Support fetch(new Request(...))

AikidoSec · Jan 20, 2025 · 15e17ea · 15e17ea
1 parent 588f93b
commit 15e17ea
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/library/sinks/Fetch.test.ts b/library/sinks/Fetch.test.ts
@@ -105,6 +105,14 @@ t.test(
     t.same(agent.getHostnames().asArray(), []);
     agent.getHostnames().clear();
 
+    await fetch(new Request("https://app.aikido.dev"));
+
+    t.same(agent.getHostnames().asArray(), [
+      { hostname: "app.aikido.dev", port: 443, hits: 1 },
+    ]);
+
+    agent.getHostnames().clear();
+
     await runWithContext(context, async () => {
       // Don't await fetch to see how it handles
       // multiple requests at the same time
@@ -258,7 +266,9 @@ t.test(
         ...{ body: { image: redirectUrl.domainTwice } },
       },
       async () => {
-        const error = await t.rejects(() => fetch(redirectUrl.domainTwice));
+        const error = await t.rejects(() =>
+          fetch(new Request(redirectUrl.domainTwice))
+        );
         if (error instanceof Error) {
           t.same(
             // @ts-expect-error Type is not defined

diff --git a/library/sinks/Fetch.ts b/library/sinks/Fetch.ts
@@ -79,6 +79,20 @@ export class Fetch implements Wrapper {
           return attack;
         }
       }
+
+      if (args[0] instanceof Request) {
+        const url = tryParseURL(args[0].url);
+        if (url) {
+          const attack = this.inspectHostname(
+            agent,
+            url.hostname,
+            getPortFromURL(url)
+          );
+          if (attack) {
+            return attack;
+          }
+        }
+      }
     }
 
     return undefined;