8000 Revert "Feature/token passing mini runtime release" by notshivansh · Pull Request #2733 · akto-api-security/akto · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Revert "Feature/token passing mini runtime release" #2733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 30, 2025
Merged

Revert "Feature/token passing mini runtime release" #2733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions apps/api-runtime/src/main/java/com/akto/dependency/DependencyAnalyser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
import com.akto.parsers.HttpCallParser;
import com.akto.runtime.APICatalogSync;
import com.akto.runtime.URLAggregator;
import com.akto.runtime.policies.AuthPolicy;
import com.akto.util.HTTPHeadersExample;
import com.akto.util.JSONUtils;
import com.google.common.base.Charsets;
Expand Down
4 changes: 4 additions & 0 deletions apps/api-runtime/src/main/java/com/akto/parsers/HttpCallParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,16 @@
import com.akto.test_editor.execution.VariableResolver;
import com.akto.test_editor.filter.data_operands_impl.ValidationResult;
import com.akto.usage.UsageMetricCalculator;
import com.akto.util.JSONUtils;
import com.akto.util.http_util.CoreHTTPClient;
import com.akto.util.Constants;
import com.akto.util.DbMode;
import com.akto.util.HttpRequestResponseUtils;
import com.google.gson.Gson;
import com.mongodb.BasicDBObject;
import com.mongodb.client.model.*;
import okhttp3.*;
import org.apache.commons.lang3.StringUtils;
import org.bson.conversions.Bson;

import java.io.IOException;
Expand Down
2 changes: 2 additions & 0 deletions apps/api-runtime/src/main/java/com/akto/runtime/APICatalogSync.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@
import org.slf4j.LoggerFactory;

import java.util.Map.Entry;
import java.util.concurrent.ConcurrentHashMap;
import java.util.regex.Pattern;

import static com.akto.dto.type.KeyTypes.patternToSubType;

Expand Down
2 changes: 2 additions & 0 deletions apps/api-runtime/src/main/java/com/akto/runtime/PayloadAnalyzer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
import com.akto.dto.type.SingleTypeInfo.SubType;
import com.akto.log.LoggerMaker;
import com.akto.log.LoggerMaker.LogDb;
import com.mongodb.BasicDBObject;
import com.mongodb.client.model.Filters;
import com.mongodb.client.model.UpdateOneModel;
import com.mongodb.client.model.UpdateOptions;
import com.mongodb.client.model.Updates;
Expand Down
1 change: 1 addition & 0 deletions apps/api-runtime/src/main/java/com/akto/runtime/RelationshipSync.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.node.ArrayNode;
import com.mongodb.client.model.*;
import org.bson.conversions.Bson;
import com.akto.dto.HttpResponseParams;
Expand Down
4 changes: 3 additions & 1 deletion apps/api-runtime/src/main/java/com/akto/runtime/merge/MergeOnHostOnly.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import java.util.Map;
import java.util.Set;

import com.akto.log.LoggerMaker;
import com.mongodb.client.model.Projections;
import org.bson.conversions.Bson;

Expand All @@ -21,12 +22,13 @@
import com.akto.dao.TrafficInfoDao;
import com.akto.dto.ApiCollection;
import com.akto.dto.ApiInfo;
import com.akto.dto.FilterSampleData;
import com.akto.dto.SensitiveSampleData;
import com.akto.dto.traffic.SampleData;
import com.akto.dto.traffic.TrafficInfo;
import com.akto.dto.type.SingleTypeInfo;
import com.akto.log.LoggerMaker;
import com.akto.util.Util;
import com.mongodb.BasicDBObject;
import com.mongodb.client.model.Filters;
import com.mongodb.client.model.InsertManyOptions;
import com.mongodb.client.model.UpdateOptions;
Expand Down
1 change: 0 additions & 1 deletion apps/api-runtime/src/main/java/com/akto/runtime/policies/AktoPolicyNew.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package com.akto.runtime.policies;

import com.akto.dao.*;
import com.akto.dao.common.AuthPolicy;
import com.akto.dto.*;
import com.akto.dto.ApiInfo.ApiInfoKey;
import com.akto.dto.runtime_filters.RuntimeFilter;
Expand Down
109 changes: 2 additions & 107 deletions .../java/com/akto/dao/common/AuthPolicy.java → ...com/akto/runtime/policies/AuthPolicy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,60 +1,40 @@
package com.akto.dao.common;
package com.akto.runtime.policies;

import com.akto.dto.ApiInfo;
import com.akto.dto.CustomAuthType;
import com.akto.dto.HttpResponseParams;
import com.akto.dto.OriginalHttpRequest;
import com.akto.dto.runtime_filters.RuntimeFilter;
import com.akto.dto.type.KeyTypes;
import com.akto.util.HttpRequestResponseUtils;
import com.akto.util.JSONUtils;

import com.mongodb.BasicDBObject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.util.*;
import com.akto.dto.*;
import com.akto.util.Constants;
import com.akto.util.HttpRequestResponseUtils;
import com.alibaba.fastjson2.JSON;
import com.alibaba.fastjson2.JSONObject;
import org.apache.commons.lang3.math.NumberUtils;

import static com.akto.runtime.utils.Utils.parseCookie;

public class AuthPolicy {

public static final String AUTHORIZATION_HEADER_NAME = "authorization";
public static final String COOKIE_NAME = "cookie";
private static final Logger logger = LoggerFactory.getLogger(AuthPolicy.class);

public static List<String> authHeaders = new ArrayList<>();
public static Map<String, String> headersMap = new HashMap<>();

private static List<ApiInfo.AuthType> findBearerBasicAuth(String header, String value){
value = value.trim();
boolean twoFields = value.split(" ").length == 2;
if (twoFields && value.substring(0, Math.min(6, value.length())).equalsIgnoreCase("bearer")) {
headersMap.put(header, value);
authHeaders.add(header);
return Collections.singletonList(ApiInfo.AuthType.BEARER);
} else if (twoFields && value.substring(0, Math.min(5, value.length())).equalsIgnoreCase("basic")) {
headersMap.put(header, value);
authHeaders.add(header);
return Collections.singletonList(ApiInfo.AuthType.BASIC);
} else if (header.equals(AUTHORIZATION_HEADER_NAME) || header.equals("auth")) {
// todo: check jwt first and then this
headersMap.put(header, value);
authHeaders.add(header);
return Collections.singletonList(ApiInfo.AuthType.AUTHORIZATION_HEADER);
}
return new ArrayList<>();
}

public static boolean findAuthType(HttpResponseParams httpResponseParams, ApiInfo apiInfo, RuntimeFilter filter, List<CustomAuthType> customAuthTypes) {

authHeaders = new ArrayList<>();
headersMap = new HashMap<>();
Set<Set<ApiInfo.AuthType>> allAuthTypesFound = apiInfo.getAllAuthTypesFound();
if (allAuthTypesFound == null) allAuthTypesFound = new HashSet<>();

Expand Down Expand Up @@ -110,8 +90,6 @@ public static boolean findAuthType(HttpResponseParams httpResponseParams, ApiInf
// Find JWT in cookie values
if (KeyTypes.isJWT(cookieMap.get(cookieKey))) {
authTypes.add(ApiInfo.AuthType.JWT);
headersMap.put(cookieKey, cookieMap.get(cookieKey));
authHeaders.add(cookieKey);
flag = true;
}
}
Expand All @@ -127,8 +105,6 @@ public static boolean findAuthType(HttpResponseParams httpResponseParams, ApiInf
if (KeyTypes.isJWT(header)){
authTypes.add(ApiInfo.AuthType.JWT);
flag = true;
headersMap.put(headerName, header);
authHeaders.add(headerName);
break;
}
}
Expand All @@ -144,87 +120,6 @@ public static boolean findAuthType(HttpResponseParams httpResponseParams, ApiInf
allAuthTypesFound.add(authTypes);
apiInfo.setAllAuthTypesFound(allAuthTypesFound);

if(!headersMap.isEmpty()) {
for (int i = 0; i < headersMap.size(); i++) {
logger.info("HeaderMap found: {}, {}", headersMap.get(i), headersMap.get(i));
}
}

return returnValue;
}

public static Map<String,String> parseCookie(List<String> cookieList){
Map<String,String> cookieMap = new HashMap<>();
if(cookieList==null)return cookieMap;
for (String cookieValues : cookieList) {
String[] cookies = cookieValues.split(";");
for (String cookie : cookies) {
cookie=cookie.trim();
String[] cookieFields = cookie.split("=");
boolean twoCookieFields = cookieFields.length == 2;
if (twoCookieFields) {
if(!cookieMap.containsKey(cookieFields[0])){
cookieMap.put(cookieFields[0], cookieFields[1]);
}
}
}
}
return cookieMap;
}

public static HttpResponseParams parseSampleData(String sample) throws Exception {

//convert java object to JSON format

JSONObject jsonObject = JSON.parseObject(sample);

String method = jsonObject.getString("method");
String url = jsonObject.getString("path");
String type = jsonObject.getString("type");
Map<String,List<String>> requestHeaders = OriginalHttpRequest.buildHeadersMap(jsonObject, "requestHeaders");

String rawRequestPayload = jsonObject.getString("requestPayload");
String requestPayload = null;
Map<String,String> decryptedRequestPayload = HttpRequestResponseUtils.decryptRequestPayload(rawRequestPayload);
if(!decryptedRequestPayload.isEmpty() && decryptedRequestPayload.get("type") != null){
requestPayload = decryptedRequestPayload.get("payload");
logger.info("decrypted request payload: " + requestPayload);
requestHeaders.put(
Constants.AKTO_DECRYPT_HEADER,
Arrays.asList(decryptedRequestPayload.get("type"))
);
}else{
requestPayload = HttpRequestResponseUtils.rawToJsonString(rawRequestPayload,requestHeaders);
}
String apiCollectionIdStr = jsonObject.getOrDefault("akto_vxlan_id", "0").toString();
int apiCollectionId = 0;
if (NumberUtils.isDigits(apiCollectionIdStr)) {
apiCollectionId = NumberUtils.toInt(apiCollectionIdStr, 0);
}

HttpRequestParams requestParams = new HttpRequestParams(
method,url,type, requestHeaders, requestPayload, apiCollectionId
);

int statusCode = jsonObject.getInteger("statusCode");
String status = jsonObject.getString("status");
Map<String,List<String>> responseHeaders = OriginalHttpRequest.buildHeadersMap(jsonObject, "responseHeaders");
String payload = jsonObject.getString("responsePayload");
payload = HttpRequestResponseUtils.rawToJsonString(payload, responseHeaders);
payload = JSONUtils.parseIfJsonP(payload);
int time = jsonObject.getInteger("time");
String accountId = jsonObject.getString("akto_account_id");
String sourceIP = jsonObject.getString("ip");
String destIP = jsonObject.getString("destIp");
String direction = jsonObject.getString("direction");

String isPendingStr = (String) jsonObject.getOrDefault("is_pending", "false");
boolean isPending = !isPendingStr.toLowerCase().equals("false");
String sourceStr = (Stri 17AE ng) jsonObject.getOrDefault("source", HttpResponseParams.Source.OTHER.name());
HttpResponseParams.Source source = HttpResponseParams.Source.valueOf(sourceStr);

return new HttpResponseParams(
type,statusCode, status, responseHeaders, payload, requestParams, time, accountId, isPending, source, sample, sourceIP, destIP, direction
);
}
}
2 changes: 1 addition & 1 deletion apps/api-runtime/src/main/java/com/akto/utils/RedactSampleData.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import com.akto.log.LoggerMaker;
import com.akto.log.LoggerMaker.LogDb;
import com.akto.parsers.HttpCallParser;
import com.akto.dao.common.AuthPolicy;
import com.akto.runtime.policies.AuthPolicy;
import com.fasterxml.jackson.core.JsonFactory;
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.core.JsonProcessingException;
Expand Down
1 change: 0 additions & 1 deletion apps/api-runtime/src/test/java/com/akto/runtime/policies/AuthPolicyTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

import com.akto.MongoBasedTest;
import com.akto.dao.CustomAuthTypeDao;
import com.akto.dao.common.AuthPolicy;
import com.akto.dto.ApiInfo;
import com.akto.dto.CustomAuthType;
import com.akto.dto.HttpRequestParams;
Expand Down
2 changes: 2 additions & 0 deletions apps/billing/src/main/java/com/akto/action/billing/OrganizationAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,13 @@
import com.akto.log.LoggerMaker.LogDb;
import com.akto.stigg.StiggReporterClient;
import com.akto.util.UsageUtils;
import com.mongodb.BasicDBObject;
import com.mongodb.client.model.Filters;
import com.mongodb.client.model.Updates;
import com.opensymphony.xwork2.Action;
import org.bson.conversions.Bson;

import static com.opensymphony.xwork2.Action.ERROR;
import static com.opensymphony.xwork2.Action.SUCCESS;

import java.util.UUID;
Expand Down
5 changes: 5 additions & 0 deletions apps/billing/src/main/java/com/akto/listener/InitializerListener.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,14 @@
import com.mongodb.ConnectionString;
import com.mongodb.client.model.Filters;
import com.mongodb.client.model.Updates;
import org.bson.conversions.Bson;
import org.mockito.internal.matchers.Or;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import static com.akto.dto.billing.OrganizationUsage.ORG_ID;
import static com.akto.dto.billing.OrganizationUsage.SINKS;

public class InitializerListener implements ServletContextListener {
public static boolean connectedToMongo = false;
ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(2);
Expand Down
11 changes: 11 additions & 0 deletions apps/dashboard/src/main/java/com/akto/action/ApiCollectionsAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@

import org.bson.conversions.Bson;

import com.akto.action.observe.Utils;
import com.akto.dao.*;
import com.akto.billing.UsageMetricUtils;
import com.akto.dao.billing.OrganizationsDao;
import com.akto.dao.context.Context;
import com.akto.dao.testing.TestingRunDao;
import com.akto.dto.ApiCollection;
Expand All @@ -21,27 +23,36 @@
import com.akto.dto.ApiInfo.ApiInfoKey;
import com.akto.dto.testing.CustomTestingEndpoints;
import com.akto.dto.CollectionConditions.ConditionUtils;
import com.akto.dto.billing.Organization;
import com.akto.dto.type.SingleTypeInfo;
import com.akto.dto.usage.MetricTypes;
import com.akto.dto.usage.UsageMetric;
import com.akto.listener.RuntimeListener;
import com.akto.log.LoggerMaker;
import com.akto.log.LoggerMaker.LogDb;
import com.akto.usage.UsageMetricHandler;
import com.akto.dto.ApiInfo;
import com.akto.dto.SensitiveSampleData;
import com.akto.dto.ApiCollection.ENV_TYPE;
import com.akto.dto.traffic.SampleData;
import com.akto.dto.type.URLMethods;
import com.akto.log.LoggerMaker;
import com.akto.util.Constants;
import com.akto.util.LastCronRunInfo;
import com.mongodb.client.model.Accumulators;
import com.mongodb.client.model.Filters;
import com.mongodb.client.model.FindOneAndUpdateOptions;
import com.mongodb.client.model.Updates;
import com.mongodb.BasicDBObject;
import com.mongodb.client.model.Updates;
import com.mongodb.client.result.DeleteResult;
import com.mongodb.client.result.UpdateResult;
import com.mongodb.client.model.Sorts;
import com.mongodb.client.model.UnwindOptions;
import com.opensymphony.xwork2.Action;
import org.apache.commons.lang3.tuple.Pair;
import org.bson.Document;
import com.mongodb.client.result.UpdateResult;

public class ApiCollectionsAction extends UserAction {

Expand Down
21 changes: 21 additions & 0 deletions apps/dashboard/src/main/java/com/akto/action/BurpJarAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,36 @@
import com.akto.dto.ApiToken.Utility;
import com.akto.listener.InitializerListener;
import com.akto.log.LoggerMaker;
import com.akto.log.LoggerMaker.LogDb;
import com.mongodb.BasicDBObject;
import com.mongodb.client.model.Filters;
import com.mongodb.client.model.Updates;

import kotlin.text.Charsets;
import org.apache.commons.io.FileUtils;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.util.EntityUtils;
import org.apache.struts2.interceptor.ServletRequestAware;
import org.apache.struts2.interceptor.ServletResponseAware;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import java.nio.file.Files;
import java.util.Enumeration;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.jar.JarEntry;
import java.util.jar.JarFile;
import java.util.jar.JarOutputStream;

public class BurpJarAction extends UserAction implements ServletResponseAware, ServletRequestAware {

Expand Down
Loading
Loading
0