Skip to content

Commit 99ff906

Browse files
jandro996jandro996
committed
wip
1 parent d9df78f commit 99ff906

File tree

4 files changed

+83
-44
lines changed

4 files changed

+83
-44
lines changed

‎dd-java-agent/instrumentation/akka/akka-http/akka-http-10.0/src/main/java/datadog/trace/instrumentation/akkahttp/iast/UriInstrumentation.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ static void after(
101101

102102
final IastContext ctx = reqCtx.getData(RequestContextSlot.IAST);
103103

104-
if (!prop.isTainted(ctx, uri)) {
104+
if (prop.isTainted(ctx, uri)) {
105105
return;
106106
}
107107

‎dd-smoke-tests/play-2.6/app/controllers/IastController.scala‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import play.api.mvc._
44

55
import java.nio.charset.StandardCharsets
66
import java.security.MessageDigest
7+
import java.net.{HttpURLConnection, URL}
78

89
class IastController extends Controller {
910

@@ -45,4 +46,22 @@ class IastController extends Controller {
4546
case e: Exception => InternalServerError(e.getMessage)
4647
}
4748
}
49+
50+
def sourceParameterGet = Action { request =>
51+
val table = request.queryString.get("table").map(_.head).getOrElse("")
52+
try {
53+
val url = new URL(table)
54+
val conn = url.openConnection().asInstanceOf[HttpURLConnection]
55+
conn.disconnect()
56+
} catch {
57+
case _: Exception => // ignorar
58+
}
59+
Ok(s"Request Parameters => source: $table")
60+
}
61+
62+
def sourceParameterPost = Action { request =>
63+
val table = request.body.asFormUrlEncoded.flatMap(_.get("table")).map(_.head).getOrElse("")
64+
Ok(s"Request Parameters => source: $table")
65+
}
66+
4867
}

‎dd-smoke-tests/play-2.6/conf/routes‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,7 @@ POST /api_security/response controllers.AppSecController.apiResp
1515
GET /iast/multiple_vulns/:id controllers.IastController.multipleVulns(id: String)
1616
POST /iast/multiple_vulns/:id controllers.IastController.postMultipleVulns(id: String)
1717
GET /iast/multiple_vulns-2/:id controllers.IastController.multipleVulns2(id: String)
18+
19+
# IAST Source endpoints
20+
GET /iast/source/parameter/test controllers.IastController.sourceParameterGet
21+
POST /iast/source/parameter/test controllers.IastController.sourceParameterPost

‎dd-smoke-tests/play-2.6/src/test/groovy/datadog/smoketest/IastPlaySmokeTest.groovy‎

Lines changed: 59 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ abstract class IastPlaySmokeTest extends AbstractIastServerSmokeTest {
3333
new ProcessBuilder("${playDirectory}/bin/${command}")
3434
processBuilder.directory(playDirectory)
3535
processBuilder.environment().put("JAVA_OPTS",
36+
'-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005 '+
3637
(defaultIastProperties + defaultJavaProperties).collect({ it.replace(' ', '\\ ')}).join(" ")
3738
+ " -Dconfig.file=${playDirectory}/conf/application.conf"
3839
+ " -Dhttp.port=${httpPort}"
@@ -51,53 +52,68 @@ abstract class IastPlaySmokeTest extends AbstractIastServerSmokeTest {
5152

5253
abstract String serverProvider()
5354

54-
void 'Test that all the vulnerabilities are detected'() {
55+
// void 'Test that all the vulnerabilities are detected'() {
56+
// given:
57+
// def requests = []
58+
// for (int i = 1; i <= 3; i++) {
59+
// requests.add(new Request.Builder()
60+
// .url("http://localhost:${httpPort}/iast/multiple_vulns/${i}?param=value${i}")
61+
// .get()
62+
// .build())
63+
// requests.add(new Request.Builder()
64+
// .url("http://localhost:${httpPort}/iast/multiple_vulns-2/${i}?param=value${i}")
65+
// .get()
66+
// .build())
67+
// requests.add(new Request.Builder()
68+
// .url("http://localhost:${httpPort}/iast/multiple_vulns/${i}")
69+
// .post(new FormBody.Builder().add('param', "value${i}").build())
70+
// .build())
71+
// }
72+
//
73+
//
74+
// when:
75+
// requests.each { req ->
76+
// client.newCall(req as Request).execute()
77+
// }
78+
//
79+
// then: 'check has route dispatched'
80+
// hasMeta('http.route')
81+
//
82+
// then: 'check first get mapping'
83+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'SHA1' }
84+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'SHA-1' }
85+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'MD2'}
86+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'MD5'}
87+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'RIPEMD128'}
88+
//
89+
// then: 'check first post mapping'
90+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'SHA1' }
91+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'SHA-1' }
92+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'MD2'}
93+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'MD5'}
94+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'RIPEMD128'}
95+
//
96+
// then: 'check second get mapping'
97+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'SHA1' }
98+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'SHA-1' }
99+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'MD2'}
100+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'MD5'}
101+
// hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'RIPEMD128'}
102+
// }
103+
104+
void 'Test'() {
55105
given:
56-
def requests = []
57-
for (int i = 1; i <= 3; i++) {
58-
requests.add(new Request.Builder()
59-
.url("http://localhost:${httpPort}/iast/multiple_vulns/${i}?param=value${i}")
60-
.get()
61-
.build())
62-
requests.add(new Request.Builder()
63-
.url("http://localhost:${httpPort}/iast/multiple_vulns-2/${i}?param=value${i}")
64-
.get()
65-
.build())
66-
requests.add(new Request.Builder()
67-
.url("http://localhost:${httpPort}/iast/multiple_vulns/${i}")
68-
.post(new FormBody.Builder().add('param', "value${i}").build())
69-
.build())
70-
}
71-
106+
def request = new Request.Builder()
107+
.url("http://localhost:${httpPort}/iast/source/parameter/test?table=value1")
108+
.get()
109+
.build()
72110

73111
when:
74-
requests.each { req ->
75-
client.newCall(req as Request).execute()
76-
}
112+
def response = client.newCall(request).execute()
77113

78-
then: 'check has route dispatched'
79-
hasMeta('http.route')
80-
81-
then: 'check first get mapping'
82-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'SHA1' }
83-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'SHA-1' }
84-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'MD2'}
85-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'MD5'}
86-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns$1' && vul.evidence.value == 'RIPEMD128'}
87-
88-
then: 'check first post mapping'
89-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'SHA1' }
90-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'SHA-1' }
91-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'MD2'}
92-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'MD5'}
93-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$postMultipleVulns$1' && vul.evidence.value == 'RIPEMD128'}
94-
95-
then: 'check second get mapping'
96-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'SHA1' }
97-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'SHA-1' }
98-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'MD2'}
99-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'MD5'}
100-
hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == '$anonfun$multipleVulns2$1' && vul.evidence.value == 'RIPEMD128'}
114+
then:
115+
response.code() == 200
116+
hasVulnerability { it.type == 'SSRF'}
101117
}
102118

103119
// Ensure to clean up server and not only the shell script that starts it

0 commit comments

Comments
 (0)