Skip to content

Include query string in URL for ASGI/WSGI requests#622

Open
bitterpanda63 wants to merge 1 commit intomainfrom
fix-url-query-string
Open

Include query string in URL for ASGI/WSGI requests#622
bitterpanda63 wants to merge 1 commit intomainfrom
fix-url-query-string

Conversation

@bitterpanda63
Copy link
Copy Markdown
Member

@bitterpanda63 bitterpanda63 commented Apr 16, 2026

Summary

  • The request URL captured for attack events was missing the query string, so query-driven attacks (path traversal, suspicious ?path=... payloads, etc.) lost the malicious payload from their reported URL.
  • Fixes both ASGI (build_url_from_asgi) and WSGI (build_url_from_wsgi) URL builders to append ?<query_string> when present.

Re-enables test_path_traversal in the QA suite. Also lays the groundwork for #fix-wave-attack — wave-attack samples are keyed on context.url, so without the query string 16 distinct ?path=q1..q16 requests collapsed into a single sample.

Test plan

  • aikido_zen/context/asgi/build_url_from_asgi_test.py — added query-string test cases (including the path-traversal scenario).
  • aikido_zen/context/wsgi/build_url_from_wsgi_test.py — added query-string test cases.
  • Updated existing context tests whose URL assertions now include the query string.
  • Full unit suite passes locally (make test minus network-dependent tests).
  • QA suite: verify test_path_traversal passes once merged.

🤖 Generated with Claude Code

Summary by Aikido

Security Issues: 0 Quality Issues: 0 Resolved Issues: 0

⚡ Enhancements

  • Updated QA workflow to re-enable path traversal test execution.

🐛 Bugfixes

  • Included query string in ASGI and WSGI URL builders.

More info

The request URL captured for attack events was missing the query string,
causing path-traversal events (and other query-driven attacks) to lose
the malicious payload from their reported URL.

Re-enables test_path_traversal in the QA suite.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant