firewall-node

What's Changed

• Amend detection for various sinks

What's Changed

• support SQL injection protection for SQLite3
• Protect against SSRF attacks

What's Changed

• Add support for xml parsers
• If request comes from localhost, don't rate limit unless production

What's Changed

• Check req.subdomains in express as a source

What's Changed

• Reset routes + Ignore more routes

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.41...1.5.42

What's Changed

• Collect hits for routes/endpoints by @hansott in https://github.com/AikidoSec/firewall-node/pull/250

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.40...1.5.41

What's Changed

• Add printenv to command list by @timokoessler in https://github.com/AikidoSec/firewall-node/pull/245
• Filter out more routes and replace secrets with :secret by @hansott in https://github.com/AikidoSec/firewall-node/pull/248
• Improve secret detection by @hansott in https://github.com/AikidoSec/firewall-node/pull/249

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.39...1.5.40

What's Changed

• Make Readme badges clickable by @timokoessler in https://github.com/AikidoSec/firewall-node/pull/242
• Improve shell command detection by @timokoessler in https://github.com/AikidoSec/firewall-node/pull/243
• Update prototype-pollution.md by @hansott in https://github.com/AikidoSec/firewall-node/pull/244
• Use visit function to collect all StringValue's by @hansott in https://github.com/AikidoSec/firewall-node/pull/247

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.38...1.5.39

What's Changed

• Add multiple shell commands
• Add support for GraphQL

What's Changed

• Inspect execFile & execFileSync by @timokoessler

What's Changed

• Only discover endpoints/routes that exist by @hansott in https://github.com/AikidoSec/firewall-node/pull/233

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.35...1.5.36

What's Changed

• Rate limit by IP + build route from URL by @hansott in https://github.com/AikidoSec/firewall-node/pull/232

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.34...1.5.35

What's Changed

• Add JWT token itself as string by @hansott in https://github.com/AikidoSec/firewall-node/pull/231
• Send library along with agent info by @hansott in https://github.com/AikidoSec/firewall-node/pull/226

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.33...1.5.34

What's Changed

• Rename runtime to firewall by @hansott in https://github.com/AikidoSec/firewall-node/pull/230

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.32...1.5.33

Full Changelog: https://github.com/AikidoSec/runtime-node/compare/1.5.31...1.5.32

What's Changed

• Publish with provenance to npm registry by @timokoessler in https://github.com/AikidoSec/runtime-node/pull/229

Full Changelog: https://github.com/AikidoSec/runtime-node/compare/1.5.30...1.5.31

What's Changed

• Ensure array by @hansott in https://github.com/AikidoSec/runtime-node/pull/228

Full Changelog: https://github.com/AikidoSec/runtime-node/compare/1.5.29...1.5.30

What's Changed

• Fix macOS command injection bypass
• Allow rate-limiting based on wildcard URL matching

What's Changed

• Add support for Hono-based apps

What's Changed

• Escape IP address by @hansott in https://github.com/AikidoSec/runtime-node/pull/217
• Don't block IPs from allow list by @hansott in https://github.com/AikidoSec/runtime-node/pull/220

Full Changelog: https://github.com/AikidoSec/runtime-node/compare/1.5.26...1.5.27