Add sample app and e2e test for FastAPI 0.70.0

Pins FastAPI 0.70.0 (starlette 0.16.0) to reproduce and verify
route discovery on older starlette versions.

Author: hansott

end2end/fastapi_old_test.py

@@ -0,0 +1,69 @@
+import time
+import requests
+from .server.check_events_from_mock import (
+    fetch_events_from_mock,
+    filter_on_event_type,
+    validate_started_event,
+    validate_heartbeat,
+)
+
+base_url_fw = "http://localhost:8114"
+base_url_nofw = "http://localhost:8115"
+
+
+def test_firewall_started_okay():
+    events = fetch_events_from_mock("http://localhost:5000")
+    started_events = filter_on_event_type(events, "started")
+    assert len(started_events) == 1
+    validate_started_event(started_events[0], None)
+
+
+def test_homepage_with_firewall():
+    res = requests.get(f"{base_url_fw}/")
+    assert res.status_code == 200
+
+
+def test_homepage_without_firewall():
+    res = requests.get(f"{base_url_nofw}/")
+    assert res.status_code == 200
+
+
+def test_sync_route_with_firewall():
+    res = requests.get(f"{base_url_fw}/sync_route")
+    assert res.status_code == 200
+
+
+def test_sync_route_without_firewall():
+    res = requests.get(f"{base_url_nofw}/sync_route")
+    assert res.status_code == 200
+
+
+def test_shell_injection_with_firewall():
+    res = requests.get(f"{base_url_fw}/shell/ls;echo test")
+    assert res.status_code == 500
+
+    time.sleep(5)
+    events = fetch_events_from_mock("http://localhost:5000")
+    attacks = filter_on_event_type(events, "detected_attack")
+
+    assert len(attacks) == 1
+    assert attacks[0]["attack"]["blocked"] == True
+    assert attacks[0]["attack"]["kind"] == "shell_injection"
+    assert attacks[0]["attack"]["operation"] == "subprocess.Popen"
+    assert attacks[0]["attack"]["source"] == "routeParams"
+
+
+def test_shell_injection_without_firewall():
+    res = requests.get(f"{base_url_nofw}/shell/ls")
+    assert res.status_code == 200
+
+
+def test_initial_heartbeat():
+    time.sleep(55)
+    events = fetch_events_from_mock("http://localhost:5000")
+    heartbeat_events = filter_on_event_type(events, "heartbeat")
+    assert len(heartbeat_events) == 1
+    routes = heartbeat_events[0]["routes"]
+    route_paths = sorted([r["path"] for r in routes])
+    assert "/" in route_paths
+    assert "/sync_route" in route_paths

sample-apps/fastapi-old/Makefile

@@ -0,0 +1,16 @@
+include ../common.mk
+
+PORT = 8114
+PORT_DISABLED = 8115
+
+.PHONY: run
+run: install
+	@echo "Running sample app fastapi-old with Zen on port $(PORT)"
+	$(AIKIDO_ENV_COMMON) \
+	poetry run uvicorn app:app --host 0.0.0.0 --port $(PORT) --workers 4
+
+.PHONY: runZenDisabled
+runZenDisabled: install
+	@echo "Running sample app fastapi-old without Zen on port $(PORT_DISABLED)"
+	$(AIKIDO_ENV_DISABLED) \
+	poetry run uvicorn app:app --host 0.0.0.0 --port $(PORT_DISABLED) --workers 4

sample-apps/fastapi-old/app.py

@@ -0,0 +1,36 @@
+import aikido_zen
+aikido_zen.protect()
+
+import subprocess
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from aikido_zen.middleware import AikidoFastAPIMiddleware
+
+app = FastAPI()
+app.add_middleware(AikidoFastAPIMiddleware)
+
+
+@app.get("/")
+async def homepage():
+    return JSONResponse({"message": "Hello from old FastAPI"})
+
+
+@app.get("/users/{user_id}")
+async def get_user(user_id: int):
+    return JSONResponse({"user_id": user_id, "name": "Test User"})
+
+
+@app.post("/users")
+async def create_user():
+    return JSONResponse({"message": "User created"}, status_code=201)
+
+
+@app.get("/sync_route")
+def sync_route():
+    return JSONResponse({"message": "This is a sync route"})
+
+
+@app.get("/shell/{command}")
+async def execute_command(command: str):
+    result = subprocess.run(command, capture_output=True, text=True, shell=True)
+    return JSONResponse({"output": result.stdout})

sample-apps/fastapi-old/pyproject.toml

@@ -0,0 +1,20 @@
+[project]
+name = "fastapi-old"
+version = "0.1.0"
+description = "Test app with FastAPI 0.70.0 (starlette 0.16.0) to verify route discovery"
+requires-python = ">3.9.1,<4.0"
+dependencies = [
+    "aikido_zen",
+    "fastapi (>=0.70.0,<0.71.0)",
+    "uvicorn (>=0.34.0,<0.35.0)",
+]
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+package-mode = false
+
+[tool.poetry.dependencies]
+aikido_zen = { path = "../../", develop = true }