Class: Aikido::Zen::Context

Inherits:
Object
  • Object
show all
Defined in:
lib/aikido/zen/context.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(request, settings: Aikido::Zen.runtime_settings) {|request| ... } ⇒ Context

Returns a new instance of Context.

Parameters:

  • request (Rack::Request) —

    a Request object that implements the Rack::Request API, to which we will delegate behavior.

  • settings (Aikido::Zen::RuntimeSettings) (defaults to: Aikido::Zen.runtime_settings)

Yield Parameters:

  • request (Rack::Request) —

    the given request object.

Yield Returns:

  • (Hash<Symbol, #flat_map>) —

    map of payload source types to the actual data from the request to populate them.



48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/aikido/zen/context.rb', line 48

def initialize(request, settings: Aikido::Zen.runtime_settings, &sources)
  @request = request
  @settings = settings
  @payload_sources = sources

  @metadata = {}
  @scanning = false
  @request_bypassed = nil
  @protection_disabled = false
  @idor_protection_enabled = false
end

Instance Attribute Details

#idor_protection_enabled ⇒ Boolean Also known as: idor_protection_enabled?

Returns:

  • (Boolean) 


38
39
40
 
# File 'lib/aikido/zen/context.rb', line 38

def idor_protection_enabled
  @idor_protection_enabled
end

#protection_disabled ⇒ Boolean Also known as: protection_disabled?

Returns whether attack protection for the currently requested endpoint was disabled on the Aikido dashboard, or if the source IP for this request is in the "Bypass List".

Returns:

  • (Boolean) —

    whether attack protection for the currently requested endpoint was disabled on the Aikido dashboard, or if the source IP for this request is in the "Bypass List".



34
35
36
 
# File 'lib/aikido/zen/context.rb', line 34

def protection_disabled
  @protection_disabled
end

#request ⇒ Aikido::Zen::Request (readonly)

Returns:



21
22
23
 
# File 'lib/aikido/zen/context.rb', line 21

def request
  @request
end

#request_bypassed ⇒ Boolean? Also known as: request_bypassed?

Returns whether the request is bypassed.

Returns:

  • (Boolean, nil) —

    whether the request is bypassed.



28
29
30
 
# File 'lib/aikido/zen/context.rb', line 28

def request_bypassed
  @request_bypassed
end

#scanning ⇒ Boolean Also known as: scanning?

Returns:

  • (Boolean) 


24
25
26
 
# File 'lib/aikido/zen/context.rb', line 24

def scanning
  @scanning
end

Class Method Details

.from_rack_env(env, config = Aikido::Zen.config) ⇒ Aikido::Zen::Context

Build a Context object for the current HTTP request based on the currently configured request builder.

Parameters:

  • env (Hash) —

    the Rack env hash.

  • config (Aikido::Zen::Config) (defaults to: Aikido::Zen.config)

Returns:



16
17
18
 
# File 'lib/aikido/zen/context.rb', line 16

def self.from_rack_env(env, config = Aikido::Zen.config)
  config.request_builder.call(env)
end

Instance Method Details

#[](key) ⇒ Object?

Fetch some metadata stored in the Context.

Parameters:

  • key (String)

Returns:

  • (Object, nil) 


64
65
66
 
# File 'lib/aikido/zen/context.rb', line 64

def [](key)
  @metadata[key]
end

#[]=(key, value) ⇒ void

This method returns an undefined value.

Store some metadata in the Context so other Scanners can use it.

Parameters:

  • key (String)
  • value (Object) 


73
74
75
 
# File 'lib/aikido/zen/context.rb', line 73

def []=(key, value)
  @metadata[key] = value
end

#payloads ⇒ Array<Aikido::Zen::Payload>

Returns list of user inputs from all the different sources we recognize.

Returns:

  • (Array<Aikido::Zen::Payload>) —

    list of user inputs from all the different sources we recognize.



91
92
93
94
95
 
# File 'lib/aikido/zen/context.rb', line 91

def payloads
  @payloads ||= payload_sources.flat_map do |source, data|
    extract_payloads_from(data, source)
  end
end

#update_request(new_request) ⇒ void

This method returns an undefined value.

Overrides the current request, and invalidates any memoized data obtained from it. This is useful for scenarios where setting the request in the middleware isn't enough, such as Rails, where the router modifies it after the middleware has seen it.

Parameters:

  • new_request (Rack::Request) 


84
85
86
87
 
# File 'lib/aikido/zen/context.rb', line 84

def update_request(new_request)
  @payloads = nil
  request.__setobj__(new_request)
end