IDOR protection by hansott · Pull Request #895 · AikidoSec/firewall-node

hansott · 2026-01-27T11:14:23Z

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 5	Resolved Issues: 0

🚀 New Features

Added IDOR protection feature with config and runtime checks
Added MySQL2 IDOR unit tests exercising various tenant scenarios

⚡ Enhancements

Exposed APIs for IDOR: enableIdorProtection, setTenantId, withoutIdorProtection
Integrated IDOR checks into MySQL, MySQL2, and Postgres query instrumentation
Extended interceptor result handling to include and enforce IDOR violations
Bumped zen-internals version used by build from v0.1.56 to v0.1.57

^{More info}

We only instrument `sql.unsafe` atm (need to instrument deeper to see all queries)

docs/idor-protection.md

library/agent/hooks/onInspectionInterceptorResult.ts

library/agent/idorProtection.ts

library/vulnerabilities/idor/checkContextForIdor.ts

library/agent/context/tenantId.ts

library/vulnerabilities/idor/checkContextForIdor.ts

This will make it easier to implement in other agents.

For IDOR analyze function

codecov · 2026-02-02T14:20:56Z

Codecov Report

❌ Patch coverage is 77.90262% with 118 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
library/agent/context/tenantId.ts	12.76%	41 Missing ⚠️
library/agent/idorProtection.ts	45.20%	40 Missing ⚠️
...ibrary/vulnerabilities/idor/checkContextForIdor.ts	87.44%	28 Missing ⚠️
library/sinks/MySQL.ts	93.61%	3 Missing ⚠️
library/sinks/MySQL2.ts	93.61%	3 Missing ⚠️
library/sinks/Postgres.ts	94.82%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

* 'main' of github.com:AikidoSec/node-RASP: Update ESM hint in Readme Mark ESM as stable Ignore library/helpers/form-parsing for codecov Migrate from prettier to oxfmt Don't check stderr, just status Remove remains of ESLint

library/vulnerabilities/idor/checkContextForIdor.ts

library/sinks/MySQL2.idor.tests.ts

library/vulnerabilities/idor/checkContextForIdor.ts

library/agent/Agent.ts

hansott added 13 commits January 27, 2026 12:12

Initial commit IDOR protection

62e3096

Add benchmark for idor protection

5ca4990

Add IDOR for postgres sinks

af4befa

Add more tests and remove operator field

ea7bd76

Cleanup type

4af19dd

Remove support for postgres.js

213ca48

We only instrument `sql.unsafe` atm (need to instrument deeper to see all queries)

Let users know that we planned this

83b09a6

Add idor tests for MySQL 2

b7b184e

Cleanup comments

95955d2

Format code

51a246d

Fix linting

cd0b4d4

Avoid agent.setIdorProtectionConfig(undefined!);

f398e0e

Improve type safety

2dfff43

timokoessler reviewed Jan 29, 2026

View reviewed changes

hansott added 9 commits January 30, 2026 13:41

Check if excludedTables values are strings

28042c6

Improve IDOR docs

8db702c

Ignore IDOR violations for bypassed IPs

47059fa

This will make it easier to implement in other agents.

Extract function for IDOR analysis

7e71c57

Format markdown

0c6c13f

Add comment

315967f

Remove unneeded check

1af8f53

Remove JSON.parse (zen-internals uses serde-wasm-bindgen now)

90a12b0

Use Zen internals v0.1.57

064af75

For IDOR analyze function

hansott marked this pull request as ready for review February 2, 2026 14:32