Skip to content

Commit 7a64f51

Browse files
notshivanshnotshivansh
authored
Merge pull request #1334 from akto-api-security/develop
Develop
2 parents c28d6a1 + ff74693 commit 7a64f51

File tree

6 files changed

+86
-28
lines changed

6 files changed

+86
-28
lines changed

‎apps/api-runtime/src/main/java/com/akto/parsers/HttpCallParser.java

+6-2
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public class HttpCallParser {
5252
private final int sync_threshold_time;
5353
private int sync_count = 0;
5454
private int last_synced;
55-
private static final LoggerMaker loggerMaker = new LoggerMaker(HttpCallParser.class);
55+
private static final LoggerMaker loggerMaker = new LoggerMaker(HttpCallParser.class, LogDb.RUNTIME);
5656
public APICatalogSync apiCatalogSync;
5757
public DependencyAnalyser dependencyAnalyser;
5858
private Map<String, Integer> hostNameToIdMap = new HashMap<>();
@@ -230,7 +230,11 @@ public void syncFunction(List<HttpResponseParams> responseParams, boolean syncIm
230230

231231
if (DbMode.dbType.equals(DbMode.DbType.MONGO_DB)) {
232232
for (HttpResponseParams responseParam: filteredResponseParams) {
233-
dependencyAnalyser.analyse(responseParam.getOrig(), responseParam.requestParams.getApiCollectionId());
233+
try{
234+
dependencyAnalyser.analyse(responseParam.getOrig(), responseParam.requestParams.getApiCollectionId());
235+
} catch (Exception e){
236+
loggerMaker.errorAndAddToDb(e, "error in analyzing dependency");
237+
}
234238
}
235239
}
236240

‎apps/api-runtime/src/main/java/com/akto/utils/SampleDataToSTI.java

+17
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@
22

33
import java.util.ArrayList;
44
import java.util.HashMap;
5+
import java.util.HashSet;
56
import java.util.List;
67
import java.util.Map;
8+
import java.util.Set;
79

810
import com.akto.dto.traffic.SampleData;
911
import com.akto.dto.type.SingleTypeInfo;
@@ -13,8 +15,11 @@
1315
import com.akto.dto.HttpResponseParams;
1416
import com.akto.dto.SensitiveSampleData;
1517
import com.akto.dto.type.APICatalog;
18+
import com.akto.dto.type.RequestTemplate;
1619
import com.akto.runtime.APICatalogSync;
1720
import com.akto.runtime.URLAggregator;
21+
import com.mongodb.BasicDBObject;
22+
1823
import org.slf4j.Logger;
1924
import org.slf4j.LoggerFactory;
2025

@@ -124,6 +129,15 @@ private List<SingleTypeInfo> getSampleDataToSTIUtil(String dataString, String ur
124129
return singleTypeInfos;
125130
}
126131

132+
Set<String> queryParamSet = new HashSet<>();
133+
try {
134+
String urlWithParams = httpResponseParams.getRequestParams().getURL();
135+
BasicDBObject queryParams = RequestTemplate.getQueryJSON(urlWithParams);
136+
queryParamSet = new HashSet<>(queryParams.keySet());
137+
} catch (Exception e){
138+
logger.error(e.getMessage());
139+
}
140+
127141
List<HttpResponseParams> responseParams = new ArrayList<>();
128142
responseParams.add(httpResponseParams);
129143
Map<Integer, URLAggregator> aggregatorMap = new HashMap<>();
@@ -140,6 +154,9 @@ private List<SingleTypeInfo> getSampleDataToSTIUtil(String dataString, String ur
140154

141155
for (int i = 0; i < singleTypeInfos.size(); i++) {
142156
singleTypeInfos.get(i).setUrl(url);
157+
if(queryParamSet.contains(singleTypeInfos.get(i).getParam())){
158+
singleTypeInfos.get(i).setQueryParam(true);
159+
}
143160
}
144161

145162
return singleTypeInfos;

‎libs/dao/src/main/java/com/akto/dto/type/SingleTypeInfo.java

+12
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,18 @@ public String toString() {
537537
@BsonIgnore
538538
private Object value;
539539

540+
// Only being used for generating OpenAPI spec.
541+
@BsonIgnore
542+
private boolean isQueryParam;
543+
544+
public boolean isQueryParam() {
545+
return isQueryParam;
546+
}
547+
548+
public void setQueryParam(boolean isQueryParam) {
549+
this.isQueryParam = isQueryParam;
550+
}
551+
540552
public static final String _UNIQUE_COUNT = "uniqueCount";
541553
public long uniqueCount = 0L;
542554
public static final String _PUBLIC_COUNT = "publicCount";

‎libs/utils/src/main/java/com/akto/open_api/Main.java

+43-23
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
11
package com.akto.open_api;
22

3-
import com.akto.dao.ApiCollectionsDao;
4-
import com.akto.dao.SingleTypeInfoDao;
5-
import com.akto.dto.ApiCollection;
63
import com.akto.dto.type.SingleTypeInfo;
74
import com.akto.log.LoggerMaker;
85
import com.akto.log.LoggerMaker.LogDb;
96
import com.fasterxml.jackson.databind.ObjectMapper;
107
import com.fasterxml.jackson.databind.introspect.AnnotatedMember;
118
import com.fasterxml.jackson.databind.introspect.JacksonAnnotationIntrospector;
12-
import com.mongodb.client.model.Filters;
139
import io.swagger.v3.oas.models.OpenAPI;
1410
import io.swagger.v3.oas.models.PathItem;
1511
import io.swagger.v3.oas.models.Paths;
@@ -21,15 +17,14 @@
2117
import java.net.URI;
2218
import java.net.URISyntaxException;
2319
import java.util.*;
24-
import java.util.regex.Matcher;
2520
import java.util.regex.Pattern;
2621
import org.slf4j.Logger;
2722
import org.slf4j.LoggerFactory;
2823

2924
import static com.fasterxml.jackson.annotation.JsonInclude.Include.NON_NULL;
3025

3126
public class Main {
32-
private static final LoggerMaker loggerMaker = new LoggerMaker(Main.class);
27+
private static final LoggerMaker loggerMaker = new LoggerMaker(Main.class, LogDb.DASHBOARD);
3328
private static final Logger logger = LoggerFactory.getLogger(Main.class);
3429

3530
private static final ObjectMapper mapper = new ObjectMapper();
@@ -99,38 +94,63 @@ public static void addPathItems(int responseCode, Paths paths, String url, Strin
9994
}
10095
List<Parameter> headerParameters = new ArrayList<>();
10196
try{
102-
headerParameters = buildHeaders(singleTypeInfoList);
97+
headerParameters = buildParams(singleTypeInfoList, ParamLocation.HEADER);
10398
} catch (Exception e) {
10499
loggerMaker.errorAndAddToDb("ERROR in building headers in addPathItems " + e, LogDb.DASHBOARD);
105100
}
101+
102+
List<Parameter> queryParameters = new ArrayList<>();
103+
try{
104+
queryParameters = buildParams(singleTypeInfoList, ParamLocation.QUERY);
105+
} catch (Exception e) {
106+
loggerMaker.errorAndAddToDb("ERROR in building query params in addPathItems " + e, LogDb.DASHBOARD);
107+
}
106108

107-
PathBuilder.addPathItem(paths, url, method, responseCode, schema, headerParameters, includeHeaders);
109+
PathBuilder.addPathItem(paths, url, method, responseCode, schema, headerParameters, queryParameters, includeHeaders);
108110
}
109111

110-
public static List<Parameter> buildHeaders(List<SingleTypeInfo> singleTypeInfoList) throws Exception{
111-
List<Parameter> headerParameters = new ArrayList<>();
112+
// Ref: https://github.com/OAI/OpenAPI-Specification/blob/3.0.1/versions/3.0.1.md#parameter-locations
113+
public enum ParamLocation {
114+
HEADER, QUERY, PATH, COOKIE
115+
}
116+
117+
public static List<Parameter> buildParams(List<SingleTypeInfo> singleTypeInfoList, ParamLocation location) throws Exception{
118+
List<Parameter> parameters = new ArrayList<>();
112119
ObjectSchema schema =new ObjectSchema();
113-
for (SingleTypeInfo singleTypeInfo: singleTypeInfoList) {
114-
if(singleTypeInfo.isIsHeader()){
115-
List<SchemaBuilder.CustomSchema> cc = SchemaBuilder.getCustomSchemasFromSingleTypeInfo(singleTypeInfo);
116-
SchemaBuilder.build(schema, cc);
120+
for (SingleTypeInfo singleTypeInfo : singleTypeInfoList) {
121+
switch (location) {
122+
case HEADER:
123+
if (singleTypeInfo.isIsHeader()) {
124+
List<SchemaBuilder.CustomSchema> cc = SchemaBuilder.getCustomSchemasFromSingleTypeInfo(singleTypeInfo);
125+
SchemaBuilder.build(schema, cc);
126+
}
127+
break;
128+
case QUERY:
129+
if (singleTypeInfo.isQueryParam()) {
130+
List<SchemaBuilder.CustomSchema> cc = SchemaBuilder.getCustomSchemasFromSingleTypeInfo(singleTypeInfo);
131+
SchemaBuilder.build(schema, cc);
132+
}
133+
break;
134+
default:
135+
break;
117136
}
118137
}
119-
if (schema.getProperties() == null) return headerParameters;
120-
for(String header:schema.getProperties().keySet()){
121-
Parameter head = new Parameter();
122-
head.setName(header);
123-
head.setIn("header");
124-
head.setSchema(schema.getProperties().get(header));
125-
headerParameters.add(head);
138+
139+
if (schema.getProperties() == null) return parameters;
140+
for(String param:schema.getProperties().keySet()){
141+
Parameter parameter = new Parameter();
142+
parameter.setName(param);
143+
parameter.setIn(location.name().toLowerCase());
144+
parameter.setSchema(schema.getProperties().get(param));
145+
parameters.add(parameter);
126146
}
127-
return headerParameters;
147+
return parameters;
128148
}
129149

130150
public static Schema<?> buildSchema(List<SingleTypeInfo> singleTypeInfoList) throws Exception {
131151
ObjectSchema schema =new ObjectSchema();
132152
for (SingleTypeInfo singleTypeInfo: singleTypeInfoList) {
133-
if(singleTypeInfo.isIsHeader()){
153+
if(singleTypeInfo.isIsHeader() || singleTypeInfo.isQueryParam() || singleTypeInfo.getIsUrlParam()){
134154
continue;
135155
}
136156
List<SchemaBuilder.CustomSchema> cc = SchemaBuilder.getCustomSchemasFromSingleTypeInfo(singleTypeInfo);

‎libs/utils/src/main/java/com/akto/open_api/PathBuilder.java

+5-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
public class PathBuilder {
2020

21-
public static void addPathItem(Paths paths, String url, String method , int responseCode, Schema<?> schema,List<Parameter> headerParameters, boolean includeHeaders) throws Exception {
21+
public static void addPathItem(Paths paths, String url, String method , int responseCode, Schema<?> schema,List<Parameter> headerParameters, List<Parameter> queryParameters, boolean includeHeaders) throws Exception {
2222
PathItem pathItem = paths.getOrDefault(url, new PathItem());
2323
pathItem.setDescription("description");
2424
Operation operation = getOperation(pathItem,method);
@@ -39,9 +39,12 @@ public static void addPathItem(Paths paths, String url, String method , int resp
3939

4040
requestBody.setContent(requestBodyContent);
4141
operation.setRequestBody(requestBody);
42+
List<Parameter> parameters = new ArrayList<>();
4243
if (includeHeaders) {
43-
operation.setParameters(headerParameters);
44+
parameters.addAll(headerParameters);
4445
}
46+
parameters.addAll(queryParameters);
47+
operation.setParameters(parameters);
4548
setOperation(pathItem, method, operation);
4649
paths.addPathItem(url, pathItem);
4750
return ;

‎libs/utils/src/main/java/com/akto/open_api/parser/Parser.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import com.akto.dto.HttpResponseParams;
88
import com.akto.dto.OriginalHttpRequest;
99
import com.akto.dto.OriginalHttpResponse;
10+
import com.akto.dto.HttpResponseParams.Source;
1011
import com.akto.dto.upload.FileUploadError;
1112
import com.akto.dto.upload.SwaggerUploadLog;
1213
import com.akto.log.LoggerMaker;
@@ -323,7 +324,8 @@ public static ParserResult convertOpenApiToAkto(OpenAPI openAPI, String uploadId
323324
messageObject.put(mKeys.ip, "null");
324325
messageObject.put(mKeys.time, Context.now() + "");
325326
messageObject.put(mKeys.type, "HTTP");
326-
messageObject.put(mKeys.source, "OTHER");
327+
// swagger uploads are treated as HAR files.
328+
messageObject.put(mKeys.source, Source.HAR.name());
327329

328330
if (responseObjectList.isEmpty()) {
329331
responseObjectList.add(emptyResponseObject);

0 commit comments

Comments
 (0)