[TEST] - Add QA testing workflow #266

PopoviciMarian · 2025-09-10T15:56:45Z

No description provided.

.github/workflows/build.yml

* updated path traversal, shell injection, SQL injection, and SSRF checks to utilize TrimInvisible for input sanitization * Update * Update * Add test --------- Co-authored-by: root <[email protected]>

* implement URL normalization function and enhance SSRF detection * add error checking in URL parsing * refactor * add default ports for HTTP and HTTPS schemes * update test * adding user info removal and improving backslash handling in request processing * fix test cases for URL normalization * enhance URL normalization and add test cases for SSRF detection * refactor SSRF test * update * update * add comment to clarify URL parsing error handling * test --------- Co-authored-by: root <[email protected]>

* Add GitHub Actions workflow for building PHP extension images

.github/workflows/build.yml

aikido-pr-checks · 2025-09-11T11:04:52Z

lib/request-processor/helpers/trimInvisible.go

+}
+
+func isTrimRune(r rune) bool {
+	// 1) All Unicxde whitespace


Comment contains typo 'Unicxde' instead of 'Unicode' which makes documentation incorrect. More info

aikido-pr-checks · 2025-09-11T11:04:54Z

lib/request-processor/helpers/tryParseURL.go

 	}
+	// If the port is not present, we need to add it based on the scheme
+	if parsedURL.Port() == "" {
+		port := 0


Default port logic sets port to 0 for non-http/https schemes, resulting in invalid URLs like 'example.com:0'. More info

aikido-pr-checks · 2025-09-15T10:01:48Z

lib/request-processor/helpers/normalizeRequestUrl.go

+func removeCTLByte(urlStr string) string {
+	for i := 0; i < len(urlStr); i++ {
+		if urlStr[i] <= ' ' || urlStr[i] == 0x7f {
+			urlStr = urlStr[:i] + urlStr[i+1:]


Function parameter urlStr is reassigned, making it harder to track the original input value. More info

aikido-pr-checks · 2025-09-15T10:01:49Z

lib/request-processor/vulnerabilities/ssrf/findHostnameInUserInput.go

 		return false
 	}
+	// if hostname contains : we need to add the [ and ] to the hostname (ipv6)
+	if strings.Contains(hostname, ":") {


Parameter 'hostname' is reassigned, making original value unclear. More info

aikido-pr-checks · 2025-09-15T10:01:50Z

lib/request-processor/vulnerabilities/ssrf/findHostnameInUserInput.go


 	userInput = helpers.ExtractResourceOrOriginal(userInput)
-	variants := []string{userInput, "http://" + userInput, "https://" + userInput}
+	userInput = helpers.NormalizeRawUrl(userInput)


Parameter 'userInput' is reassigned, making original value unclear. More info

Co-authored-by: root <[email protected]>

aikido-pr-checks · 2025-09-17T10:19:33Z

lib/request-processor/handle_urls.go

 		}
 	}

+	// if the response is 302, we need to check CURLINFO_REDIRECT_URL


Comment restates obvious code mechanics without explaining why 302 responses need special redirect URL checking. More info

Co-authored-by: root <[email protected]>

aikido-pr-checks · 2025-09-21T16:53:53Z

lib/request-processor/context/event_getters.go

+	return Context.Callback(C.OUTGOING_REQUEST_RESPONSE_CODE)
+}
+
+func GetOutgoingRequestRedirectUrl() string {


Function name GetOutgoingRequestRedirectUrl suggests it returns a URL but actually returns only the hostname portion. More info

.github/workflows/build.yml

+    runs-on: ubuntu-latest
+    needs: [ build_deb ]
+    steps:
+
+      - name: Checkout zen-demo-php
+        uses: actions/checkout@v4
+        with:
+          repository: Aikido-demo-apps/zen-demo-php
+          path: zen-demo-php
+          ref: dev-testing
+          submodules: recursive
+
+      - name: Get Arch
+        run: echo "ARCH=$(uname -m)" >> $GITHUB_ENV
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: aikido-php-firewall.${{ env.ARCH }}.deb
+          path: ./zen-demo-php
+
+      - name: Overwrite aikido.sh install script
+        run: |
+          echo "dpkg -i -E \"/var/www/html/aikido-php-firewall.\$(uname -i).deb\"" > ./zen-demo-php/.fly/scripts/aikido.sh
+        
+      - name: Run Firewall QA Tests
+        uses: AikidoSec/firewall-tester-action@releases/v1
+        with:
+          dockerfile_path: ./zen-demo-php/Dockerfile
+          extra_args: '--env-file=./zen-demo-php/.env.example -e APP_KEY=base64:W2v6u6VR4lURkxuMT9xZ6pdhXSt5rxsmWTbd1HGqlIM='
+          sleep_before_test: 20
+          skip_tests: test_wave_attack,test_rate_limiting_group_id_1_minute
+          max_parallel_tests: 7
+          ignore_failures: true


To fix this problem, we should explicitly set the permissions for the affected job to the minimal necessary privileges. The most conservative default is contents: read, which allows the job to checkout code and read repository contents, but does not allow write operations. This should be added to the test_php_qa_action job definition, immediately after the runs-on: line (line 451, in context), or optionally also at the workflow root for global enforcement. Since only this job is flagged, we will add:

permissions: contents: read

after runs-on: ubuntu-latest (line 451).

aikido-pr-checks · 2025-09-21T17:09:16Z

lib/request-processor/utils/utils.go

+		return ""
+	}
+
+	parts := strings.Split(value, ",")


Function has 6+ levels of nested control flow that could be simplified with early returns or helper functions. More info

* Add GetMethod function to Server class for handling HTTP method overrides - Implemented GetMethod to retrieve the request method, supporting X-HTTP-METHOD-OVERRIDE and _method query parameter for frameworks like Symfony and Laravel. - Added utility function ToUppercase for string manipulation. - Updated GoContextCallback to use the new GetMethod function. * test * Add getMethodFromQuery function to Server class * Refactor getMethodFromQuery to improve query method retrieval * Refactor Symfony request class check in Server.cpp * update * fix * fix --------- Co-authored-by: root <[email protected]>

aikido-pr-checks · 2025-09-23T10:53:55Z

lib/php-extension/Server.cpp

+// Return the method from the query param _method (_GET["_method"])
+std::string Server::GetMethodFromQuery() {
+    zval *get_array;
+    get_array = zend_hash_str_find(&EG(symbol_table), "_GET", sizeof("_GET") - 1);


Pointer get_array is dereferenced without null check after zend_hash_str_find call. More info

aikido-pr-checks · 2025-09-23T10:54:02Z

lib/php-extension/Server.cpp

+std::string Server::GetMethod() {
+    std::string method = ToUppercase(this->GetVar("REQUEST_METHOD"));
+
+    // TODO: Add a check here to see if the request is from Symfony or Laravel


TODO comment indicates incomplete work that should be tracked properly or implemented. More info

* Propagate disk logs env (#274) * Propage disk logs * Remove SQL query logging --------- Co-authored-by: Tudor Timcu <[email protected]> Co-authored-by: root <[email protected]>

Add QA testing workflow

36ca159

github-advanced-security bot found potential problems Sep 10, 2025

View reviewed changes

.github/workflows/build.yml Fixed Show fixed Hide fixed

root added 2 commits September 10, 2025 16:37

fix

8967717

fix

181d17c

github-advanced-security bot found potential problems Sep 10, 2025

View reviewed changes

.github/workflows/build.yml Fixed Show fixed Hide fixed

root and others added 14 commits September 10, 2025 17:04

fix

92adfa9

fix

6a945c3

fix

0cf47e1

fix

bc2e730

fix

f7e603f

fix

a524d11

fix

d5b28c9

fix

bda8082

fix

892df3f

fix

1fb58ac

Add trim invisible helper (#267)

dc124db

* updated path traversal, shell injection, SQL injection, and SSRF checks to utilize TrimInvisible for input sanitization * Update * Update * Add test --------- Co-authored-by: root <[email protected]>

Dev prebaking toolchain (#261) (#269)

c8d8bdd

* Add GitHub Actions workflow for building PHP extension images

Merge branch 'temp-merge-all' into add-qa-tester-action

1ff9b4a

github-advanced-security bot found potential problems Sep 11, 2025

View reviewed changes

.github/workflows/build.yml Fixed Show fixed Hide fixed

aikido-pr-checks bot reviewed Sep 11, 2025

View reviewed changes

test

03d9f6d

PopoviciMarian changed the title ~~Add QA testing workflow~~ [TEST] - Add QA testing workflow Sep 15, 2025

aikido-pr-checks bot reviewed Sep 15, 2025

View reviewed changes

Add handling for 302 redirect responses in request processor (#273)

bf24f11

Co-authored-by: root <[email protected]>

aikido-pr-checks bot reviewed Sep 17, 2025

View reviewed changes

Fix and add tests for GetIpFromRequest function (#276)

c84fe90

Co-authored-by: root <[email protected]>

Fix formatting of the project title in README

5593900

PopoviciMarian closed this Sep 21, 2025

PopoviciMarian reopened this Sep 21, 2025

aikido-pr-checks bot reviewed Sep 21, 2025

View reviewed changes

root added 3 commits September 21, 2025 16:55

Add permissions for content read in GitHub Actions build workflow

babb5db

test

2f2675e

test

6ddef1d

github-advanced-security bot found potential problems Sep 21, 2025

View reviewed changes

test

8e339ff

aikido-pr-checks bot reviewed Sep 21, 2025

View reviewed changes

PopoviciMarian force-pushed the add-qa-tester-action branch from a2eaf75 to 8e339ff Compare September 23, 2025 10:50

aikido-pr-checks bot reviewed Sep 23, 2025

View reviewed changes

Remove sql query logging (#285)

45b2ce3

* Propagate disk logs env (#274) * Propage disk logs * Remove SQL query logging --------- Co-authored-by: Tudor Timcu <[email protected]> Co-authored-by: root <[email protected]>

PopoviciMarian closed this Oct 26, 2025

@@ -449,6 +449,8 @@
               test_php_qa_action:
                 runs-on: ubuntu-latest
+                permissions:
+                  contents: read
                 needs: [ build_deb ]
                 steps:

[TEST] - Add QA testing workflow #266

[TEST] - Add QA testing workflow #266

Uh oh!

Conversation

PopoviciMarian commented Sep 10, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aikido-pr-checks bot Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Check warning

Copilot Autofix

aikido-pr-checks bot Sep 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks bot Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aikido-pr-checks bot Sep 11, 2025 •

edited

Loading

aikido-pr-checks bot Sep 11, 2025 •

edited

Loading

aikido-pr-checks bot Sep 15, 2025 •

edited

Loading

aikido-pr-checks bot Sep 15, 2025 •

edited

Loading

aikido-pr-checks bot Sep 15, 2025 •

edited

Loading

aikido-pr-checks bot Sep 17, 2025 •

edited

Loading

aikido-pr-checks bot Sep 21, 2025 •

edited

Loading

aikido-pr-checks bot Sep 21, 2025 •

edited

Loading

aikido-pr-checks bot Sep 23, 2025 •

edited

Loading

aikido-pr-checks bot Sep 23, 2025 •

edited

Loading