Skip to content

Commit 7461cf4

Browse files
manuel-alvarez-alvarezmanuel-alvarez-alvarez
authored
Move byte[] and char[] call sites to full detection mode only (#6960)
1 parent 6978c8e commit 7461cf4

17 files changed

Lines changed: 519 additions & 546 deletions

File tree

‎dd-java-agent/agent-iast/src/testFixtures/groovy/com/datadog/iast/test/IastAgentTestRunner.groovy‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,11 @@ class IastAgentTestRunner extends AgentTestRunner implements IastRequestContextP
4444
new TaintedObjectCollection(localTaintedObjects)
4545
}
4646

47+
protected TaintedObjectCollection getTaintedObjectCollection(DDSpan span) {
48+
final IastContext ctx = span.getRequestContext().getData(RequestContextSlot.IAST)
49+
return new TaintedObjectCollection(ctx.getTaintedObjects())
50+
}
51+
4752
protected DDSpan runUnderIastTrace(Closure cl) {
4853
CallbackProvider iastCbp = TEST_TRACER.getCallbackProvider(RequestContextSlot.IAST)
4954
Supplier<Flow<Object>> reqStartCb = iastCbp.getCallback(Events.EVENTS.requestStarted())

‎dd-java-agent/agent-iast/src/testFixtures/groovy/com/datadog/iast/test/TaintedObjectCollection.groovy‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ class TaintedObjectCollection {
9696
return false
9797
}
9898
TaintedObject tobj = obj
99-
valueMatcher.matches(tobj.get() as String) &&
99+
valueMatcher.matches(tobj.get()) &&
100100
ranges.every { RangeMatcher rm ->
101101
tobj.ranges.any { range ->
102102
rm.matches(range)

‎dd-java-agent/instrumentation/iast-instrumenter/src/main/resources/datadog/trace/instrumentation/iastinstrumenter/iast_exclusion.trie‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -195,9 +195,6 @@
195195
0 org.apache.http.client.methods.*
196196
# apache compiled jsps
197197
0 org.apache.jsp.*
198-
# Need for kafka propagation
199-
2 org.apache.kafka.common.serialization.ByteBufferDeserializer
200-
2 org.apache.kafka.common.serialization.StringDeserializer
201198
1 org.apiguardian.*
202199
1 org.aspectj.*
203200
1 org.attoparser.*

‎dd-java-agent/instrumentation/java-lang/src/main/java/datadog/trace/instrumentation/java/lang/StringCallSite.java‎

Lines changed: 0 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,11 @@
11
package datadog.trace.instrumentation.java.lang;
22

3-
import static datadog.trace.api.iast.VulnerabilityMarks.NOT_MARKED;
4-
53
import datadog.trace.agent.tooling.csi.CallSite;
64
import datadog.trace.api.iast.IastCallSites;
75
import datadog.trace.api.iast.InstrumentationBridge;
86
import datadog.trace.api.iast.Propagation;
9-
import datadog.trace.api.iast.propagation.CodecModule;
10-
import datadog.trace.api.iast.propagation.PropagationModule;
117
import datadog.trace.api.iast.propagation.StringModule;
128
import datadog.trace.util.stacktrace.StackUtils;
13-
import java.nio.charset.Charset;
149
import java.util.ArrayList;
1510
import java.util.List;
1611
import java.util.Locale;
@@ -220,130 +215,6 @@ public static String afterStringConstructor(
220215
return result;
221216
}
222217

223-
@CallSite.After("void java.lang.String.<init>(byte[])")
224-
public static String afterByteArrayCtor(
225-
@CallSite.AllArguments @Nonnull final Object[] params,
226-
@CallSite.Return @Nonnull final String result) {
227-
final CodecModule module = InstrumentationBridge.CODEC;
228-
try {
229-
if (module != null) {
230-
final byte[] bytes = (byte[]) params[0];
231-
if (bytes != null) {
232-
module.onStringFromBytes(bytes, 0, bytes.length, null, result);
233-
}
234-
}
235-
} catch (final Throwable e) {
236-
module.onUnexpectedException("afterByteArrayCtor threw", e);
237-
}
238-
return result;
239-
}
240-
241-
@CallSite.After("void java.lang.String.<init>(byte[], java.lang.String)")
242-
@CallSite.After("void java.lang.String.<init>(byte[], java.nio.charset.Charset)")
243-
public static String afterByteArrayCtor2(
244-
@CallSite.AllArguments @Nonnull final Object[] params,
245-
@CallSite.Return @Nonnull final String result) {
246-
final CodecModule module = InstrumentationBridge.CODEC;
247-
try {
248-
if (module != null) {
249-
final byte[] bytes = (byte[]) params[0];
250-
if (bytes != null) {
251-
final String charset =
252-
params[1] instanceof Charset ? ((Charset) params[1]).name() : (String) params[1];
253-
module.onStringFromBytes(bytes, 0, bytes.length, charset, result);
254-
}
255-
}
256-
} catch (final Throwable e) {
257-
module.onUnexpectedException("afterByteArrayCtor2 threw", e);
258-
}
259-
return result;
260-
}
261-
262-
@CallSite.After("void java.lang.String.<init>(byte[], int, int)")
263-
public static String afterByteArrayCtor3(
264-
@CallSite.AllArguments @Nonnull final Object[] params,
265-
@CallSite.Return @Nonnull final String result) {
266-
final CodecModule module = InstrumentationBridge.CODEC;
267-
try {
268-
if (module != null) {
269-
final byte[] bytes = (byte[]) params[0];
270-
if (bytes != null) {
271-
module.onStringFromBytes(bytes, (int) params[1], (int) params[2], null, result);
272-
}
273-
}
274-
} catch (final Throwable e) {
275-
module.onUnexpectedException("afterByteArrayCtor3 threw", e);
276-
}
277-
return result;
278-
}
279-
280-
@CallSite.After("void java.lang.String.<init>(byte[], int, int, java.lang.String)")
281-
@CallSite.After("void java.lang.String.<init>(byte[], int, int, java.nio.charset.Charset)")
282-
public static String afterByteArrayCtor4(
283-
@CallSite.AllArguments @Nonnull final Object[] params,
284-
@CallSite.Return @Nonnull final String result) {
285-
final CodecModule module = InstrumentationBridge.CODEC;
286-
try {
287-
if (module != null) {
288-
final byte[] bytes = (byte[]) params[0];
289-
if (bytes != null) {
290-
final String charset =
291-
params[3] instanceof Charset ? ((Charset) params[3]).name() : (String) params[3];
292-
module.onStringFromBytes(bytes, (int) params[1], (int) params[2], charset, result);
293-
}
294-
}
295-
} catch (final Throwable e) {
296-
module.onUnexpectedException("afterByteArrayCtor4 threw", e);
297-
}
298-
return result;
299-
}
300-
301-
@CallSite.After("byte[] java.lang.String.getBytes()")
302-
public static byte[] afterGetBytes(
303-
@CallSite.This @Nonnull final String self, @CallSite.Return @Nonnull final byte[] result) {
304-
final CodecModule module = InstrumentationBridge.CODEC;
305-
try {
306-
if (module != null) {
307-
module.onStringGetBytes(self, null, result);
308-
}
309-
} catch (final Throwable e) {
310-
module.onUnexpectedException("afterGetBytes threw", e);
311-
}
312-
return result;
313-
}
314-
315-
@CallSite.After("byte[] java.lang.String.getBytes(java.lang.String)")
316-
public static byte[] afterGetBytes(
317-
@CallSite.This @Nonnull final String self,
318-
@CallSite.Argument @Nullable final String encoding,
319-
@CallSite.Return @Nonnull final byte[] result) {
320-
final CodecModule module = InstrumentationBridge.CODEC;
321-
try {
322-
if (module != null) {
323-
module.onStringGetBytes(self, encoding, result);
324-
}
325-
} catch (final Throwable e) {
326-
module.onUnexpectedException("afterGetBytes threw", e);
327-
}
328-
return result;
329-
}
330-
331-
@CallSite.After("byte[] java.lang.String.getBytes(java.nio.charset.Charset)")
332-
public static byte[] afterGetBytes(
333-
@CallSite.This @Nonnull final String self,
334-
@CallSite.Argument @Nullable final Charset encoding,
335-
@CallSite.Return @Nonnull final byte[] result) {
336-
final CodecModule module = InstrumentationBridge.CODEC;
337-
try {
338-
if (module != null) {
339-
module.onStringGetBytes(self, encoding == null ? null : encoding.name(), result);
340-
}
341-
} catch (final Throwable e) {
342-
module.onUnexpectedException("afterGetBytes threw", e);
343-
}
344-
return result;
345-
}
346-
347218
@CallSite.After("java.lang.String java.lang.String.format(java.lang.String, java.lang.Object[])")
348219
public static String afterFormat(
349220
@CallSite.Argument(0) @Nullable final String pattern,
@@ -378,20 +249,6 @@ public static String afterFormat(
378249
return result;
379250
}
380251

381-
@CallSite.After("char[] java.lang.String.toCharArray()")
382-
public static char[] afterToCharArray(
383-
@CallSite.This @Nonnull final String self, @CallSite.Return @Nonnull final char[] result) {
384-
final PropagationModule module = InstrumentationBridge.PROPAGATION;
385-
if (module != null) {
386-
try {
387-
module.taintObjectIfTainted(result, self, true, NOT_MARKED);
388-
} catch (final Throwable e) {
389-
module.onUnexpectedException("afterToCharArray threw", e);
390-
}
391-
}
392-
return result;
393-
}
394-
395252
@CallSite.After("java.lang.String[] java.lang.String.split(java.lang.String)")
396253
public static String[] afterSplit(
397254
@CallSite.This @Nonnull final String self,

‎dd-java-agent/instrumentation/java-lang/src/main/java/datadog/trace/instrumentation/java/lang/StringFullDetectionCallSite.java‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
package datadog.trace.instrumentation.java.lang;
2+
3+
import static datadog.trace.api.iast.VulnerabilityMarks.NOT_MARKED;
4+
5+
import datadog.trace.agent.tooling.csi.CallSite;
6+
import datadog.trace.api.iast.IastCallSites;
7+
import datadog.trace.api.iast.InstrumentationBridge;
8+
import datadog.trace.api.iast.Propagation;
9+
import datadog.trace.api.iast.propagation.CodecModule;
10+
import datadog.trace.api.iast.propagation.PropagationModule;
11+
import java.nio.charset.Charset;
12+
import javax.annotation.Nonnull;
13+
import javax.annotation.Nullable;
14+
15+
@Propagation
16+
@CallSite(
17+
spi = IastCallSites.class,
18+
enabled = {"datadog.trace.api.iast.IastEnabledChecks", "isFullDetection"})
19+
public class StringFullDetectionCallSite {
20+
21+
@CallSite.After("void java.lang.String.<init>(byte[])")
22+
public static String afterByteArrayCtor(
23+
@CallSite.AllArguments @Nonnull final Object[] params,
24+
@CallSite.Return @Nonnull final String result) {
25+
final CodecModule module = InstrumentationBridge.CODEC;
26+
try {
27+
if (module != null) {
28+
final byte[] bytes = (byte[]) params[0];
29+
if (bytes != null) {
30+
module.onStringFromBytes(bytes, 0, bytes.length, null, result);
31+
}
32+
}
33+
} catch (final Throwable e) {
34+
module.onUnexpectedException("afterByteArrayCtor threw", e);
35+
}
36+
return result;
37+
}
38+
39+
@CallSite.After("void java.lang.String.<init>(byte[], java.lang.String)")
40+
@CallSite.After("void java.lang.String.<init>(byte[], java.nio.charset.Charset)")
41+
public static String afterByteArrayCtor2(
42+
@CallSite.AllArguments @Nonnull final Object[] params,
43+
@CallSite.Return @Nonnull final String result) {
44+
final CodecModule module = InstrumentationBridge.CODEC;
45+
try {
46+
if (module != null) {
47+
final byte[] bytes = (byte[]) params[0];
48+
if (bytes != null) {
49+
final String charset =
50+
params[1] instanceof Charset ? ((Charset) params[1]).name() : (String) params[1];
51+
module.onStringFromBytes(bytes, 0, bytes.length, charset, result);
52+
}
53+
}
54+
} catch (final Throwable e) {
55+
module.onUnexpectedException("afterByteArrayCtor2 threw", e);
56+
}
57+
return result;
58+
}
59+
60+
@CallSite.After("void java.lang.String.<init>(byte[], int, int)")
61+
public static String afterByteArrayCtor3(
62+
@CallSite.AllArguments @Nonnull final Object[] params,
63+
@CallSite.Return @Nonnull final String result) {
64+
final CodecModule module = InstrumentationBridge.CODEC;
65+
try {
66+
if (module != null) {
67+
final byte[] bytes = (byte[]) params[0];
68+
if (bytes != null) {
69+
module.onStringFromBytes(bytes, (int) params[1], (int) params[2], null, result);
70+
}
71+
}
72+
} catch (final Throwable e) {
73+
module.onUnexpectedException("afterByteArrayCtor3 threw", e);
74+
}
75+
return result;
76+
}
77+
78+
@CallSite.After("void java.lang.String.<init>(byte[], int, int, java.lang.String)")
79+
@CallSite.After("void java.lang.String.<init>(byte[], int, int, java.nio.charset.Charset)")
80+
public static String afterByteArrayCtor4(
81+
@CallSite.AllArguments @Nonnull final Object[] params,
82+
@CallSite.Return @Nonnull final String result) {
83+
final CodecModule module = InstrumentationBridge.CODEC;
84+
try {
85+
if (module != null) {
86+
final byte[] bytes = (byte[]) params[0];
87+
if (bytes != null) {
88+
final String charset =
89+
params[3] instanceof Charset ? ((Charset) params[3]).name() : (String) params[3];
90+
module.onStringFromBytes(bytes, (int) params[1], (int) params[2], charset, result);
91+
}
92+
}
93+
} catch (final Throwable e) {
94+
module.onUnexpectedException("afterByteArrayCtor4 threw", e);
95+
}
96+
return result;
97+
}
98+
99+
@CallSite.After("byte[] java.lang.String.getBytes()")
100+
public static byte[] afterGetBytes(
101+
@CallSite.This @Nonnull final String self, @CallSite.Return @Nonnull final byte[] result) {
102+
final CodecModule module = InstrumentationBridge.CODEC;
103+
try {
104+
if (module != null) {
105+
module.onStringGetBytes(self, null, result);
106+
}
107+
} catch (final Throwable e) {
108+
module.onUnexpectedException("afterGetBytes threw", e);
109+
}
110+
return result;
111+
}
112+
113+
@CallSite.After("byte[] java.lang.String.getBytes(java.lang.String)")
114+
public static byte[] afterGetBytes(
115+
@CallSite.This @Nonnull final String self,
116+
@CallSite.Argument @Nullable final String encoding,
117+
@CallSite.Return @Nonnull final byte[] result) {
118+
final CodecModule module = InstrumentationBridge.CODEC;
119+
try {
120+
if (module != null) {
121+
module.onStringGetBytes(self, encoding, result);
122+
}
123+
} catch (final Throwable e) {
124+
module.onUnexpectedException("afterGetBytes threw", e);
125+
}
126+
return result;
127+
}
128+
129+
@CallSite.After("byte[] java.lang.String.getBytes(java.nio.charset.Charset)")
130+
public static byte[] afterGetBytes(
131+
@CallSite.This @Nonnull final String self,
132+
@CallSite.Argument @Nullable final Charset encoding,
133+
@CallSite.Return @Nonnull final byte[] result) {
134+
final CodecModule module = InstrumentationBridge.CODEC;
135+
try {
136+
if (module != null) {
137+
module.onStringGetBytes(self, encoding == null ? null : encoding.name(), result);
138+
}
139+
} catch (final Throwable e) {
140+
module.onUnexpectedException("afterGetBytes threw", e);
141+
}
142+
return result;
143+
}
144+
145+
@CallSite.After("char[] java.lang.String.toCharArray()")
146+
public static char[] afterToCharArray(
147+
@CallSite.This @Nonnull final String self, @CallSite.Return @Nonnull final char[] result) {
148+
final PropagationModule module = InstrumentationBridge.PROPAGATION;
149+
if (module != null) {
150+
try {
151+
module.taintObjectIfTainted(result, self, true, NOT_MARKED);
152+
} catch (final Throwable e) {
153+
module.onUnexpectedException("afterToCharArray threw", e);
154+
}
155+
}
156+
return result;
157+
}
158+
}

0 commit comments

Comments
 (0)