milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add interceptors for MITM

Browse source
This commit is contained in:
Sander Declerck 2025-11-06 18:00:11 +01:00
parent 0b056e92de
commit e251908cb3
No known key found for this signature in database
4 changed files with 123 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

31
packages/safe-chain/src/registryProxy/registryProxy.js
View file

@ -4,10 +4,19 @@ import { mitmConnect } from "./mitmRequestHandler.js";
import { handleHttpProxyRequest } from "./plainHttpProxy.js";
import { getCaCertPath } from "./certUtils.js";
import { auditChanges } from "../scanning/audit/index.js";
import { knownJsRegistries, knownPipRegistries, parsePackageFromUrl } from "./parsePackageFromUrl.js";
import { getEcoSystem, ECOSYSTEM_JS, ECOSYSTEM_PY } from "../config/settings.js";
import {
knownJsRegistries,
knownPipRegistries,
parsePackageFromUrl,
} from "./parsePackageFromUrl.js";
import {
getEcoSystem,
ECOSYSTEM_JS,
ECOSYSTEM_PY,
} from "../config/settings.js";
import { ui } from "../environment/userInteraction.js";
import chalk from "chalk";
import { createInterceptorBuilder } from "./interceptors/interceptorBuilder.js";
const SERVER_STOP_TIMEOUT_MS = 1000;
/**
@ -143,7 +152,7 @@ function handleConnect(req, clientSocket, head) {
}
if (isKnownRegistry) {
mitmConnect(req, clientSocket, isAllowedUrl);
mitmConnect(req, clientSocket, createMitmInterceptor());
} else {
// For other hosts, just tunnel the request to the destination tcp socket
ui.writeVerbose(`Safe-chain: Tunneling request to ${req.url}`);
@ -151,6 +160,22 @@ function handleConnect(req, clientSocket, head) {
}
}
/**
*
* @returns {import("./interceptors/interceptorBuilder.js").Interceptor}
*/
function createMitmInterceptor() {
const builder = createInterceptorBuilder();
builder.onRequest(async (req) => {
if (!(await isAllowedUrl(req.targetUrl))) {
req.blockRequest(403, "Forbidden - blocked by safe-chain");
}
});
return builder.build();
}
/**
* @param {string} url
* @returns {Promise<boolean>}