prevent merging on hosts

akto-api-security · Oct 31, 2023 · 95859b9 · 95859b9
1 parent 983a5d8
commit 95859b9
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 1 deletion.
diff --git a/apps/api-runtime/src/main/java/com/akto/runtime/APICatalogSync.java b/apps/api-runtime/src/main/java/com/akto/runtime/APICatalogSync.java
@@ -620,7 +620,8 @@ public static URLTemplate tryMergeUrls(URLStatic dbUrl, URLStatic newUrl) {
             String tempToken = newTokens[i];
             String dbToken = dbTokens[i];
 
-            if (tempToken.equalsIgnoreCase(dbToken)) {
+            int minCount = dbUrl.getUrl().startsWith("http") && newUrl.getUrl().startsWith("http") ? 3 : 0;
+            if (tempToken.equalsIgnoreCase(dbToken) || i < minCount) {
                 continue;
             }
 
@@ -637,6 +638,13 @@ public static URLTemplate tryMergeUrls(URLStatic dbUrl, URLStatic newUrl) {
             }
         }
 
+        boolean allNull = true;
+        for (SingleTypeInfo.SuperType superType: newTypes) {
+            allNull = allNull && (superType == null);
+        }
+
+        if (allNull) return null;
+
         if (templatizedStrTokens <= 1) {
             return new URLTemplate(newTokens, newTypes, newUrl.getMethod());
         }

diff --git a/apps/api-runtime/src/test/java/com/akto/parsers/TestMergingNew.java b/apps/api-runtime/src/test/java/com/akto/parsers/TestMergingNew.java
@@ -803,4 +803,32 @@ public void testSampleDataUpdate() throws Exception {
 
     }
 
+    @Test
+    public void testHarIPMerging() {
+        testInitializer();
+        SingleTypeInfoDao.instance.getMCollection().drop();
+        ApiCollectionsDao.instance.getMCollection().drop();
+        HttpCallParser parser = new HttpCallParser("userIdentifier", 1, 1, 1, true);
+        String url = "https://akto";
+        List<HttpResponseParams> responseParams = new ArrayList<>();
+        List<String> urls = new ArrayList<>();
+        for (int i=0; i< 50; i++) {
+            urls.add(url + "-"+i + ".io/" + "books");
+        }
+        for (String c: urls) {
+            HttpResponseParams resp = createSampleParams("user1", c);
+            responseParams.add(resp);
+        }
+
+        parser.syncFunction(responseParams.subList(0,23), false, true);
+        parser.apiCatalogSync.syncWithDB(false, true);
+        APICatalogSync.mergeUrlsAndSave(123,true);
+        parser.apiCatalogSync.buildFromDB(false, true);
+
+        APICatalog dbState = parser.apiCatalogSync.getDbState(123);
+        assertEquals(23, dbState.getStrictURLToMethods().size());
+        assertEquals(0, dbState.getTemplateURLToMethods().size());
+
+    }
+
 }