diff --git a/backend/app_sdk/app_base.py b/backend/app_sdk/app_base.py index 9d397aeb..75d0acb4 100644 --- a/backend/app_sdk/app_base.py +++ b/backend/app_sdk/app_base.py @@ -1708,23 +1708,21 @@ class AppBase: if values != None: added = 0 for val in values: - #print(f"VAL: {val}") - #parameter["value"].replace(val["key"], val["value"], -1) - #print(f'PARAM1: {action["parameters"][counter]["value"]}') - action["parameters"][counter]["value"] = action["parameters"][counter]["value"].replace(val["key"], val["value"], 1) - #action["parameters"][counter]["value"].replace(r"${url}", r"$Find_URLs.valid.#.data", 1) - #print(f'PARAM2: {action["parameters"][counter]["value"]}') - #newparams.append({ - # "name": val["key"], - # "value": val["value"], - # "variant": "STATIC_VALUE", - # "id": "body_replacement", - # "schema": { - # "type": "string", - # }, - #}) + replace_value = val["value"] + replace_key = val["key"] + if (val["value"].startswith("{") and val["value"].endswith("}")) or (val["value"].startswith("[") and val["value"].endswith("]")): + print(f"""Trying to parse as JSON: {val["value"]}""") + try: + value_replace = json.loads(val["value"]) + # If it gets here, remove the "" infront and behind the key as well since this is preventing the JSON from being loaded + replace_key = f"\"{replace_key}\"" + except json.decoder.JSONDecodeError as e: + print("Failed JSON replacement for OpenAPI %s", val["key"]) + elif val["value"].lower() == "true" or val["value"].lower() == "false": + replace_key = f"\"{replace_key}\"" + + action["parameters"][counter]["value"] = action["parameters"][counter]["value"].replace(replace_key, replace_value, 1) - #print(f'[INFO] Added param {val["key"]} for body with value {val["value"]} (using OpenAPI)') print(f'[INFO] Added param {val["key"]} for body (using OpenAPI)') added += 1 @@ -1735,6 +1733,34 @@ class AppBase: print("KeyError body OpenAPI: %s" % e) pass + try: + newvalue = json.loads(action["parameters"][counter]["value"]) + deletekeys = [] + for key, value in newvalue.items(): + if isinstance(value, str) and len(value) == 0: + deletekeys.append(key) + continue + + for deletekey in deletekeys: + del newvalue[deletekey] + + action["parameters"][counter]["value"] = json.dumps(newvalue) + + except json.decoder.JSONDecodeError as e: + print("Failed JSON replacement for OpenAPI keys (2) %s", val["key"]) + + #if "\n" in action["parameters"][counter]["value"]: + # print("MODIFYING BODY!!") + # newbody = "" + # for line in action["parameters"][counter]["value"].split("\n"): + # if ": \"\"" in line: + # print("Skipping line %s" % line) + # continue + + # newbody += line + + # print("New body: %s" % newbody) + break #print(action["parameters"]) diff --git a/backend/app_sdk/build.sh b/backend/app_sdk/build.sh index 695cacd6..ca82bf90 100644 --- a/backend/app_sdk/build.sh +++ b/backend/app_sdk/build.sh @@ -1,6 +1,6 @@ #!/bin/bash NAME=shuffle-app_sdk -VERSION=0.8.71 +VERSION=0.8.72 docker rmi docker.pkg.github.com/frikky/shuffle/$NAME:$VERSION --force docker build . -t frikky/shuffle:app_sdk -t frikky/$NAME:$VERSION -t docker.pkg.github.com/frikky/shuffle/$NAME:$VERSION -t ghcr.io/frikky/$NAME:$VERSION diff --git a/backend/go-app/go.mod b/backend/go-app/go.mod index 55b11a4d..58cb8459 100644 --- a/backend/go-app/go.mod +++ b/backend/go-app/go.mod @@ -2,7 +2,7 @@ module shuffle go 1.13 -replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared +//replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared //replace github.com/frikky/kin-openapi => ../../../../git/kin-openapi @@ -20,7 +20,7 @@ require ( github.com/docker/go-connections v0.4.0 github.com/docker/go-units v0.4.0 // indirect github.com/frikky/kin-openapi v0.38.0 - github.com/frikky/shuffle-shared v0.0.23 + github.com/frikky/shuffle-shared v0.0.27 github.com/ghodss/yaml v1.0.0 github.com/go-git/go-billy/v5 v5.0.0 github.com/go-git/go-git/v5 v5.0.0 diff --git a/backend/go-app/main.go b/backend/go-app/main.go index 501384cc..dd437a88 100644 --- a/backend/go-app/main.go +++ b/backend/go-app/main.go @@ -10,6 +10,8 @@ import ( "crypto/md5" "encoding/hex" "encoding/json" + //"unicode/utf8" + "errors" "path/filepath" @@ -4191,7 +4193,7 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) { return } - log.Printf("[INFO] EDITING APP WITH ID %s", app.ID) + log.Printf("[INFO] EDITING APP WITH ID %s and md5 %s", app.ID, newmd5) newmd5 = app.ID } @@ -4199,11 +4201,29 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) { // Test = client side with fetch? ctx := context.Background() + //s := string(body) + //if !utf8.ValidString(s) { + // v := make([]rune, 0, len(s)) + // for i, r := range s { + // if r == utf8.RuneError { + // _, size := utf8.DecodeRuneInString(s[i:]) + // if size == 1 { + // continue + // } + // } + // v = append(v, r) + // } + // s = string(v) + //} + //fmt.Printf("%q\n", s) + + //body = []byte(strings.Replace(string(body), '<80>', '', -1)) + + //log.Println(string(body)) swaggerLoader := openapi3.NewSwaggerLoader() swaggerLoader.IsExternalRefsAllowed = true swagger, err := swaggerLoader.LoadSwaggerFromData(body) if err != nil { - log.Println(string(body)) log.Printf("[ERROR] Swagger validation error: %s", err) resp.WriteHeader(500) resp.Write([]byte(`{"success": false, "reason": "Failed verifying openapi"}`)) diff --git a/docker-compose.yml b/docker-compose.yml index 56fd9a3c..f9399d8c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3' services: frontend: #build: ./frontend - image: ghcr.io/frikky/shuffle-frontend:0.8.71 + image: ghcr.io/frikky/shuffle-frontend:0.8.72 container_name: shuffle-frontend hostname: shuffle-frontend ports: @@ -17,7 +17,7 @@ services: - backend backend: #build: ./backend - image: ghcr.io/frikky/shuffle-backend:0.8.71 + image: ghcr.io/frikky/shuffle-backend:0.8.72 container_name: shuffle-backend hostname: ${BACKEND_HOSTNAME} # Here for debugging: @@ -47,7 +47,7 @@ services: - database orborus: #build: ./functions/onprem/orborus - image: ghcr.io/frikky/shuffle-orborus:0.8.71 + image: ghcr.io/frikky/shuffle-orborus:0.8.72 container_name: shuffle-orborus hostname: shuffle-orborus networks: @@ -56,7 +56,7 @@ services: - /var/run/docker.sock:/var/run/docker.sock environment: - SHUFFLE_APP_SDK_VERSION=0.8.60 - - SHUFFLE_WORKER_VERSION=0.8.71 + - SHUFFLE_WORKER_VERSION=0.8.72 - ORG_ID=${ORG_ID} - ENVIRONMENT_NAME=${ENVIRONMENT_NAME} - BASE_URL=http://${OUTER_HOSTNAME}:${BACKEND_PORT} diff --git a/frontend/src/components/ParsedAction.jsx b/frontend/src/components/ParsedAction.jsx index c5295876..6b8e4938 100644 --- a/frontend/src/components/ParsedAction.jsx +++ b/frontend/src/components/ParsedAction.jsx @@ -1405,7 +1405,7 @@ const ParsedAction = (props) => {
{selectedAction.description}
: null} -
+
diff --git a/frontend/src/views/AngularWorkflow.jsx b/frontend/src/views/AngularWorkflow.jsx index bc03a65b..eb2cf843 100644 --- a/frontend/src/views/AngularWorkflow.jsx +++ b/frontend/src/views/AngularWorkflow.jsx @@ -4412,7 +4412,7 @@ const AngularWorkflow = (props) => {
- API-key: + API-key
{ //console.log("Handle requestbody: ", methodvalue["requestBody"]) if (methodvalue["requestBody"]["content"] !== undefined) { if (methodvalue["requestBody"]["content"]["application/json"] !== undefined) { + newaction["headers"] = "Content-Type=application/json\nAccept=application/json" if (methodvalue["requestBody"]["content"]["application/json"]["schema"] !== undefined && methodvalue["requestBody"]["content"]["application/json"]["schema"] !== null) { if (methodvalue["requestBody"]["content"]["application/json"]["schema"]["properties"] !== undefined) { var tmpobject = {} @@ -558,11 +559,13 @@ const AppCreator = (props) => { const parsedkey = propkey.replaceAll(" ", "_").toLowerCase() newbody[parsedkey] = "${"+parsedkey+"}" } + newaction["body"] = JSON.stringify(newbody, null, 2) } } } else if (methodvalue["requestBody"]["content"]["application/xml"] !== undefined) { console.log("METHOD XML: ", methodvalue) + newaction["headers"] = "Content-Type=application/xml\nAccept=application/xml" if (methodvalue["requestBody"]["content"]["application/xml"]["schema"] !== undefined && methodvalue["requestBody"]["content"]["application/xml"]["schema"] !== null) { if (methodvalue["requestBody"]["content"]["application/xml"]["schema"]["properties"] !== undefined) { var tmpobject = {} @@ -851,6 +854,9 @@ const AppCreator = (props) => { } if (securitySchemes !== undefined) { + // FIXME: Should add Oauth2 (Microsoft) and JWT (Wazuh) + //console.log("SECURITY: ", securitySchemes) + //if (Object.entries(securitySchemes) > 1 && for (const [key, value] of Object.entries(securitySchemes)) { if (value.scheme === "bearer") { setAuthenticationOption("Bearer auth") @@ -1240,7 +1246,7 @@ const AppCreator = (props) => { 'Content-Type': 'application/json', 'Accept': 'application/json', }, - body: JSON.stringify(data), + body: JSON.stringify(data, null, 4), credentials: "include", }) .then((response) => { @@ -2428,8 +2434,8 @@ const AppCreator = (props) => { Cancel diff --git a/frontend/src/views/Workflows.jsx b/frontend/src/views/Workflows.jsx index ddd62883..b06b8a7d 100644 --- a/frontend/src/views/Workflows.jsx +++ b/frontend/src/views/Workflows.jsx @@ -595,7 +595,7 @@ const Workflows = (props) => { for (var subkey in data.actions[key].parameters) { const param = data.actions[key].parameters[subkey] - if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret") || param.name.includes("domain") || param.name.includes("url")) { + if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret") || param.name.includes("domain") || param.name.includes("url") || param.name.includes("mail")) { // FIXME: This may be a vuln if api-keys are generated that start with $ if (param.value.startsWith("$")) { console.log("Skipping field, as it's referencing a variable") @@ -629,7 +629,7 @@ const Workflows = (props) => { if (data.workflow_variables !== null && data.workflow_variables !== undefined) { for (var key in data.workflow_variables) { const param = data.workflow_variables[key] - if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret")) { + if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret")|| param.name.includes("email")) { param.value = "" param.is_valid = false }