Spring/Javalin fix: make sure to report query params as url

agent/src/main/java/dev/aikido/agent/wrappers/javalin/JavalinWrapper.java

@@ -58,7 +58,7 @@ public static void before(
 
             // Create a context object for Javalin
             ContextObject context = new JavalinContextObject(
-                    ctx.method().name(), ctx.url(), ctx.ip(),
+                        ctx.method().name(), ctx.fullUrl(), ctx.ip(),
                     ctx.queryParamMap(), cookies, headers
             );
             WebRequestCollector.Res response = WebRequestCollector.report(context);

agent/src/main/java/dev/aikido/agent/wrappers/spring/SpringMVCJakartaWrapper.java

@@ -87,7 +87,7 @@ public static Object interceptOnEnter(
 
             ContextObject contextObject = new SpringMVCContextObject(
                     request.getMethod(), request.getRequestURL(), request.getRemoteAddr(),
-                    request.getParameterMap(), cookiesMap, headersMap
+                    request.getParameterMap(), cookiesMap, headersMap, request.getQueryString()
             );
 
             // Write a new response:

agent/src/main/java/dev/aikido/agent/wrappers/spring/SpringMVCJavaxWrapper.java

@@ -89,7 +89,7 @@ public static Object interceptOnEnter(
 
             ContextObject contextObject = new SpringMVCContextObject(
                     request.getMethod(), request.getRequestURL(), request.getRemoteAddr(),
-                    request.getParameterMap(), cookiesMap, headersMap
+                    request.getParameterMap(), cookiesMap, headersMap, request.getQueryString()
             );
 
             // Write a new response:

agent_api/src/main/java/dev/aikido/agent_api/context/ContextObject.java

@@ -114,7 +114,7 @@ public RouteMetadata getRouteMetadata() {
     public String toString() {
         return "ContextObject{" +
             "method='" + method + '\'' +
-            ", url='" + url + '\'' +
+            ", route='" + route + '\'' +
             ", source='" + source + '\'' +
             '}';
     }

agent_api/src/main/java/dev/aikido/agent_api/context/SpringMVCContextObject.java

@@ -8,11 +8,14 @@
 public class SpringMVCContextObject extends SpringContextObject {
     public SpringMVCContextObject(
             String method, StringBuffer url, String rawIp, Map<String, String[]> queryParams,
-            HashMap<String, List<String>> cookies, HashMap<String, Enumeration<String>> headers
+            HashMap<String, List<String>> cookies, HashMap<String, Enumeration<String>> headers, String queryString
     ) {
         this.method = method;
         if (url != null) {
             this.url = url.toString();
+            if (queryString != null && !queryString.isEmpty()) {
+                this.url = this.url + "?" + queryString;
+            }
         }
         this.query = extractQueryParameters(queryParams);
         this.cookies = cookies;

agent_api/src/test/java/collectors/SpringAnnotationCollectorTest.java

@@ -79,7 +79,7 @@ public Class<? extends Annotation> annotationType() {
     @BeforeEach
     public void setUp() {
         mockContext = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/test"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>()
+                "GET", new StringBuffer("http://localhost/test"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>(), null
         );
         Context.set(mockContext);
     }

agent_api/src/test/java/context/SpringMVCContextObjectTest.java

@@ -16,27 +16,27 @@ class SpringMVCContextObjectTest {
     @BeforeEach
     void setUp() {
         springContextObject = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/test"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>()
+                "GET", new StringBuffer("http://localhost/test"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>(), null
         );
     }
 
     @Test
     void testGetRouteWithSlashTest() {
         // Act
         springContextObject = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/test"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>()
+                "GET", new StringBuffer("http://localhost/test"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>(), "a=b"
         );
 
         // Assert
-        assertEquals("http://localhost/test", springContextObject.getUrl());
+        assertEquals("http://localhost/test?a=b", springContextObject.getUrl());
         assertEquals("/test", springContextObject.getRoute());
     }
 
     @Test
     void testGetRouteWithNumbers() {
         // Act
         springContextObject = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>()
+                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), new HashMap<>(), ""
         );
 
         // Assert
@@ -59,7 +59,7 @@ void testIpRequestFeature() {
         headers.put("x-forwarded-for", forwardedForValues.elements());
 
         springContextObject = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), headers
+                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), headers, null
         );
 
         assertEquals(1, springContextObject.getHeaders().size());
@@ -75,7 +75,7 @@ void testIpRequestFeature_InvalidHeader() {
         headers.put("x-forwarded-for", forwardedForValues.elements());
 
         springContextObject = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), headers
+                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), headers, null
         );
 
         assertEquals(1, springContextObject.getHeaders().size());
@@ -91,7 +91,7 @@ void testIpRequestFeature_TrustProxyOff() {
         headers.put("x-forwarded-for", forwardedForValues.elements());
 
         springContextObject = new SpringMVCContextObject(
-                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), headers
+                "GET", new StringBuffer("http://localhost/api/dog/28632"), "192.168.1.1", Map.of(), new HashMap<>(), headers, null
         );
 
         assertEquals(1, springContextObject.getHeaders().size());

agent_api/src/test/java/vulnerabilities/StringsFromContextTest.java

@@ -22,7 +22,7 @@ void setUp() {
                         "userId", List.of("user1"))),
                 /* headers: */ new HashMap<>(Map.of(
                         "content-type", new Vector<>(List.of("application/json")).elements(),
-                        "authorization", new Vector<>(List.of("Bearer token")).elements()))
+                        "authorization", new Vector<>(List.of("Bearer token")).elements())), null
         );
     }
 

end2end/attack_events.json

@@ -11,6 +11,9 @@
     "source": "body",
     "operation": "(MySQL Connector/J) java.sql.Connection.prepareStatement"
   },
+  "javalin_mysql_request": {
+    "url": "http://localhost:8098/api/create?a=b"
+  },
   "javalin_postgres_attack": {
     "blocked": true,
     "kind": "sql_injection",
@@ -36,6 +39,9 @@
     "operation": "(MySQL Connector/J) java.sql.Connection.prepareStatement",
     "user_id": "123"
   },
+  "spring_mysql_boot_mysql_request": {
+    "url": "http://localhost:8082/api/pets/create?b=2&c=3"
+  },
   "spring_mysql_boot_mariadb_attack": {
     "blocked": true,
     "kind": "sql_injection",

end2end/javalin_mysql_kotlin.py

@@ -4,9 +4,9 @@
 javalin_mysql_app = App(8098)
 
 javalin_mysql_app.add_payload(
-    key="sql", test_event=events["javalin_mysql_attack"],
-    safe_request=Request(route="/api/create", body={"name": "Bobby"}),
-    unsafe_request=Request(route="/api/create", body={"name": "Malicious Pet\", \"Gru from the Minions\") -- "})
+    key="sql", test_event=events["javalin_mysql_attack"], test_request=events["javalin_mysql_request"],
+    safe_request=Request(route="/api/create?a=b#test2", body={"name": "Bobby"}),
+    unsafe_request=Request(route="/api/create?a=b#test2", body={"name": "Malicious Pet\", \"Gru from the Minions\") -- "})
 )
 
 javalin_mysql_app.add_payload(

end2end/spring_boot_mysql.py

@@ -5,10 +5,10 @@
 spring_boot_mysql_app = App(8082)
 
 spring_boot_mysql_app.add_payload(
-    "sql_mysql",test_event=events["spring_mysql_boot_mysql_attack"],
-    safe_request=Request("/api/pets/create", headers={'user': '123'}, body={"name": "Bobby"}),
+    "sql_mysql",test_event=events["spring_mysql_boot_mysql_attack"], test_request=events["spring_mysql_boot_mysql_request"],
+    safe_request=Request("/api/pets/create?b=2&c=3#fragment", headers={'user': '123'}, body={"name": "Bobby"}),
     unsafe_request=Request(
-        "/api/pets/create", headers={'user': '123'}, body={"name": 'Malicious Pet", "Gru from the Minions") -- '}
+        "/api/pets/create?b=2&c=3#fragment", headers={'user': '123'}, body={"name": 'Malicious Pet", "Gru from the Minions") -- '}
     )
 )
 

end2end/utils/__init__.py

@@ -22,11 +22,12 @@ def __init__(self, port):
         if not wait_until_live(self.urls["disabled"]):
             raise Exception(self.urls["disabled"] + " is not turning on.")
 
-    def add_payload(self,key, safe_request, unsafe_request=None, test_event=None):
+    def add_payload(self,key, safe_request, unsafe_request=None, test_event=None, test_request=None):
         self.payloads[key] = {
             "safe": safe_request,
             "unsafe": unsafe_request,
-            "test_event": test_event
+            "test_event": test_event,
+            "test_request": test_request
         }
 
     def test_payload(self, key):
@@ -38,16 +39,24 @@ def test_payload(self, key):
         test_payloads_safe_vs_unsafe(payload, self.urls)
         print("✅ Tested payload: " + key)
 
-        if payload["test_event"]:
+        reported_event = None
+        if payload["test_event"] or payload["test_request"]:
             time.sleep(5)
-            attacks = self.event_handler.fetch_attacks()
-            assert_eq(len(attacks), equals=1)
+            attack_events = self.event_handler.fetch_attacks()
+            assert_eq(len(attack_events), equals=1)
+            reported_event = attack_events[0]
+
+        if payload["test_event"]:
             for k, v in payload["test_event"].items():
                 if k == "user_id":  # exemption rule for user ids
-                    assert_eq(attacks[0]["attack"]["user"]["id"], v)
+                    assert_eq(reported_event["attack"]["user"]["id"], v)
                 else:
-                    assert_eq(attacks[0]["attack"][k], equals=v)
-            print("✅ Tested accurate event reporting for: " + key)
+                    assert_eq(reported_event["attack"][k], equals=v)
+            print("✅ Tested accurate evet[attack] reporting for: " + key)
+        if payload["test_request"]:
+            for k, v in payload["test_request"].items():
+                assert_eq(reported_event["request"][k], equals=v)
+            print("✅ Tested accurate event[request] reporting for: " + key)
 
     def test_all_payloads(self):
         for key in self.payloads.keys():