firewall-node

What's Changed

• Fix various edge cases and extend test coverage

• Temporarily disabled SSRF redirect protection for stability

• Fix accuracy issue during wildcard rate limiting

• Improve fetch & undici SSRF protection against malicious redirects
• Add support for better-sqlite3
• Improve rate limiting algorithm
• Protect needle for SSRF
• Fix issue related to Sentry SDK v8

• Improved shell injection detection

• Improve communication with Aikido dashboard (increased timeout)
• Add support for HTTP/2 server
• Prevent SSRF bypass through redirection
• Ensure that direct invocations of shell are also inspected

What's Changed

• Minor changes to handling of IP blocks

What's Changed

• Improve Hono app benchmark
• Add Next.js install instructions
• Introduce IP allowlist feature for admin API routes

What's Changed

• Solve SQLi false positive edge cases

What's Changed

• Add benchmark with Hono and PostgreSQL
• Fixed false positive edge cases in SQLi
• Add support for node:sqlite

What's Changed

• Added support for GraphQL, including field reporting and rate limiting per field
• Add performance optimizations

What's Changed

• Fix context sometimes not available in event handlers
• Sanitize output of pathToPayload
• Fix SSRF false positives with different ports

What's Changed

• Cleanup of tests and linting

What's Changed

• Add docs for micro
• Wrap undici if node 16.8+ and run tests on node 22

What's Changed

• Add support for micro server

What's Changed

• Check for unsupported runtime
• Detect path traversal in file: URL
• Send more clean stack traces

What's Changed

• Validate setUser(...) input and accept numbers as IDs

What's Changed

• Ignore error handlers and add end2end test for Sentry by @hansott in https://github.com/AikidoSec/firewall-node/pull/274

Full Changelog: https://github.com/AikidoSec/firewall-node/compare/1.5.48...1.5.49

What's Changed

• Add support for hapi 🚀
• Add support for ShellJS
• Add ~ to dangerous shell characters

What's Changed

• Stop reporting redirects as API paths
• Allow enabling 'blocking mode' from UI