rename to should_block_outbound_domain and rm bypassed ip check

Author: bitterpanda63

aikido_zen/sinks/socket/__init__.py

@@ -1,10 +1,11 @@
 """
 Sink module for `socket`
 """
-
+from aikido_zen.errors import AikidoSSRF
 from aikido_zen.helpers.get_argument import get_argument
 from aikido_zen.sinks import on_import, patch_function, after
-from aikido_zen.sinks.socket.report_and_check_hostname import report_and_check_hostname
+from aikido_zen.sinks.socket.normalize_hostname import normalize_hostname
+from aikido_zen.sinks.socket.should_block_outbound_domain import should_block_outbound_domain
 from aikido_zen.vulnerabilities import run_vulnerability_scan
 
 
@@ -14,7 +15,13 @@ def _getaddrinfo_after(func, instance, args, kwargs, return_value):
     host = get_argument(args, kwargs, 0, "host")
     port = get_argument(args, kwargs, 1, "port")
 
-    report_and_check_hostname(host, port)
+    # We want a normalized hostname for reporting & blocking outbound domains
+    # This function decodes the hostname if its written in punycode
+    hostname = normalize_hostname(host)
+
+    # Store hostname and check if we should stop this request from happening
+    if should_block_outbound_domain(host, port):
+        raise AikidoSSRF(f"Zen has blocked an outbound connection to {hostname}")
 
     # Run vulnerability scan with the return value (DNS results)
     op = "socket.getaddrinfo"

aikido_zen/sinks/socket/report_and_check_hostname.py

@@ -0,0 +1,13 @@
+from aikido_zen.context import get_current_context
+from aikido_zen.errors import AikidoSSRF
+from aikido_zen.sinks.socket.normalize_hostname import normalize_hostname
+from aikido_zen.thread.thread_cache import get_cache
+
+
+def should_block_outbound_domain(hostname, port):
+    process_cache = get_cache()
+    if not process_cache:
+        return False
+    process_cache.hostnames.add(hostname, port)
+
+    return process_cache.config.should_block_outgoing_request(hostname)