8000 Add IAST propagation to String valueOf by Mariovido · Pull Request #8013 · DataDog/dd-trace-java · GitHub
[go: up one dir, main page]
Skip to content

Add IAST propagation to String valueOf #8013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Nov 27, 2024
Merged

Add IAST propagation to String valueOf #8013

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
02ce186
Add Iast propagation support for string value of
Mariovido Nov 25, 2024
2f3a62f
Remove comment
Mariovido Nov 25, 2024
18f19e0
Add support for taintable objects
Mariovido Nov 26, 2024
082ceb4
Minor fix
Mariovido Nov 26, 2024
4669bea
Add support for special objects
Mariovido Nov 26, 2024
25fce09
Change ObjectInputStream for ByteArrayInputStream
Mariovido Nov 26, 2024
09a4c95
Refactor tests in StringModuleTest
Mariovido Nov 27, 2024
28eeeba
Change assertion for taintable objects
Mariovido Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add support for special objects
  • Loading branch information
@Mariovido
Mariovido committed Nov 26, 2024
commit 4669bea5879f3f95b31a36a59b1c15ceb7f67c54
12 changes: 11 additions & 1 deletion dd-java-agent/agent-iast/src/main/java/com/datadog/iast/propagation/StringModuleImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -778,7 +778,17 @@ public void onStringValueOf(Object param, @Nonnull String result) {
return;
}

taintedObjects.taint(result, rangesParam);
// Special objects like InputStream...
if (rangesParam[0].getLength() == Integer.MAX_VALUE) {
final Source source = rangesParam[0].getSource();
final Range[] ranges =
Ranges.forCharSequence(
result, new Source(source.getOrigin(), source.getName(), source.getValue()));

taintedObjects.taint(result, ranges);
} else {
taintedObjects.taint(result, rangesParam);
}
}
}

Expand Down
15 changes: 12 additions & 3 deletions ...ava-agent/agent-iast/src/test/groovy/com/datadog/iast/propagation/StringModuleTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1324,11 +1324,17 @@ class StringModuleTest extends IastModuleImplTestBase {
sbf("==>my_input<==") | "==>my_input<=="
}

void 'test valueOf with taintable object and make sure IastRequestContext is called'() {
void 'test valueOf with taintable and special objects object and make sure IastRequestContext is called'() {
given:
final taintedObjects = ctx.getTaintedObjects()
final source = taintedSource(null)
final param = taintable(taintedObjects, source)
final source = taintedSource()
final param
if (taintable) {
param = taintable(taintedObjects, source)
} else {
param = new ObjectInputStream()
taintObject(taintedObjects, param, source)
}
def result = String.valueOf(param)

when:
Expand All @@ -1338,6 +1344,9 @@ class StringModuleTest extends IastModuleImplTestBase {
then:
1 * tracer.activeSpan() >> span
taintFormat(result, taintedObject.getRanges()) == "==>" + param.toString() + "<=="

where:
taintable << [true, false]
}

private static Date date(final String pattern, final String value) {
Expand Down
Loading
0