sinks: run idor checks [wip]

Author: bitterpanda63

aikido_zen/sinks/asyncpg.py

@@ -6,6 +6,7 @@
 from aikido_zen.helpers.get_argument import get_argument
 from aikido_zen.helpers.register_call import register_call
 from aikido_zen.sinks import patch_function, before, on_import
+from aikido_zen.vulnerabilities.idor.check_idor import run_idor_check
 
 
 @before
@@ -17,6 +18,10 @@ def _execute(func, instance, args, kwargs):
 
     vulns.run_vulnerability_scan(kind="sql_injection", op=op, args=(query, "postgres"))
 
+    # asyncpg uses variadic positional args for params: execute(query, *args)
+    query_params = args[1:] if len(args) > 1 else None
+    run_idor_check(query, "postgres", query_params)
+
 
 @on_import("asyncpg.connection", "asyncpg", version_requirement="0.27.0")
 def patch(m):

aikido_zen/sinks/clickhouse_driver.py

@@ -2,6 +2,7 @@
 from aikido_zen.helpers.register_call import register_call
 from aikido_zen.sinks import before, on_import, patch_function
 from aikido_zen.vulnerabilities import run_vulnerability_scan
+from aikido_zen.vulnerabilities.idor.check_idor import run_idor_check
 
 
 @before
@@ -13,6 +14,9 @@ def _execute(func, instance, args, kwargs):
 
     run_vulnerability_scan("sql_injection", op, args=(query, "clickhouse"))
 
+    query_params = get_argument(args, kwargs, 1, "params")
+    run_idor_check(query, "clickhouse", query_params)
+
 
 @on_import("clickhouse_driver", package="clickhouse_driver")
 def patch(m):

aikido_zen/sinks/mysqlclient.py

@@ -6,6 +6,7 @@
 import aikido_zen.vulnerabilities as vulns
 from aikido_zen.helpers.register_call import register_call
 from aikido_zen.sinks import patch_function, on_import, before
+from aikido_zen.vulnerabilities.idor.check_idor import run_idor_check
 
 
 @before
@@ -20,6 +21,9 @@ def _execute(func, instance, args, kwargs):
         kind="sql_injection", op="MySQLdb.Cursor.execute", args=(query, "mysql")
     )
 
+    query_params = get_argument(args, kwargs, 1, "args")
+    run_idor_check(query, "mysql", query_params)
+
 
 @before
 def _executemany(func, instance, args, kwargs):
@@ -30,6 +34,9 @@ def _executemany(func, instance, args, kwargs):
         kind="sql_injection", op="MySQLdb.Cursor.executemany", args=(query, "mysql")
     )
 
+    query_params = get_argument(args, kwargs, 1, "args")
+    run_idor_check(query, "mysql", query_params)
+
 
 @on_import("MySQLdb.cursors", "mysqlclient", version_requirement="1.5.0")
 def patch(m):

aikido_zen/sinks/psycopg.py

@@ -6,6 +6,7 @@
 from aikido_zen.helpers.get_argument import get_argument
 from aikido_zen.helpers.register_call import register_call
 from aikido_zen.sinks import patch_function, on_import, before
+from aikido_zen.vulnerabilities.idor.check_idor import run_idor_check
 
 
 @before
@@ -25,6 +26,9 @@ def _execute(func, instance, args, kwargs):
     op = f"psycopg.{instance.__class__.__name__}.{func.__name__}"
     vulns.run_vulnerability_scan(kind="sql_injection", op=op, args=(query, "postgres"))
 
+    query_params = get_argument(args, kwargs, 1, "params")
+    run_idor_check(query, "postgres", query_params)
+
 
 @on_import("psycopg.cursor", "psycopg", version_requirement="3.1.0")
 def patch(m):

aikido_zen/sinks/psycopg2.py

@@ -7,6 +7,7 @@
 from aikido_zen.helpers.get_argument import get_argument
 from aikido_zen.helpers.register_call import register_call
 from aikido_zen.sinks import on_import, before, patch_function, after
+from aikido_zen.vulnerabilities.idor.check_idor import run_idor_check
 
 
 @after
@@ -42,6 +43,9 @@ def psycopg2_patch(func, instance, args, kwargs):
 
     vulns.run_vulnerability_scan(kind="sql_injection", op=op, args=(query, "postgres"))
 
+    query_params = get_argument(args, kwargs, 1, "vars")
+    run_idor_check(query, "postgres", query_params)
+
 
 @on_import("psycopg2")
 def patch(m):

aikido_zen/sinks/pymysql.py

@@ -6,6 +6,7 @@
 from aikido_zen.helpers.get_argument import get_argument
 from aikido_zen.helpers.register_call import register_call
 from aikido_zen.sinks import patch_function, on_import, before
+from aikido_zen.vulnerabilities.idor.check_idor import run_idor_check
 
 
 @before
@@ -20,6 +21,9 @@ def _execute(func, instance, args, kwargs):
         kind="sql_injection", op="pymysql.Cursor.execute", args=(query, "mysql")
     )
 
+    query_params = get_argument(args, kwargs, 1, "args")
+    run_idor_check(query, "mysql", query_params)
+
 
 @before
 def _executemany(func, instance, args, kwargs):
@@ -30,6 +34,9 @@ def _executemany(func, instance, args, kwargs):
         kind="sql_injection", op="pymysql.Cursor.executemany", args=(query, "mysql")
     )
 
+    query_params = get_argument(args, kwargs, 1, "args")
+    run_idor_check(query, "mysql", query_params)
+
 
 @on_import("pymysql.cursors", "pymysql", version_requirement="0.9.0")
 def patch(m):