Skip to content

Commit 02fa05c

Browse files
MariovidoMariovido
authored
Fix BitSet builder in VulnerabilityTypes (#8212)
1 parent 148aef9 commit 02fa05c

File tree

2 files changed

+40
-32
lines changed

2 files changed

+40
-32
lines changed

‎dd-java-agent/agent-iast/src/main/java/com/datadog/iast/model/VulnerabilityType.java‎

Lines changed: 38 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -25,143 +25,143 @@
2525

2626
public interface VulnerabilityType {
2727

28-
BitSet DB_EXCLUDED = new BitSet(SourceTypes.SQL_TABLE);
29-
3028
VulnerabilityType WEAK_CIPHER =
31-
type(VulnerabilityTypes.WEAK_CIPHER).excludedSources(DB_EXCLUDED).build();
29+
type(VulnerabilityTypes.WEAK_CIPHER).excludedSources(Builder.DB_EXCLUDED).build();
3230
VulnerabilityType WEAK_HASH =
33-
type(VulnerabilityTypes.WEAK_HASH).excludedSources(DB_EXCLUDED).build();
31+
type(VulnerabilityTypes.WEAK_HASH).excludedSources(Builder.DB_EXCLUDED).build();
3432
VulnerabilityType INSECURE_COOKIE =
3533
type(VulnerabilityTypes.INSECURE_COOKIE)
3634
.hash(VulnerabilityType::evidenceHash)
37-
.excludedSources(DB_EXCLUDED)
35+
.excludedSources(Builder.DB_EXCLUDED)
3836
.build();
3937
VulnerabilityType NO_HTTPONLY_COOKIE =
4038
type(VulnerabilityTypes.NO_HTTPONLY_COOKIE)
4139
.hash(VulnerabilityType::evidenceHash)
42-
.excludedSources(DB_EXCLUDED)
40+
.excludedSources(Builder.DB_EXCLUDED)
4341
.build();
4442
VulnerabilityType HSTS_HEADER_MISSING =
4543
type(VulnerabilityTypes.HSTS_HEADER_MISSING)
4644
.hash(VulnerabilityType::serviceHash)
47-
.excludedSources(DB_EXCLUDED)
45+
.excludedSources(Builder.DB_EXCLUDED)
4846
.build();
4947
VulnerabilityType XCONTENTTYPE_HEADER_MISSING =
5048
type(VulnerabilityTypes.XCONTENTTYPE_HEADER_MISSING)
5149
.hash(VulnerabilityType::serviceHash)
52-
.excludedSources(DB_EXCLUDED)
50+
.excludedSources(Builder.DB_EXCLUDED)
5351
.build();
5452
VulnerabilityType NO_SAMESITE_COOKIE =
5553
type(VulnerabilityTypes.NO_SAMESITE_COOKIE)
5654
.hash(VulnerabilityType::evidenceHash)
57-
.excludedSources(DB_EXCLUDED)
55+
.excludedSources(Builder.DB_EXCLUDED)
5856
.build();
5957

6058
VulnerabilityType SQL_INJECTION =
6159
type(VulnerabilityTypes.SQL_INJECTION).mark(SQL_INJECTION_MARK).build();
6260
VulnerabilityType COMMAND_INJECTION =
6361
type(VulnerabilityTypes.COMMAND_INJECTION)
6462
.mark(COMMAND_INJECTION_MARK)
65-
.excludedSources(DB_EXCLUDED)
63+
.excludedSources(Builder.DB_EXCLUDED)
6664
.build();
6765
VulnerabilityType PATH_TRAVERSAL =
6866
type(VulnerabilityTypes.PATH_TRAVERSAL)
6967
.separator(File.separatorChar)
7068
.mark(PATH_TRAVERSAL_MARK)
71-
.excludedSources(DB_EXCLUDED)
69+
.excludedSources(Builder.DB_EXCLUDED)
7270
.build();
7371
VulnerabilityType LDAP_INJECTION =
7472
type(VulnerabilityTypes.LDAP_INJECTION)
7573
.mark(LDAP_INJECTION_MARK)
76-
.excludedSources(DB_EXCLUDED)
74+
.excludedSources(Builder.DB_EXCLUDED)
7775
.build();
7876
VulnerabilityType SSRF =
79-
type(VulnerabilityTypes.SSRF).mark(SSRF_MARK).excludedSources(DB_EXCLUDED).build();
77+
type(VulnerabilityTypes.SSRF).mark(SSRF_MARK).excludedSources(Builder.DB_EXCLUDED).build();
8078
VulnerabilityType UNVALIDATED_REDIRECT =
8179
type(VulnerabilityTypes.UNVALIDATED_REDIRECT)
8280
.mark(UNVALIDATED_REDIRECT_MARK)
83-
.excludedSources(DB_EXCLUDED)
81+
.excludedSources(Builder.DB_EXCLUDED)
8482
.build();
8583
VulnerabilityType WEAK_RANDOMNESS =
86-
type(VulnerabilityTypes.WEAK_RANDOMNESS).excludedSources(DB_EXCLUDED).build();
84+
type(VulnerabilityTypes.WEAK_RANDOMNESS).excludedSources(Builder.DB_EXCLUDED).build();
8785

8886
VulnerabilityType XPATH_INJECTION =
8987
type(VulnerabilityTypes.XPATH_INJECTION)
9088
.mark(XPATH_INJECTION_MARK)
91-
.excludedSources(DB_EXCLUDED)
89+
.excludedSources(Builder.DB_EXCLUDED)
9290
.build();
9391

9492
VulnerabilityType TRUST_BOUNDARY_VIOLATION =
9593
type(VulnerabilityTypes.TRUST_BOUNDARY_VIOLATION)
9694
.mark(TRUST_BOUNDARY_VIOLATION_MARK)
97-
.excludedSources(DB_EXCLUDED)
95+
.excludedSources(Builder.DB_EXCLUDED)
9896
.build();
9997

10098
VulnerabilityType XSS = type(VulnerabilityTypes.XSS).mark(XSS_MARK).build();
10199

102100
VulnerabilityType HEADER_INJECTION =
103101
type(VulnerabilityTypes.HEADER_INJECTION)
104102
.mark(HEADER_INJECTION_MARK)
105-
.excludedSources(DB_EXCLUDED)
103+
.excludedSources(Builder.DB_EXCLUDED)
106104
.build();
107105

108106
VulnerabilityType STACKTRACE_LEAK =
109-
type(VulnerabilityTypes.STACKTRACE_LEAK).excludedSources(DB_EXCLUDED).build();
107+
type(VulnerabilityTypes.STACKTRACE_LEAK).excludedSources(Builder.DB_EXCLUDED).build();
110108

111109
VulnerabilityType VERB_TAMPERING =
112-
type(VulnerabilityTypes.VERB_TAMPERING).excludedSources(DB_EXCLUDED).build();
110+
type(VulnerabilityTypes.VERB_TAMPERING).excludedSources(Builder.DB_EXCLUDED).build();
113111

114112
VulnerabilityType ADMIN_CONSOLE_ACTIVE =
115113
type(VulnerabilityTypes.ADMIN_CONSOLE_ACTIVE)
116114
.deduplicable(false)
117115
.hash(VulnerabilityType::serviceHash)
118-
.excludedSources(DB_EXCLUDED)
116+
.excludedSources(Builder.DB_EXCLUDED)
119117
.build();
120118

121119
VulnerabilityType DEFAULT_HTML_ESCAPE_INVALID =
122-
type(VulnerabilityTypes.DEFAULT_HTML_ESCAPE_INVALID).excludedSources(DB_EXCLUDED).build();
120+
type(VulnerabilityTypes.DEFAULT_HTML_ESCAPE_INVALID)
121+
.excludedSources(Builder.DB_EXCLUDED)
122+
.build();
123123

124124
VulnerabilityType SESSION_TIMEOUT =
125-
type(VulnerabilityTypes.SESSION_TIMEOUT).excludedSources(DB_EXCLUDED).build();
125+
type(VulnerabilityTypes.SESSION_TIMEOUT).excludedSources(Builder.DB_EXCLUDED).build();
126126

127127
VulnerabilityType DIRECTORY_LISTING_LEAK =
128-
type(VulnerabilityTypes.DIRECTORY_LISTING_LEAK).excludedSources(DB_EXCLUDED).build();
128+
type(VulnerabilityTypes.DIRECTORY_LISTING_LEAK).excludedSources(Builder.DB_EXCLUDED).build();
129129
VulnerabilityType INSECURE_JSP_LAYOUT =
130-
type(VulnerabilityTypes.INSECURE_JSP_LAYOUT).excludedSources(DB_EXCLUDED).build();
130+
type(VulnerabilityTypes.INSECURE_JSP_LAYOUT).excludedSources(Builder.DB_EXCLUDED).build();
131131

132132
VulnerabilityType HARDCODED_SECRET =
133-
type(VulnerabilityTypes.HARDCODED_SECRET).excludedSources(DB_EXCLUDED).build();
133+
type(VulnerabilityTypes.HARDCODED_SECRET).excludedSources(Builder.DB_EXCLUDED).build();
134134

135135
VulnerabilityType INSECURE_AUTH_PROTOCOL =
136136
type(VulnerabilityTypes.INSECURE_AUTH_PROTOCOL)
137137
.hash(VulnerabilityType::evidenceHash)
138-
.excludedSources(DB_EXCLUDED)
138+
.excludedSources(Builder.DB_EXCLUDED)
139139
.build();
140140

141141
VulnerabilityType REFLECTION_INJECTION =
142142
type(VulnerabilityTypes.REFLECTION_INJECTION)
143143
.mark(REFLECTION_INJECTION_MARK)
144-
.excludedSources(DB_EXCLUDED)
144+
.excludedSources(Builder.DB_EXCLUDED)
145145
.build();
146146

147147
VulnerabilityType SESSION_REWRITING =
148148
type(VulnerabilityTypes.SESSION_REWRITING)
149149
.deduplicable(false)
150150
.hash(VulnerabilityType::serviceHash)
151-
.excludedSources(DB_EXCLUDED)
151+
.excludedSources(Builder.DB_EXCLUDED)
152152
.build();
153153

154154
VulnerabilityType DEFAULT_APP_DEPLOYED =
155155
type(VulnerabilityTypes.DEFAULT_APP_DEPLOYED)
156156
.deduplicable(false)
157157
.hash(VulnerabilityType::serviceHash)
158-
.excludedSources(DB_EXCLUDED)
158+
.excludedSources(Builder.DB_EXCLUDED)
159159
.build();
160160

161161
VulnerabilityType UNTRUSTED_DESERIALIZATION =
162162
type(VulnerabilityTypes.UNTRUSTED_DESERIALIZATION)
163163
.mark(UNTRUSTED_DESERIALIZATION_MARK)
164-
.excludedSources(DB_EXCLUDED)
164+
.excludedSources(Builder.DB_EXCLUDED)
165165
.build();
166166

167167
/* All vulnerability types that have a mark. Should be updated if new vulnerabilityType with mark is added */
@@ -271,6 +271,13 @@ public String getName() {
271271
}
272272

273273
class Builder {
274+
private static final BitSet DB_EXCLUDED;
275+
276+
static {
277+
DB_EXCLUDED = new BitSet(SourceTypes.STRINGS.length + 1);
278+
DB_EXCLUDED.set(SourceTypes.SQL_TABLE);
279+
}
280+
274281
private final byte type;
275282
private char separator = ' ';
276283
private int mark = NOT_MARKED;

‎dd-java-agent/agent-iast/src/main/java/com/datadog/iast/taint/Ranges.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -438,7 +438,8 @@ public static Range[] excludeRangesBySource(Range[] ranges, BitSet source) {
438438
RangeBuilder newRanges = new RangeBuilder(ranges.length);
439439

440440
for (Range range : ranges) {
441-
if (!source.get(range.getSource().getOrigin())) {
441+
if (range.getSource().getOrigin() == SourceTypes.NONE
442+
|| !source.get(range.getSource().getOrigin())) {
442443
newRanges.add(range);
443444
}
444445
}

0 commit comments

Comments
 (0)