Autorize v1.9.4

README.md

@@ -5,7 +5,7 @@ It is designed to assist application security engineers and penetration testers
 
 Autorize passively monitors traffic generated by a **high-privileged user**, automatically replays requests using **low-privileged** or **unauthenticated** contexts, and analyzes the server responses to determine whether access controls are properly enforced.
 
-The extension is written in Python by **Barak Tawily**, an application security researcher and practitioner.
+The extension is written in Jython by **Barak Tawily**, an application security researcher and practitioner.
 
 ![Autorize Screenshot](https://raw.githubusercontent.com/Quitten/Autorize/master/Autorize.png)
 

authorization/authorization.py

@@ -284,7 +284,7 @@ def checkAuthorizationAllUsers(self, messageInfo, checkUnauthorized=True):
     method = self._helpers.analyzeRequest(messageInfo.getRequest()).getMethod()
     original_url = self._helpers.analyzeRequest(messageInfo).getUrl()
 
-    logEntry = LogEntry(self.currentRequestNumber,
+    logEntry = LogEntry(None,  # ID assigned inside lock to avoid duplicates when concurrent
                         method,
                         original_url,
                         messageInfo,
@@ -329,10 +329,11 @@ def checkAuthorizationAllUsers(self, messageInfo, checkUnauthorized=True):
 
     self._lock.acquire()
     try:
+        logEntry._id = self.currentRequestNumber
         row = self._log.size()
         self._log.add(logEntry)
         SwingUtilities.invokeLater(UpdateTableEDT(self,"insert",row,row))
-        self.currentRequestNumber = self.currentRequestNumber + 1
+        self.currentRequestNumber += 1
     except Exception as e:
         raise
     finally:
@@ -577,7 +578,7 @@ def checkAuthorization(self, messageInfo, originalHeaders, checkUnauthorized):
             self._log.add(LogEntry(self.currentRequestNumber,self._callbacks.saveBuffersToTempFiles(requestResponse), method, self._helpers.analyzeRequest(requestResponse).getUrl(),messageInfo,impression,None,"Disabled")) # same requests not include again.
 
         SwingUtilities.invokeLater(UpdateTableEDT(self,"insert",row,row))
-        self.currentRequestNumber = self.currentRequestNumber + 1
+        self.currentRequestNumber += 1
     except Exception as e:
         raise
     finally:

helpers/initiator.py

@@ -20,7 +20,7 @@ def __init__(self, extender):
 
     def init_constants(self):
         self.contributors = ["Federico Dotta", "mgeeky", "Marcin Woloszyn", "jpginc", "Eric Harris", "Joao Teles", "Roy Oswaldha"]
-        self._extender.version = "1.9.3"
+        self._extender.version = "1.9.4"
         self._extender._log = ArrayList()
         self._extender._lock = Lock()