Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recent hotfixes #1021

Merged
merged 23 commits into from
Apr 17, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
e67278e
basic implementation of using dependency graph in testing
avneesh-akto Mar 7, 2024
35ff291
removed duplicate files and added API to TestEditorEnums.java
avneesh-akto Mar 11, 2024
21af369
added workflow_filter in testing
avneesh-akto Mar 15, 2024
76c96c2
fixed merge conflicts
avneesh-akto Apr 8, 2024
5e03999
allow get_assets call in templates
avneesh-akto Apr 13, 2024
19e33ab
Merge pull request #1008 from akto-api-security/develop
avneesh-akto Apr 15, 2024
f850f7f
fixed merge conflicts
avneesh-akto Apr 16, 2024
68e9ceb
remove mac-os
ankush-jain-akto Apr 16, 2024
674d2cd
code cleanup
avneesh-akto Apr 16, 2024
a3f89c6
remove bolt
ankush-jain-akto Apr 16, 2024
0869488
support variables in override url input
ayushaga14 Apr 16, 2024
dd1d118
allow variable string in run test input
ayushaga14 Apr 16, 2024
866081b
rever har action changes and null checks for memory.java
avneesh-akto Apr 16, 2024
d0d6f48
Update Constants.java
aktoboy Apr 16, 2024
c62e46b
fixed unit test
avneesh-akto Apr 16, 2024
6b76963
added graceful error handling to workflow tests
avneesh-akto Apr 16, 2024
6c9af33
Merge pull request #1014 from akto-api-security/feature/dp_in_testing
avneesh-akto Apr 16, 2024
a2895d3
add logs
ayushaga14 Apr 17, 2024
1c9294d
Merge pull request #1016 from akto-api-security/feature_var_substitui…
ayushaga14 Apr 17, 2024
d31fe8f
Merge pull request #1019 from akto-api-security/aktoboy-patch-1
aktoboy Apr 17, 2024
1f30fb4
Added changes for test results telemetry
aktoboy Apr 17, 2024
b6365d5
Fixed mongo connection string
aktoboy Apr 17, 2024
5e2e684
Merge pull request #1022 from akto-api-security/feature/ingest-test-r…
aktoboy Apr 17, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,13 @@ name: "CodeQL"
on:
push:
branches: [ "master" ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ "master" ]
schedule:
- cron: '22 0 * * 1'

jobs:
analyze:
name: Analyze
runs-on: ${{ (matrix.language == 'java' && 'macos-latest') || 'ubuntu-latest' }}
runs-on: 'ubuntu-latest'
timeout-minutes: ${{ (matrix.language == 'java' && 120) || 360 }}
permissions:
actions: read
Expand Down
8 changes: 0 additions & 8 deletions .github/workflows/staging.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@ jobs:
outputs:
IMAGE_TAG: ${{ steps.docker_tag.outputs.IMAGE_TAG }}
steps:
- name: Setup Bolt
uses: koalalab-inc/bolt@v1
- uses: actions/checkout@v2
- uses: actions/setup-java@v2
with:
Expand Down Expand Up @@ -112,8 +110,6 @@ jobs:
outputs:
lb_name: ${{ steps.deploy_cluster.outputs.lb_name }}
steps:
- name: Setup Bolt
uses: koalalab-inc/bolt@v1
#revert branch name
- name: Setup mongo, akto-k8s-agent kube yaml's
run: |
Expand Down Expand Up @@ -187,8 +183,6 @@ jobs:
needs: deploy
runs-on: ubuntu-latest
steps:
- name: Setup Bolt
uses: koalalab-inc/bolt@v1
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
with:
Expand Down Expand Up @@ -227,8 +221,6 @@ jobs:
FLASH_NLB_DNS: ${{ secrets.FLASH_NLB_DNS }}
FLASH_MONGO_CONN: ${{ secrets.FLASH_MONGO_CONN }}
steps:
- name: Setup Bolt
uses: koalalab-inc/bolt@v1

- name: Fetch kube yaml
#revert branch name
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,10 @@ public void analyse(String message, int finalApiCollectionId) {
SingleTypeInfo.SuperType superType = urlTemplate.getTypes()[i];
if (superType == null) continue;
int idx = ogUrl.startsWith("http") ? i:i+1;
String s = ogUrlSplit[idx]; // because ogUrl=/api/books/123 while template url=api/books/INTEGER
Object s = ogUrlSplit[idx]; // because ogUrl=/api/books/123 while template url=api/books/INTEGER
if (superType.equals(SingleTypeInfo.SuperType.INTEGER)) {
s = Integer.parseInt(ogUrlSplit[idx]);
}
Set<Object> val = new HashSet<>();
val.add(s);
processRequestParam(i+"", val, combinedUrl, true, false);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ public void testAnalyse1() {
TreeHelper treeHelper = new TreeHelper();
treeHelper.buildTree("1000", "/api/m7", "POST");
Map<Integer, Node> result = treeHelper.result;
assertEquals(2, result.size()); // this is because /api/m6 gets best value from /api/m1
assertEquals(3, result.size()); // this is because /api/m6 gets best value from /api/m1

Map<String, Connection> connections = result.get(Objects.hash("1000", "/api/m7", "POST")).getConnections();
assertEquals(1, connections.size());
Expand Down Expand Up @@ -161,7 +161,7 @@ public void testAnalyse3() {
TreeHelper treeHelper = new TreeHelper();
treeHelper.buildTree("1000", "/api/m7", "POST");
Map<Integer, Node> result = treeHelper.result;
assertEquals(6, result.size()); // this is because /api/m6 has 2 parameters getting data
assertEquals(7, result.size()); // this is because /api/m6 has 2 parameters getting data

Map<String, Connection> connections = result.get(Objects.hash("1000", "/api/m7", "POST")).getConnections();
assertEquals(1, connections.size());
Expand Down Expand Up @@ -197,7 +197,7 @@ public void testAnalyse4() {
TreeHelper treeHelper = new TreeHelper();
treeHelper.buildTree("1000", "api/cars/INTEGER", "POST");
Map<Integer, Node> result = treeHelper.result;
assertEquals(1, result.size()); // this is because /api/m6 has 2 parameters getting data
assertEquals(2, result.size()); // this is because /api/m6 has 2 parameters getting data

Map<String, Connection> connections = result.get(Objects.hash("1000", "api/cars/INTEGER", "POST")).getConnections();
assertEquals(1, connections.size());
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
import com.akto.dto.type.URLMethods.Method;
import com.akto.log.LoggerMaker;
import com.akto.runtime.RelationshipSync;
import com.akto.utils.Build;
import com.akto.test_editor.execution.Build;
import com.akto.utils.Utils;
import com.mongodb.BasicDBObject;
import com.mongodb.ConnectionString;
Expand Down
22 changes: 11 additions & 11 deletions apps/dashboard/src/main/java/com/akto/action/HarAction.java
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ public String execute() throws IOException {
return ERROR.toUpperCase();
}
} else {
Collection<String> actionErrors = apiCollectionsAction.getActionErrors();
Collection<String> actionErrors = apiCollectionsAction.getActionErrors();
if (actionErrors != null && actionErrors.size() > 0) {
for (String actionError: actionErrors) {
addActionError(actionError);
Expand Down Expand Up @@ -178,7 +178,7 @@ public void setTcpContent(byte[] tcpContent) {
Awesome awesome = null;

public String uploadTcp() {

File tmpDir = FileUtils.getTempDirectory();
String filename = UUID.randomUUID().toString() + ".pcap";
File tcpDump = new File(tmpDir, filename);
Expand All @@ -188,23 +188,23 @@ public String uploadTcp() {
Awesome.GoString.ByValue str = new Awesome.GoString.ByValue();
str.p = tcpDump.getAbsolutePath();
str.n = str.p.length();

Awesome.GoString.ByValue str2 = new Awesome.GoString.ByValue();
str2.p = System.getenv("AKTO_KAFKA_BROKER_URL");
str2.n = str2.p.length();

awesome.readTcpDumpFile(str, str2 , apiCollectionId);
return Action.SUCCESS.toUpperCase();

return Action.SUCCESS.toUpperCase();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
return Action.ERROR.toUpperCase();
return Action.ERROR.toUpperCase();
}

}

interface Awesome extends Library {
interface Awesome extends Library {
public static class GoString extends Structure {
/** C type : const char* */
public String p;
Expand All @@ -224,8 +224,8 @@ public GoString(String p, long n) {
public static class ByReference extends GoString implements Structure.ByReference {}
public static class ByValue extends GoString implements Structure.ByValue {}
}

public void readTcpDumpFile(GoString.ByValue filepath, GoString.ByValue kafkaURL, long apiCollectionId);

}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -1795,6 +1795,8 @@ public static Organization fetchAndSaveFeatureWiseAllowed(Organization organizat
hotjarSiteId = OrganizationUtils.fetchHotjarSiteId(metaData);
boolean telemetryEnabled = OrganizationUtils.fetchTelemetryEnabled(metaData);
setTelemetrySettings(organization, telemetryEnabled);
boolean testTelemetryEnabled = OrganizationUtils.fetchTestTelemetryEnabled(metaData);
organization.setTestTelemetryEnabled(testTelemetryEnabled);

loggerMaker.infoAndAddToDb("Processed org metadata",LogDb.DASHBOARD);

Expand All @@ -1812,6 +1814,7 @@ public static Organization fetchAndSaveFeatureWiseAllowed(Organization organizat
Updates.set(Organization.FEATURE_WISE_ALLOWED, featureWiseAllowed),
Updates.set(Organization.GRACE_PERIOD, gracePeriod),
Updates.set(Organization.HOTJAR_SITE_ID, hotjarSiteId),
Updates.set(Organization.TEST_TELEMETRY_ENABLED, testTelemetryEnabled),
Updates.set(Organization.LAST_FEATURE_MAP_UPDATE, lastFeatureMapUpdate)));

loggerMaker.infoAndAddToDb("Updated org",LogDb.DASHBOARD);
Expand Down
49 changes: 0 additions & 49 deletions apps/dashboard/src/main/java/com/akto/utils/GzipUtils.java

This file was deleted.

7 changes: 6 additions & 1 deletion apps/dashboard/src/main/java/com/akto/utils/Utils.java
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,11 @@
new URL(url).toURI();
return true;
} catch (MalformedURLException | URISyntaxException e) {
Pattern pattern = Pattern.compile("\\$\\{[^}]*\\}");
Matcher matcher = pattern.matcher(url);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
that depends on a
user-provided value
may run slow on strings starting with '${' and with many repetitions of '${'.
if (matcher.find()) {
return true;
}
return false;
}
}
Expand Down Expand Up @@ -470,7 +475,7 @@
info = new AccountHTTPCallParserAktoPolicyInfo();
HttpCallParser callParser = new HttpCallParser("userIdentifier", 1, 1, 1, false);
info.setHttpCallParser(callParser);
// info.setResourceAnalyser(new ResourceAnalyser(300_000, 0.01, 100_000, 0.01));
// info.setResourceAnalyser(new ResourceAnalyser(300_000, 0.01, 100_000, 0.01));
RuntimeListener.accountHTTPParserMap.put(accountId, info);
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -286,4 +286,9 @@ public static boolean fetchTelemetryEnabled(BasicDBObject metadata) {
BasicDBObject additionalMetaData = (BasicDBObject) metadata.getOrDefault("additionalMetaData", new BasicDBObject());
return additionalMetaData.getString("ENABLE_TELEMETRY", "NA").equalsIgnoreCase("ENABLED");
}

public static boolean fetchTestTelemetryEnabled(BasicDBObject metadata) {
BasicDBObject additionalMetaData = (BasicDBObject) metadata.getOrDefault("additionalMetaData", new BasicDBObject());
return additionalMetaData.getString("ENABLE_TEST_TELEMETRY", "NA").equalsIgnoreCase("ENABLED");
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,9 @@ function formatRawNodeData(nodes, currentApiCollectionId, currentEndpoint, curre
let connections = node["connections"]
let edgesMap = new Map()
Object.values(connections).forEach(connection => {
let edge = connection["edges"][0] // todo: null check
let edge = connection["edges"][0]

if (!edge) return

let source = calculateNodeId(edge["apiCollectionId"], edge["url"], edge["method"]);
let edgeId = source + "-" + id;
Expand Down
Loading
Loading