          if Aikido::Zen.satisfy "async-http", ">= 0.70.0"
-            require "async/http"
-
-            ::Async::HTTP::Client.prepend(Async::HTTP::ClientExtensions)
-          end
-        end
-
         SINK = Sinks.add("async-http", scanners: [
           Scanners::SSRFScanner,
           OutboundConnectionMonitor
@@ -30,48 +22,54 @@ module Aikido::Zen
           end
         end
 
-        module ClientExtensions
-          extend Sinks::DSL
+        def self.load_sinks!
+          if Aikido::Zen.satisfy "async-http", ">= 0.70.0"
+            require "async/http"
 
-          sink_around :call do |super_call, request|
-            uri = URI(format("%<scheme>s://%<authority>s%<path>s", {
-              scheme: request.scheme || scheme,
-              authority: request.authority || authority,
-              path: request.path
-            }))
+            ::Async::HTTP::Client.class_eval do
+              extend Sinks::DSL
 
-            wrapped_request = Scanners::SSRFScanner::Request.new(
-              verb: request.method,
-              uri: uri,
-              headers: request.headers.to_h,
-              header_normalizer: ->(value) { Array(value).join(", ") }
-            )
+              sink_around :call do |original_call, request|
+                uri = URI(format("%<scheme>s://%<authority>s%<path>s", {
+                  scheme: request.scheme || scheme,
+                  authority: request.authority || authority,
+                  path: request.path
+                }))
 
-            # Store the request information so the DNS sinks can pick it up.
-            context = Aikido::Zen.current_context
-            if context
-              prev_request = context["ssrf.request"]
-              context["ssrf.request"] = wrapped_request
-            end
+                wrapped_request = Scanners::SSRFScanner::Request.new(
+                  verb: request.method,
+                  uri: uri,
+                  headers: request.headers.to_h,
+                  header_normalizer: ->(value) { Array(value).join(", ") }
+                )
 
-            connection = OutboundConnection.from_uri(uri)
+                # Store the request information so the DNS sinks can pick it up.
+                context = Aikido::Zen.current_context
+                if context
+                  prev_request = context["ssrf.request"]
+                  context["ssrf.request"] = wrapped_request
+                end
 
-            Helpers.scan(wrapped_request, connection, "request")
+                connection = OutboundConnection.from_uri(uri)
 
-            response = super_call.call
+                Helpers.scan(wrapped_request, connection, "request")
 
-            Scanners::SSRFScanner.track_redirects(
-              request: wrapped_request,
-              response: Scanners::SSRFScanner::Response.new(
-                status: response.status,
-                headers: response.headers.to_h,
-                header_normalizer: ->(value) { Array(value).join(", ") }
-              )
-            )
+                response = original_call.call
+
+                Scanners::SSRFScanner.track_redirects(
+                  request: wrapped_request,
+                  response: Scanners::SSRFScanner::Response.new(
+                    status: response.status,
+                    headers: response.headers.to_h,
+                    header_normalizer: ->(value) { Array(value).join(", ") }
+                  )
+                )
 
-            response
-          ensure
-            context["ssrf.request"] = prev_request if context
+                response
+              ensure
+                context["ssrf.request"] = prev_request if context
+              end
+            end
           end
         end
       end

data/lib/aikido/zen/sinks/curb.rb

@@ -6,14 +6,6 @@ require_relative "../outbound_connection_monitor"
 module Aikido::Zen
   module Sinks
     module Curl
-      def self.load_sinks!
-        if Aikido::Zen.satisfy "curb", ">= 0.2.3"
-          require "curb"
-
-          ::Curl::Easy.prepend(Curl::EasyExtensions)
-        end
-      end
-
       SINK = Sinks.add("curb", scanners: [
         Scanners::SSRFScanner,
         OutboundConnectionMonitor
@@ -53,59 +45,65 @@ module Aikido::Zen
         end
       end
 
-      module EasyExtensions
-        extend Sinks::DSL
-
-        sink_around :perform do |super_call|
-          wrapped_request = Helpers.wrap_request(self)
-
-          # Store the request information so the DNS sinks can pick it up.
-          context = Aikido::Zen.current_context
-          if context
-            prev_request = context["ssrf.request"]
-            context["ssrf.request"] = wrapped_request
-          end
-
-          connection = OutboundConnection.from_uri(URI(url))
-
-          Helpers.scan(wrapped_request, connection, "request")
-
-          response = super_call.call
-
-          Scanners::SSRFScanner.track_redirects(
-            request: wrapped_request,
-            response: Helpers.wrap_response(self)
-          )
+      def self.load_sinks!
+        if Aikido::Zen.satisfy "curb", ">= 0.2.3"
+          require "curb"
 
-          # When libcurl has follow_location set, it will handle redirections
-          # internally, and expose the "last_effective_url" as the URI that was
-          # last requested in the redirect chain.
-          #
-          # In this case, we can't actually stop the request from happening, but
-          # we can scan again (now that we know another request happened), to
-          # stop the response from being exposed to the user. This downgrades
-          # the SSRF into a blind SSRF, which is better than doing nothing.
-          if url != last_effective_url
-            last_effective_request = Helpers.wrap_request(self, url: last_effective_url)
-
-            # Code coverage is disabled here because the else clause is a no-op,
-            # so there is nothing to cover.
-            # :nocov:
-            if context
-              context["ssrf.request"] = last_effective_request
-            else
-              # empty
+          ::Curl::Easy.class_eval do
+            extend Sinks::DSL
+
+            sink_around :perform do |original_call|
+              wrapped_request = Helpers.wrap_request(self)
+
+              # Store the request information so the DNS sinks can pick it up.
+              context = Aikido::Zen.current_context
+              if context
+                prev_request = context["ssrf.request"]
+                context["ssrf.request"] = wrapped_request
+              end
+
+              connection = OutboundConnection.from_uri(URI(url))
+
+              Helpers.scan(wrapped_request, connection, "request")
+
+              response = original_call.call
+
+              Scanners::SSRFScanner.track_redirects(
+                request: wrapped_request,
+                response: Helpers.wrap_response(self)
+              )
+
+              # When libcurl has follow_location set, it will handle redirections
+              # internally, and expose the "last_effective_url" as the URI that was
+              # last requested in the redirect chain.
+              #
+              # In this case, we can't actually stop the request from happening, but
+              # we can scan again (now that we know another request happened), to
+              # stop the response from being exposed to the user. This downgrades
+              # the SSRF into a blind SSRF, which is better than doing nothing.
+              if url != last_effective_url
+                last_effective_request = Helpers.wrap_request(self, url: last_effective_url)
+
+                # Code coverage is disabled here because the else clause is a no-op,
+                # so there is nothing to cover.
+                # :nocov:
+                if context
+                  context["ssrf.request"] = last_effective_request
+                else
+                  # empty
+                end
+                # :nocov:
+
+                connection = OutboundConnection.from_uri(URI(last_effective_url))
+
+                Helpers.scan(last_effective_request, connection, "request")
+              end
+
+              response
+            ensure
+              context["ssrf.request"] = prev_request if context
             end
-            # :nocov:
-
-            connection = OutboundConnection.from_uri(URI(last_effective_url))
-
-            Helpers.scan(last_effective_request, connection, "request")
           end
-
-          response
-        ensure
-          context["ssrf.request"] = prev_request if context
         end
       end
     end

data/lib/aikido/zen/sinks/em_http.rb

@@ -7,19 +7,6 @@ module Aikido::Zen
   module Sinks
     module EventMachine
       module HttpRequest
-        def self.load_sinks!
-          if Aikido::Zen.satisfy "em-http-request", ">= 1.0"
-            require "em-http-request"
-
-            ::EventMachine::HttpRequest.use(EventMachine::HttpRequest::Middleware)
-
-            # NOTE: We can't use middleware to intercept requests as we want to ensure any
-            # modifications to the request from user-supplied middleware are already applied
-            # before we scan the request.
-            ::EventMachine::HttpClient.prepend(EventMachine::HttpRequest::HttpClientExtensions)
-          end
-        end
-
         SINK = Sinks.add("em-http-request", scanners: [
           Scanners::SSRFScanner,
           OutboundConnectionMonitor
@@ -35,26 +22,37 @@ module Aikido::Zen
           end
         end
 
-        module HttpClientExtensions
-          extend Sinks::DSL
+        def self.load_sinks!
+          if Aikido::Zen.satisfy "em-http-request", ">= 1.0"
+            require "em-http-request"
 
-          sink_before :send_request do
-            wrapped_request = Scanners::SSRFScanner::Request.new(
-              verb: req.method.to_s,
-              uri: URI(req.uri),
-              headers: req.headers
-            )
+            ::EventMachine::HttpRequest.use(EventMachine::HttpRequest::Middleware)
 
-            # Store the request information so the DNS sinks can pick it up.
-            context = Aikido::Zen.current_context
-            context["ssrf.request"] = wrapped_request if context
+            # NOTE: We can't use middleware to intercept requests as we want to ensure any
+            # modifications to the request from user-supplied middleware are already applied
+            # before we scan the request.
+            ::EventMachine::HttpClient.class_eval do
+              extend Sinks::DSL
 
-            connection = OutboundConnection.new(
-              host: req.host,
-              port: req.port
-            )
+              sink_before :send_request do
+                wrapped_request = Scanners::SSRFScanner::Request.new(
+                  verb: req.method.to_s,
+                  uri: URI(req.uri),
+                  headers: req.headers
+                )
+
+                # Store the request information so the DNS sinks can pick it up.
+                context = Aikido::Zen.current_context
+                context["ssrf.request"] = wrapped_request if context
+
+                connection = OutboundConnection.new(
+                  host: req.host,
+                  port: req.port
+                )
 
-            Helpers.scan(wrapped_request, connection, "request")
+                Helpers.scan(wrapped_request, connection, "request")
+              end
+            end
           end
         end
 

data/lib/aikido/zen/sinks/excon.rb

@@ -6,15 +6,6 @@ require_relative "../outbound_connection_monitor"
 module Aikido::Zen
   module Sinks
     module Excon
-      def self.load_sinks!
-        if Aikido::Zen.satisfy "excon", ">= 0.50.0"
-          require "excon"
-
-          ::Excon::Connection.prepend(ConnectionExtensions)
-          ::Excon::Middleware::RedirectFollower.prepend(RedirectFollowerExtensions)
-        end
-      end
-
       SINK = Sinks.add("excon", scanners: [
         Scanners::SSRFScanner,
         OutboundConnectionMonitor
@@ -46,72 +37,78 @@ module Aikido::Zen
         end
       end
 
-      module ConnectionExtensions
-        extend Sinks::DSL
+      def self.load_sinks!
+        if Aikido::Zen.satisfy "excon", ">= 0.50.0"
+          require "excon"
+
+          ::Excon::Connection.class_eval do
+            extend Sinks::DSL
 
-        sink_around :request do |super_call, params = {}|
-          request = Helpers.build_request(@data, params)
+            sink_around :request do |original_call, params = {}|
+              request = Helpers.build_request(@data, params)
 
-          # Store the request information so the DNS sinks can pick it up.
-          context = Aikido::Zen.current_context
-          if context
-            prev_request = context["ssrf.request"]
-            context["ssrf.request"] = request
-          end
+              # Store the request information so the DNS sinks can pick it up.
+              context = Aikido::Zen.current_context
+              if context
+                prev_request = context["ssrf.request"]
+                context["ssrf.request"] = request
+              end
 
-          connection = OutboundConnection.from_uri(request.uri)
+              connection = OutboundConnection.from_uri(request.uri)
 
-          Helpers.scan(request, connection, "request")
+              Helpers.scan(request, connection, "request")
 
-          response = super_call.call
+              response = original_call.call
 
-          Scanners::SSRFScanner.track_redirects(
-            request: request,
-            response: Scanners::SSRFScanner::Response.new(
-              status: response.status,
-              headers: response.headers.to_h
-            )
-          )
+              Scanners::SSRFScanner.track_redirects(
+                request: request,
+                response: Scanners::SSRFScanner::Response.new(
+                  status: response.status,
+                  headers: response.headers.to_h
+                )
+              )
 
-          response
-        rescue Sinks::DSL::PresafeError => err
-          outer_cause = err.cause
-          case outer_cause
-          when ::Excon::Error::Socket
-            inner_cause = outer_cause.cause
-            # Excon wraps errors inside the lower level layer. This only happens
-            # to our scanning exceptions when a request is using RedirectFollower,
-            # so we unwrap them when it happens so host apps can handle errors
-            # consistently.
-            raise inner_cause if inner_cause.is_a?(Aikido::Zen::UnderAttackError)
+              response
+            rescue Sinks::DSL::PresafeError => err
+              outer_cause = err.cause
+              case outer_cause
+              when ::Excon::Error::Socket
+                inner_cause = outer_cause.cause
+                # Excon wraps errors inside the lower level layer. This only happens
+                # to our scanning exceptions when a request is using RedirectFollower,
+                # so we unwrap them when it happens so host apps can handle errors
+                # consistently.
+                raise inner_cause if inner_cause.is_a?(Aikido::Zen::UnderAttackError)
+              end
+              raise
+            ensure
+              context["ssrf.request"] = prev_request if context
+            end
           end
-          raise
-        ensure
-          context["ssrf.request"] = prev_request if context
-        end
-      end
 
-      module RedirectFollowerExtensions
-        extend Sinks::DSL
-
-        sink_before :response_call do |datum|
-          response = datum[:response]
-
-          # Code coverage is disabled here because the else clause is a no-op,
-          # so there is nothing to cover.
-          # :nocov:
-          if !response.nil?
-            Scanners::SSRFScanner.track_redirects(
-              request: Helpers.build_request(datum, {}),
-              response: Scanners::SSRFScanner::Response.new(
-                status: response[:status],
-                headers: response[:headers]
-              )
-            )
-          else
-            # empty
+          ::Excon::Middleware::RedirectFollower.class_eval do
+            extend Sinks::DSL
+
+            sink_before :response_call do |datum|
+              response = datum[:response]
+
+              # Code coverage is disabled here because the else clause is a no-op,
+              # so there is nothing to cover.
+              # :nocov:
+              if !response.nil?
+                Scanners::SSRFScanner.track_redirects(
+                  request: Helpers.build_request(datum, {}),
+                  response: Scanners::SSRFScanner::Response.new(
+                    status: response[:status],
+                    headers: response[:headers]
+                  )
+                )
+              else
+                # empty
+              end
+              # :nocov:
+            end
           end
-          # :nocov:
         end
       end
     end