Skip to content

Commit 3ab0557

Browse files
bitterpanda63bitterpanda63
committed
Add string operation param to RedirectCollector
1 parent f77d1eb commit 3ab0557

2 files changed

Lines changed: 48 additions & 47 deletions

File tree

‎agent_api/src/main/java/dev/aikido/agent_api/collectors/RedirectCollector.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@ public final class RedirectCollector {
1414
private static final Logger logger = LogManager.getLogger(RedirectCollector.class);
1515

1616
private RedirectCollector() {}
17-
public static void report(URL origin, URL dest) {
17+
public static void report(URL origin, URL dest, String operation) {
1818
logger.trace("Redirect detected: [Origin]<%s> -> [Destination]<%s>", origin, dest);
1919
ContextObject context = Context.get();
2020
// Report destination URL :
21-
URLCollector.report(dest);
21+
URLCollector.report(dest, operation);
2222

2323
// Add as a node :
2424
List<RedirectNode> redirectStarterNodes = context.getRedirectStartNodes();
@@ -41,4 +41,4 @@ public static void report(URL origin, URL dest) {
4141
context.addRedirectNode(starterNode);
4242
Context.set(context); // Update context.
4343
}
44-
}
44+
}

‎agent_api/src/test/java/vulnerabilities/ssrf/RedirectOriginFinderTest.java‎

Lines changed: 45 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,15 @@ public void setup() {
2222

2323
@Test
2424
public void testGetRedirectOrigin() throws MalformedURLException {
25-
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"));
25+
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"), "test-op");
2626
assertNotNull(getRedirectOrigin("hackers.com", 443));
2727
assertEquals("https://example.com", getRedirectOrigin("hackers.com", 443).toString());
2828
}
2929

3030
@Test
3131
public void testGetRedirectOrigin2() throws MalformedURLException {
32-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com/2"));
33-
RedirectCollector.report(new URL("https://example.com/2"), new URL("https://hackers.com/test"));
32+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com/2"), "test-op");
33+
RedirectCollector.report(new URL("https://example.com/2"), new URL("https://hackers.com/test"), "test-op");
3434
assertEquals(1, Context.get().getRedirectStartNodes().size());
3535
assertNotNull(getRedirectOrigin("hackers.com", 443));
3636
assertEquals("https://example.com", getRedirectOrigin("hackers.com", 443).toString());
@@ -43,113 +43,113 @@ public void testGetRedirectNoRedirects() {
4343

4444
@Test
4545
public void testGetRedirectOriginNotADestination() throws MalformedURLException {
46-
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"));
46+
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"), "test-op");
4747
assertNull(getRedirectOrigin("example.com", 443));
4848
}
4949

5050
@Test
5151
public void testGetRedirectOriginNotInRedirects() throws MalformedURLException {
52-
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"));
52+
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"), "test-op");
5353
assertNull(getRedirectOrigin("example.com", 443));
5454
}
5555

5656
@Test
5757
public void testGetRedirectOriginMultipleRedirects() throws MalformedURLException {
58-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com/2"));
59-
RedirectCollector.report(new URL("https://example.com/2"), new URL("https://hackers.com/test"));
60-
RedirectCollector.report(new URL("https://hackers.com/test"), new URL("https://another.com"));
58+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com/2"), "test-op");
59+
RedirectCollector.report(new URL("https://example.com/2"), new URL("https://hackers.com/test"), "test-op");
60+
RedirectCollector.report(new URL("https://hackers.com/test"), new URL("https://another.com"), "test-op");
6161

6262
assertEquals("https://example.com", getRedirectOrigin("hackers.com", 443).toString());
6363
}
6464

6565
@Test
6666
public void testAvoidsInfiniteLoopsWithUnrelatedCyclicRedirects() throws MalformedURLException {
67-
RedirectCollector.report(new URL("https://cycle.com/a"), new URL("https://cycle.com/b"));
68-
RedirectCollector.report(new URL("https://cycle.com/b"), new URL("https://cycle.com/c"));
69-
RedirectCollector.report(new URL("https://cycle.com/c"), new URL("https://cycle.com/a")); // Unrelated cycle
70-
RedirectCollector.report(new URL("https://start.com"), new URL("https://middle.com")); // Relevant redirect
71-
RedirectCollector.report(new URL("https://middle.com"), new URL("https://end.com")); // Relevant redirect
67+
RedirectCollector.report(new URL("https://cycle.com/a"), new URL("https://cycle.com/b"), "test-op");
68+
RedirectCollector.report(new URL("https://cycle.com/b"), new URL("https://cycle.com/c"), "test-op");
69+
RedirectCollector.report(new URL("https://cycle.com/c"), new URL("https://cycle.com/a"), "test-op"); // Unrelated cycle
70+
RedirectCollector.report(new URL("https://start.com"), new URL("https://middle.com"), "test-op"); // Relevant redirect
71+
RedirectCollector.report(new URL("https://middle.com"), new URL("https://end.com"), "test-op"); // Relevant redirect
7272

7373
assertEquals("https://start.com", getRedirectOrigin("end.com", 443).toString());
7474
}
7575

7676
@Test
7777
public void testHandlesMultipleRequestsWithOverlappingRedirects() throws MalformedURLException {
78-
RedirectCollector.report(new URL("https://site1.com"), new URL("https://site2.com"));
79-
RedirectCollector.report(new URL("https://site2.com"), new URL("https://site3.com"));
80-
RedirectCollector.report(new URL("https://site3.com"), new URL("https://site1.com")); // Cycle
81-
RedirectCollector.report(new URL("https://origin.com"), new URL("https://destination.com")); // Relevant redirect
78+
RedirectCollector.report(new URL("https://site1.com"), new URL("https://site2.com"), "test-op");
79+
RedirectCollector.report(new URL("https://site2.com"), new URL("https://site3.com"), "test-op");
80+
RedirectCollector.report(new URL("https://site3.com"), new URL("https://site1.com"), "test-op"); // Cycle
81+
RedirectCollector.report(new URL("https://origin.com"), new URL("https://destination.com"), "test-op"); // Relevant redirect
8282

8383
assertEquals("https://origin.com", getRedirectOrigin("destination.com", 443).toString());
8484
}
8585

8686
@Test
8787
public void testAvoidsInfiniteLoopsWhenCyclesArePartOfTheRedirectChain() throws MalformedURLException {
88-
RedirectCollector.report(new URL("https://start.com"), new URL("https://loop.com/a"));
89-
RedirectCollector.report(new URL("https://loop.com/a"), new URL("https://loop.com/b"));
90-
RedirectCollector.report(new URL("https://loop.com/b"), new URL("https://loop.com/c"));
91-
RedirectCollector.report(new URL("https://loop.com/c"), new URL("https://loop.com/a")); // Cycle here
88+
RedirectCollector.report(new URL("https://start.com"), new URL("https://loop.com/a"), "test-op");
89+
RedirectCollector.report(new URL("https://loop.com/a"), new URL("https://loop.com/b"), "test-op");
90+
RedirectCollector.report(new URL("https://loop.com/b"), new URL("https://loop.com/c"), "test-op");
91+
RedirectCollector.report(new URL("https://loop.com/c"), new URL("https://loop.com/a"), "test-op"); // Cycle here
9292

9393
assertEquals("https://start.com", getRedirectOrigin("loop.com", 443).toString());
9494
}
9595

9696
@Test
9797
public void testRedirectsWithQueryParameters() throws MalformedURLException {
98-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com?param=value"));
98+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com?param=value"), "test-op");
9999

100100
assertEquals("https://example.com", getRedirectOrigin("example.com", 443).toString());
101101
}
102102

103103
@Test
104104
public void testRedirectsWithFragmentIdentifiers() throws MalformedURLException {
105-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com#section"));
105+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com#section"), "test-op");
106106

107107
assertEquals("https://example.com", getRedirectOrigin("example.com", 443).toString());
108108
}
109109

110110
@Test
111111
public void testRedirectsWithDifferentProtocols() throws MalformedURLException {
112-
RedirectCollector.report(new URL("http://example.com"), new URL("https://example.com"));
112+
RedirectCollector.report(new URL("http://example.com"), new URL("https://example.com"), "test-op");
113113

114114
assertEquals("http://example.com", getRedirectOrigin("example.com", 443).toString());
115115
}
116116

117117
@Test
118118
public void testRedirectsWithDifferentPorts() throws MalformedURLException {
119-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com:8080"));
119+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com:8080"), "test-op");
120120

121121
assertEquals("https://example.com", getRedirectOrigin("example.com", 8080).toString());
122122
}
123123

124124
@Test
125125
public void testRedirectsWithPaths() throws MalformedURLException {
126-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com/home"));
127-
RedirectCollector.report(new URL("https://example.com/home"), new URL("https://example.com/home/welcome"));
126+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com/home"), "test-op");
127+
RedirectCollector.report(new URL("https://example.com/home"), new URL("https://example.com/home/welcome"), "test-op");
128128

129129
assertEquals("https://example.com", getRedirectOrigin("example.com", 443).toString());
130130
}
131131
@Test
132132
public void testMultipleRedirectsToSameDestination() throws MalformedURLException {
133-
RedirectCollector.report(new URL("https://a.com"), new URL("https://d.com"));
134-
RedirectCollector.report(new URL("https://b.com"), new URL("https://d.com"));
135-
RedirectCollector.report(new URL("https://c.com"), new URL("https://d.com"));
133+
RedirectCollector.report(new URL("https://a.com"), new URL("https://d.com"), "test-op");
134+
RedirectCollector.report(new URL("https://b.com"), new URL("https://d.com"), "test-op");
135+
RedirectCollector.report(new URL("https://c.com"), new URL("https://d.com"), "test-op");
136136

137137
assertEquals("https://a.com", getRedirectOrigin("d.com", 443).toString());
138138
}
139139

140140
@Test
141141
public void testMultipleRedirectPathsToSameUrl() throws MalformedURLException {
142-
RedirectCollector.report(new URL("https://x.com"), new URL("https://y.com"));
143-
RedirectCollector.report(new URL("https://y.com"), new URL("https://z.com"));
144-
RedirectCollector.report(new URL("https://a.com"), new URL("https://b.com"));
145-
RedirectCollector.report(new URL("https://b.com"), new URL("https://z.com"));
142+
RedirectCollector.report(new URL("https://x.com"), new URL("https://y.com"), "test-op");
143+
RedirectCollector.report(new URL("https://y.com"), new URL("https://z.com"), "test-op");
144+
RedirectCollector.report(new URL("https://a.com"), new URL("https://b.com"), "test-op");
145+
RedirectCollector.report(new URL("https://b.com"), new URL("https://z.com"), "test-op");
146146

147147
assertEquals("https://x.com", getRedirectOrigin("z.com", 443).toString());
148148
}
149149

150150
@Test
151151
public void testReturnsUndefinedWhenSourceAndDestinationAreSameUrl() throws MalformedURLException {
152-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com"));
152+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com"), "test-op");
153153

154154
assertEquals("https://example.com", getRedirectOrigin("example.com", 443).toString());
155155
}
@@ -159,7 +159,8 @@ public void testHandlesVeryLongRedirectChains() throws MalformedURLException {
159159
for (int i = 0; i < 100; i++) {
160160
RedirectCollector.report(
161161
new URL("https://example.com/" + i),
162-
new URL("https://example.com/" + (i + 1))
162+
new URL("https://example.com/" + (i + 1)),
163+
, "test-op"
163164
);
164165
}
165166

@@ -168,35 +169,35 @@ public void testHandlesVeryLongRedirectChains() throws MalformedURLException {
168169

169170
@Test
170171
public void testHandlesRedirectsWithCyclesLongerThanOneRedirect() throws MalformedURLException {
171-
RedirectCollector.report(new URL("https://a.com"), new URL("https://b.com"));
172-
RedirectCollector.report(new URL("https://b.com"), new URL("https://c.com"));
173-
RedirectCollector.report(new URL("https://c.com"), new URL("https://a.com")); // Cycle
172+
RedirectCollector.report(new URL("https://a.com"), new URL("https://b.com"), "test-op");
173+
RedirectCollector.report(new URL("https://b.com"), new URL("https://c.com"), "test-op");
174+
RedirectCollector.report(new URL("https://c.com"), new URL("https://a.com"), "test-op"); // Cycle
174175

175176
assertEquals("https://a.com", getRedirectOrigin("a.com", 443).toString());
176177
}
177178

178179
@Test
179180
public void testHandlesRedirectsWithDifferentQueryParameters() throws MalformedURLException {
180-
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com?param=1"));
181-
RedirectCollector.report(new URL("https://example.com?param=1"), new URL("https://example.com?param=2"));
181+
RedirectCollector.report(new URL("https://example.com"), new URL("https://example.com?param=1"), "test-op");
182+
RedirectCollector.report(new URL("https://example.com?param=1"), new URL("https://example.com?param=2"), "test-op");
182183

183184
assertEquals("https://example.com", getRedirectOrigin("example.com", 443).toString());
184185
}
185186
@Test
186187
public void testRedirectWithMatchingPort() throws MalformedURLException {
187-
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com:443"));
188+
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com:443"), "test-op");
188189
assertNotNull(getRedirectOrigin("hackers.com", 443));
189190
assertEquals("https://example.com", getRedirectOrigin("hackers.com", 443).toString());
190191
}
191192

192193
@Test
193194
public void testRedirectWithNonMatchingPort() throws MalformedURLException {
194-
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com:442"));
195+
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com:442"), "test-op");
195196
assertNull(getRedirectOrigin("hackers.com", 443));
196197
}
197198
@Test
198199
public void testRedirectWithNonMatchingPort2() throws MalformedURLException {
199-
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"));
200+
RedirectCollector.report(new URL("https://example.com"), new URL("https://hackers.com"), "test-op");
200201
assertNull(getRedirectOrigin("hackers.com", 442));
201202
}
202203
}

0 commit comments

Comments
 (0)