appsec: support for SSRF Exploit Prevention#2707

Merged

eliottness merged 22 commits intomainfrom francois.mazeau/ssrf-plug

Jun 3, 2024

+553-149

Commits on Jun 3, 2024

appsec: support for SSRF Exploit Prevention
eliottness
committed
remove spanID and nested event span_id
eliottness
committed
TEMP!: hardcode RASP SSRF rule & span tag for staging
eliottness
committed
listeners: remove timeout arg for roundtriper

Hellzy
authored and
eliottness
committed
waf_test: used sharedsec.HTTPClientIPAddre

Hellzy
authored and
eliottness
committed
waf.go: remove hardcoded rasp ssrf rule

Hellzy
authored and
eliottness
committed
http: add stacktraces to span

Hellzy
authored and
eliottness
committed
Register RC capa and check RASP enablement

Hellzy
authored and
eliottness
committed
imports police

Hellzy
authored and
eliottness
committed
net/http: remove rasp test tag

Hellzy
authored and
eliottness
committed
emitter: simplify to 1 generated stacktrace only

Hellzy
authored and
eliottness
committed
Don't add nil stacktraces to spans

Hellzy
authored and
eliottness
committed
internal/appsec: refactor roundtripper and add new events.SecurityBlockingEvent type to the public API
eliottness
committed
rename stack_trace action in generate_stack as per libddwaf upgrading guide
eliottness
committed
fix multiple issues:
eliottness
committed
rename appsec/events.SecurityBlockingEvent -> BlockingSecurityEvent
eliottness
committed
misc suggestions from @Julio-Guerra
eliottness
committed
appsec: grpc: remove MonitoringError and fix user blocking
eliottness
committed
run go mod tidy
eliottness
committed
internal/appsec: add appsec.RASPEnabled() and use it to disable RASP when needed
eliottness
committed
Update internal/appsec/emitter/httpsec/roundtripper.go

eliottness
and
Julio-Guerra
committed
order imports
eliottness
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

appsec: support for SSRF Exploit Prevention#2707

Commits on Jun 3, 2024

appsec: support for SSRF Exploit Prevention

remove spanID and nested event span_id

TEMP!: hardcode RASP SSRF rule & span tag for staging

listeners: remove timeout arg for roundtriper

waf_test: used sharedsec.HTTPClientIPAddre

waf.go: remove hardcoded rasp ssrf rule

http: add stacktraces to span

Register RC capa and check RASP enablement

imports police

net/http: remove rasp test tag

emitter: simplify to 1 generated stacktrace only

Don't add nil stacktraces to spans

internal/appsec: refactor roundtripper and add new events.SecurityBlockingEvent type to the public API

rename stack_trace action in generate_stack as per libddwaf upgrading guide

fix multiple issues:

rename appsec/events.SecurityBlockingEvent -> BlockingSecurityEvent

misc suggestions from @Julio-Guerra

appsec: grpc: remove MonitoringError and fix user blocking

run go mod tidy

internal/appsec: add appsec.RASPEnabled() and use it to disable RASP when needed

Update internal/appsec/emitter/httpsec/roundtripper.go

order imports