0.8.72 release

backend/app_sdk/app_base.py

@@ -1708,23 +1708,21 @@ class AppBase:
                                     if values != None:
                                         added = 0
                                         for val in values:
-                                            #print(f"VAL: {val}")
+                                            replace_value = val["value"]
-                                            #parameter["value"].replace(val["key"], val["value"], -1)
+                                            replace_key = val["key"]
-                                            #print(f'PARAM1: {action["parameters"][counter]["value"]}')
+                                            if (val["value"].startswith("{") and val["value"].endswith("}")) or (val["value"].startswith("[") and val["value"].endswith("]")):
-                                            action["parameters"][counter]["value"] = action["parameters"][counter]["value"].replace(val["key"], val["value"], 1)
+                                                print(f"""Trying to parse as JSON: {val["value"]}""")
-                                            #action["parameters"][counter]["value"].replace(r"${url}", r"$Find_URLs.valid.#.data", 1)
+                                                try:
-                                            #print(f'PARAM2: {action["parameters"][counter]["value"]}')
+                                                    value_replace = json.loads(val["value"])
-                                            #newparams.append({
+                                                    # If it gets here, remove the "" infront and behind the key as well since this is preventing the JSON from being loaded
-                                            #    "name": val["key"],
+                                                    replace_key = f"\"{replace_key}\""
-                                            #    "value": val["value"],
+                                                except json.decoder.JSONDecodeError as e:
-                                            #    "variant": "STATIC_VALUE",
+                                                    print("Failed JSON replacement for OpenAPI %s", val["key"])
-                                            #    "id": "body_replacement",
+                                            elif val["value"].lower() == "true" or val["value"].lower() == "false":
-                                            #    "schema": {
+                                                replace_key = f"\"{replace_key}\""
-                                            #        "type": "string",
+
-                                            #    },
+                                            action["parameters"][counter]["value"] = action["parameters"][counter]["value"].replace(replace_key, replace_value, 1)
-                                            #})
 
-                                            #print(f'[INFO] Added param {val["key"]} for body with value {val["value"]} (using OpenAPI)')
                                             print(f'[INFO] Added param {val["key"]} for body (using OpenAPI)')
                                             added += 1
 
@@ -1735,6 +1733,34 @@ class AppBase:
                                     print("KeyError body OpenAPI: %s" % e)
                                     pass
 
+                                try:
+                                    newvalue = json.loads(action["parameters"][counter]["value"])
+                                    deletekeys = []
+                                    for key, value in newvalue.items():
+                                        if isinstance(value, str) and len(value) == 0:
+                                            deletekeys.append(key)
+                                            continue
+
+                                    for deletekey in deletekeys:
+                                        del newvalue[deletekey]
+
+                                    action["parameters"][counter]["value"] = json.dumps(newvalue)
+
+                                except json.decoder.JSONDecodeError as e:
+                                    print("Failed JSON replacement for OpenAPI keys (2) %s", val["key"])
+
+                                #if "\n" in action["parameters"][counter]["value"]:
+                                #    print("MODIFYING BODY!!")
+                                #    newbody = ""
+                                #    for line in action["parameters"][counter]["value"].split("\n"):
+                                #        if ": \"\"" in line:
+                                #            print("Skipping line %s" % line)
+                                #            continue
+
+                                #        newbody += line
+
+                                #    print("New body: %s" % newbody)
+
                                 break
 
                         #print(action["parameters"])

backend/app_sdk/build.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 NAME=shuffle-app_sdk
-VERSION=0.8.71
+VERSION=0.8.72
 
 docker rmi docker.pkg.github.com/frikky/shuffle/$NAME:$VERSION --force
 docker build . -t frikky/shuffle:app_sdk -t frikky/$NAME:$VERSION -t docker.pkg.github.com/frikky/shuffle/$NAME:$VERSION -t ghcr.io/frikky/$NAME:$VERSION

backend/go-app/go.mod

@@ -2,7 +2,7 @@ module shuffle
 
 go 1.13
 
-replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared
+//replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared
 
 //replace github.com/frikky/kin-openapi => ../../../../git/kin-openapi
 
@@ -20,7 +20,7 @@ require (
 	github.com/docker/go-connections v0.4.0
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/frikky/kin-openapi v0.38.0
-	github.com/frikky/shuffle-shared v0.0.23
+	github.com/frikky/shuffle-shared v0.0.27
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-git/go-billy/v5 v5.0.0
 	github.com/go-git/go-git/v5 v5.0.0

backend/go-app/main.go

@@ -10,6 +10,8 @@ import (
 	"crypto/md5"
 	"encoding/hex"
 	"encoding/json"
+	//"unicode/utf8"
+
 	"errors"
 	"path/filepath"
 
@@ -4191,7 +4193,7 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) {
 			return
 		}
 
-		log.Printf("[INFO] EDITING APP WITH ID %s", app.ID)
+		log.Printf("[INFO] EDITING APP WITH ID %s and md5 %s", app.ID, newmd5)
 		newmd5 = app.ID
 	}
 
@@ -4199,11 +4201,29 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) {
 	// Test = client side with fetch?
 
 	ctx := context.Background()
+	//s := string(body)
+	//if !utf8.ValidString(s) {
+	//	v := make([]rune, 0, len(s))
+	//	for i, r := range s {
+	//		if r == utf8.RuneError {
+	//			_, size := utf8.DecodeRuneInString(s[i:])
+	//			if size == 1 {
+	//				continue
+	//			}
+	//		}
+	//		v = append(v, r)
+	//	}
+	//	s = string(v)
+	//}
+	//fmt.Printf("%q\n", s)
+
+	//body  = []byte(strings.Replace(string(body), '<80>', '', -1))
+
+	//log.Println(string(body))
 	swaggerLoader := openapi3.NewSwaggerLoader()
 	swaggerLoader.IsExternalRefsAllowed = true
 	swagger, err := swaggerLoader.LoadSwaggerFromData(body)
 	if err != nil {
-		log.Println(string(body))
 		log.Printf("[ERROR] Swagger validation error: %s", err)
 		resp.WriteHeader(500)
 		resp.Write([]byte(`{"success": false, "reason": "Failed verifying openapi"}`))

docker-compose.yml

@@ -2,7 +2,7 @@ version: '3'
 services:
   frontend:
     #build: ./frontend
-    image: ghcr.io/frikky/shuffle-frontend:0.8.71
+    image: ghcr.io/frikky/shuffle-frontend:0.8.72
     container_name: shuffle-frontend
     hostname: shuffle-frontend
     ports:
@@ -17,7 +17,7 @@ services:
       - backend
   backend:
     #build: ./backend
-    image: ghcr.io/frikky/shuffle-backend:0.8.71
+    image: ghcr.io/frikky/shuffle-backend:0.8.72
     container_name: shuffle-backend
     hostname: ${BACKEND_HOSTNAME}
     # Here for debugging:
@@ -47,7 +47,7 @@ services:
       - database
   orborus:
     #build: ./functions/onprem/orborus
-    image: ghcr.io/frikky/shuffle-orborus:0.8.71
+    image: ghcr.io/frikky/shuffle-orborus:0.8.72
     container_name: shuffle-orborus
     hostname: shuffle-orborus
     networks:
@@ -56,7 +56,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       - SHUFFLE_APP_SDK_VERSION=0.8.60
-      - SHUFFLE_WORKER_VERSION=0.8.71
+      - SHUFFLE_WORKER_VERSION=0.8.72
       - ORG_ID=${ORG_ID}
       - ENVIRONMENT_NAME=${ENVIRONMENT_NAME}
       - BASE_URL=http://${OUTER_HOSTNAME}:${BACKEND_PORT}

frontend/src/components/ParsedAction.jsx

@@ -1405,7 +1405,7 @@ const ParsedAction = (props) => {
 				<div style={{marginTop: 10, marginBottom: 10, maxHeight: 60, overflow: "hidden"}}>
 					{selectedAction.description}
 				</div> : null}
-				<div style={{marginTop: "10px", borderColor: "white", borderWidth: "2px", marginBottom: 50,}}>
+				<div style={{marginTop: "10px", borderColor: "white", borderWidth: "2px", marginBottom: hideExtraTypes ? 50 : 200 ,}}>
 					<AppActionArguments key={selectedAction.id} selectedAction={selectedAction} />
 				</div>
 			</div>

frontend/src/views/AngularWorkflow.jsx

@@ -4412,7 +4412,7 @@ const AngularWorkflow = (props) => {
 							<div style={{marginTop: "20px", marginBottom: "7px", display: "flex"}}>
 								<div style={{width: "17px", height: "17px", borderRadius: 17 / 2, backgroundColor: "#f85a3e", marginRight: "10px"}}/>
 								<div style={{flex: "10"}}> 
-									<b>API-key: </b> 
+									<b>API-key </b> 
 								</div>
 							</div>
 							<TextField

frontend/src/views/AppCreator.jsx

@@ -536,6 +536,7 @@ const AppCreator = (props) => {
 						//console.log("Handle requestbody: ", methodvalue["requestBody"])
 						if (methodvalue["requestBody"]["content"] !== undefined) {
 							if (methodvalue["requestBody"]["content"]["application/json"] !== undefined) {
+								newaction["headers"] = "Content-Type=application/json\nAccept=application/json"
 								if (methodvalue["requestBody"]["content"]["application/json"]["schema"] !== undefined && methodvalue["requestBody"]["content"]["application/json"]["schema"] !== null) {
 									if (methodvalue["requestBody"]["content"]["application/json"]["schema"]["properties"] !== undefined) {
 										var tmpobject = {}
@@ -558,11 +559,13 @@ const AppCreator = (props) => {
 											const parsedkey = propkey.replaceAll(" ", "_").toLowerCase() 
 											newbody[parsedkey] = "${"+parsedkey+"}"
 										}
+
 										newaction["body"] = JSON.stringify(newbody, null, 2)
 									}
 								}
 							} else if (methodvalue["requestBody"]["content"]["application/xml"] !== undefined) {
 								console.log("METHOD XML: ", methodvalue)
+								newaction["headers"] = "Content-Type=application/xml\nAccept=application/xml"
 								if (methodvalue["requestBody"]["content"]["application/xml"]["schema"] !== undefined && methodvalue["requestBody"]["content"]["application/xml"]["schema"] !== null) {
 									if (methodvalue["requestBody"]["content"]["application/xml"]["schema"]["properties"] !== undefined) {
 										var tmpobject = {}
@@ -851,6 +854,9 @@ const AppCreator = (props) => {
 		}
 
 		if (securitySchemes !== undefined) {
+			// FIXME: Should add Oauth2 (Microsoft) and JWT (Wazuh)
+			//console.log("SECURITY: ", securitySchemes)
+			//if (Object.entries(securitySchemes) > 1 && 
 			for (const [key, value] of Object.entries(securitySchemes)) {
 				if (value.scheme === "bearer") {
 					setAuthenticationOption("Bearer auth")
@@ -1240,7 +1246,7 @@ const AppCreator = (props) => {
 					'Content-Type': 'application/json',
 					'Accept': 'application/json',
 				},
-				body: JSON.stringify(data),
+				body: JSON.stringify(data, null, 4),
 	  			credentials: "include",
     		})
 		.then((response) => {
@@ -2428,8 +2434,8 @@ const AppCreator = (props) => {
 						Cancel
 					</Button>
 					<Button variant="contained" style={{borderRadius: "0px"}} disabled={disableImageUpload} onClick={() => {
-								onSaveAppIcon()
+						onSaveAppIcon()
-							}} color="primary">
+					}} color="primary">
 						Continue	
 					</Button>
 				</DialogActions>

frontend/src/views/Workflows.jsx

@@ -595,7 +595,7 @@ const Workflows = (props) => {
 
 				for (var subkey in data.actions[key].parameters) {
 					const param = data.actions[key].parameters[subkey]
-					if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret") || param.name.includes("domain") || param.name.includes("url")) {
+					if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret") || param.name.includes("domain") || param.name.includes("url") || param.name.includes("mail")) {
 						// FIXME: This may be a vuln if api-keys are generated that start with $
 						if (param.value.startsWith("$")) {
 							console.log("Skipping field, as it's referencing a variable")
@@ -629,7 +629,7 @@ const Workflows = (props) => {
 		if (data.workflow_variables !== null && data.workflow_variables !== undefined) {
 			for (var key in data.workflow_variables) {
 				const param = data.workflow_variables[key]
-				if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret")) {
+				if (param.name.includes("key") || param.name.includes("user") || param.name.includes("pass") || param.name.includes("api") || param.name.includes("auth") || param.name.includes("secret")|| param.name.includes("email")) {
 					param.value = ""
 					param.is_valid = false
 				}