Skip to content

Commit 79eb2bf

Browse files
NizernizerNizernizer
authored
Merge pull request #568 from HXSecurity/beta
1.13.0 develop
2 parents f49f486 + 5dcf8f8 commit 79eb2bf

File tree

29 files changed

+319
-38
lines changed

29 files changed

+319
-38
lines changed

‎dongtai-agent/src/main/java/io/dongtai/iast/agent/IastProperties.java‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
public class IastProperties {
1818
public final static Map<String, String> ATTACH_ARG_MAP = new HashMap<String, String>() {{
1919
put("debug", PropertyConstant.PROPERTY_DEBUG);
20-
put("app_create", PropertyConstant.PROPERTY_APP_CREATE);
2120
put("app_name", PropertyConstant.PROPERTY_APP_NAME);
2221
put("app_version", PropertyConstant.PROPERTY_APP_VERSION);
2322
put("app_template", PropertyConstant.PROPERTY_APP_TEMPLATE);
@@ -129,20 +128,6 @@ public boolean isDebug() {
129128
return "true".equalsIgnoreCase(getDebugFlag());
130129
}
131130

132-
public Integer isAutoCreateProject() {
133-
if (null == isAutoCreateProject) {
134-
String result = System.getProperty(PropertyConstant.PROPERTY_APP_CREATE,
135-
System.getProperty("project.create", cfg.getProperty("project.create", "false"))
136-
);
137-
if ("true".equalsIgnoreCase(result)) {
138-
isAutoCreateProject = 1;
139-
} else {
140-
isAutoCreateProject = 0;
141-
}
142-
}
143-
return isAutoCreateProject;
144-
}
145-
146131
public String getProjectName() {
147132
if (null == projectName) {
148133
String[] names = new String[]{

‎dongtai-agent/src/main/java/io/dongtai/iast/agent/report/AgentRegisterReport.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ private String generateAgentRegisterMsg() {
6565
object.put("serverPath", ServerDetect.getWebServerPath());
6666
object.put("serverAddr", "");
6767
object.put("serverPort", "");
68-
object.put("autoCreateProject", IastProperties.getInstance().isAutoCreateProject());
6968
object.put("projectVersion", IastProperties.getInstance().getProjectVersion());
7069
object.put("projectTemplateId", IastProperties.getInstance().getProjectTemplate());
7170

‎dongtai-common/src/main/java/io/dongtai/iast/common/config/ConfigBuilder.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ private ConfigBuilder() {
2424
Config.<Boolean>create(ConfigKey.ENABLE_LOGGER));
2525
this.configMap.put(ConfigKey.LOGGER_LEVEL,
2626
Config.<String>create(ConfigKey.LOGGER_LEVEL));
27+
this.configMap.put(ConfigKey.VALIDATED_SINK,
28+
Config.<Boolean>create(ConfigKey.VALIDATED_SINK).setDefaultValue(false));
2729
}
2830

2931
public static ConfigBuilder getInstance() {
@@ -62,6 +64,7 @@ public void update(JSONObject config) {
6264
updateString(config, ConfigKey.JsonKey.JSON_VERSION_HEADER_KEY);
6365
updateBool(config, ConfigKey.JsonKey.JSON_ENABLE_LOGGER);
6466
updateString(config, ConfigKey.JsonKey.JSON_LOGGER_LEVEL);
67+
updateBool(config, ConfigKey.JsonKey.JSON_VALIDATED_SINK);
6568
updateRequestDenyList(config);
6669
}
6770

‎dongtai-common/src/main/java/io/dongtai/iast/common/config/ConfigKey.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ public enum ConfigKey {
88
VERSION_HEADER_KEY,
99
ENABLE_LOGGER,
1010
LOGGER_LEVEL,
11+
VALIDATED_SINK,
1112
;
1213

1314
public enum JsonKey {
@@ -18,6 +19,7 @@ public enum JsonKey {
1819
JSON_VERSION_HEADER_KEY("version_header_name", VERSION_HEADER_KEY),
1920
JSON_ENABLE_LOGGER("enable_log", ENABLE_LOGGER),
2021
JSON_LOGGER_LEVEL("log_level", LOGGER_LEVEL),
22+
JSON_VALIDATED_SINK("report_validated_sink", VALIDATED_SINK),
2123
;
2224

2325
private final String key;

‎dongtai-common/src/main/java/io/dongtai/iast/common/constants/PropertyConstant.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
public class PropertyConstant {
44
public static final String PROPERTY_DEBUG = "dongtai.debug";
5-
public static final String PROPERTY_APP_CREATE = "dongtai.app.create";
65
public static final String PROPERTY_APP_NAME = "dongtai.app.name";
76
public static final String PROPERTY_APP_VERSION = "dongtai.app.version";
87
public static final String PROPERTY_APP_TEMPLATE = "dongtai.app.template";
@@ -32,5 +31,5 @@ public class PropertyConstant {
3231
public static final String PROPERTY_POLICY_PATH = "dongtai.policy.path";
3332
public static final String PROPERTY_UUID_PATH = "dongtai.uuid.path";
3433
public static final String PROPERTY_DISABLED_PLUGINS = "dongtai.disabled.plugins";
35-
public static final String PROPERTY_DISABLED_FEATURES = "dongtai.disabled_features";
34+
public static final String PROPERTY_DISABLED_FEATURES = "dongtai.disabled.features";
3635
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/bytecode/enhance/asm/AsmMethods.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,12 @@ static Method getAsmMethod(final Class<?> clazz,
219219
SpyDispatcher.class,
220220
"isFirstLevelSink"
221221
);
222+
223+
Method SPY$enterValidator = InnerHelper.getAsmMethod(
224+
SpyDispatcher.class,
225+
"enterValidator"
226+
);
227+
222228
Method SPY$enterIgnoreInternal = InnerHelper.getAsmMethod(
223229
SpyDispatcher.class,
224230
"enterIgnoreInternal"

‎dongtai-core/src/main/java/io/dongtai/iast/core/bytecode/enhance/plugin/core/DispatchClassPlugin.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ public class ClassVisit extends AbstractClassVisitor {
5454
new SourceAdapter(),
5555
new PropagatorAdapter(),
5656
new SinkAdapter(),
57+
new ValidatorAdapter(),
5758
};
5859
}
5960

‎dongtai-core/src/main/java/io/dongtai/iast/core/bytecode/enhance/plugin/core/adapter/ValidatorAdapter.java‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package io.dongtai.iast.core.bytecode.enhance.plugin.core.adapter;
2+
3+
import io.dongtai.iast.core.bytecode.enhance.MethodContext;
4+
import io.dongtai.iast.core.handler.hookpoint.models.policy.PolicyNode;
5+
import io.dongtai.iast.core.handler.hookpoint.models.policy.ValidatorNode;
6+
import org.objectweb.asm.Label;
7+
import org.objectweb.asm.MethodVisitor;
8+
import org.objectweb.asm.Opcodes;
9+
10+
import java.util.Set;
11+
12+
public class ValidatorAdapter extends MethodAdapter {
13+
/**
14+
* @param adapter
15+
* @param mv
16+
* @param context
17+
* @param policyNodes
18+
*/
19+
@Override
20+
public void onMethodEnter(MethodAdviceAdapter adapter, MethodVisitor mv, MethodContext context, Set<PolicyNode> policyNodes) {
21+
}
22+
23+
/**
24+
* @param adapter
25+
* @param mv
26+
* @param opcode
27+
* @param context
28+
* @param policyNodes
29+
*/
30+
@Override
31+
public void onMethodExit(MethodAdviceAdapter adapter, MethodVisitor mv, int opcode, MethodContext context, Set<PolicyNode> policyNodes) {
32+
for (PolicyNode policyNode : policyNodes) {
33+
if (!(policyNode instanceof ValidatorNode)) {
34+
continue;
35+
}
36+
37+
Label elseLabel = new Label();
38+
Label endLabel = new Label();
39+
40+
isEnterScope(adapter);
41+
mv.visitJumpInsn(Opcodes.IFEQ, elseLabel);
42+
43+
adapter.trackMethod(opcode, policyNode, true);
44+
45+
adapter.mark(elseLabel);
46+
adapter.mark(endLabel);
47+
}
48+
}
49+
50+
private void isEnterScope(MethodAdviceAdapter adapter) {
51+
adapter.invokeStatic(ASM_TYPE_SPY_HANDLER, SPY_HANDLER$getDispatcher);
52+
adapter.invokeInterface(ASM_TYPE_SPY_DISPATCHER, SPY$enterValidator);
53+
}
54+
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/SpyDispatcherImpl.java‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,8 @@ public void collectDubboResponse(Object result, byte status) {
394394
}
395395

396396
if (!ScopeManager.SCOPE_TRACKER.getScope(Scope.DUBBO_REQUEST).isFirst()
397-
|| !ScopeManager.SCOPE_TRACKER.getScope(Scope.DUBBO_ENTRY).in()) {
397+
|| !ScopeManager.SCOPE_TRACKER.getScope(Scope.DUBBO_ENTRY).in()
398+
|| ScopeManager.SCOPE_TRACKER.getScope(Scope.HTTP_REQUEST).in()) {
398399
return;
399400
}
400401

@@ -558,6 +559,17 @@ public void leaveSink() {
558559
}
559560
}
560561

562+
/**
563+
* mark for enter validator entry point
564+
*/
565+
@Override
566+
public boolean enterValidator() {
567+
if (!EngineManager.isEngineRunning()) {
568+
return false;
569+
}
570+
return !ScopeManager.SCOPE_TRACKER.inAgent() && ScopeManager.SCOPE_TRACKER.inEnterEntry();
571+
}
572+
561573
/**
562574
* Determines whether it is a layer 1 Sink entry
563575
*
@@ -674,6 +686,9 @@ public boolean collectMethod(Object instance, Object[] parameters, Object retObj
674686
} else if ((policyNode instanceof SinkNode)) {
675687
SinkImpl.solveSink(event, (SinkNode) policyNode);
676688
return true;
689+
} else if ((policyNode instanceof ValidatorNode)) {
690+
ValidatorImpl.solveValidator(event,(ValidatorNode)policyNode, INVOKE_ID_SEQUENCER);
691+
return true;
677692
}
678693

679694
return false;
@@ -731,7 +746,7 @@ public boolean traceDubboInvoke(Object instance, String url, Object invocation,
731746
@Override
732747
public boolean isSkipCollectDubbo(Object invocation) {
733748
if (BlackUrlBypass.isBlackUrl()) {
734-
Method setAttachmentMethod = null;
749+
Method setAttachmentMethod;
735750
try {
736751
setAttachmentMethod = invocation.getClass().getMethod("setAttachment", String.class, String.class);
737752
setAttachmentMethod.setAccessible(true);
@@ -746,7 +761,7 @@ public boolean isSkipCollectDubbo(Object invocation) {
746761
@Override
747762
public boolean isSkipCollectFeign(Object instance) {
748763
if (BlackUrlBypass.isBlackUrl()) {
749-
Field metadataField = null;
764+
Field metadataField;
750765
try {
751766
metadataField = instance.getClass().getDeclaredField("metadata");
752767
metadataField.setAccessible(true);

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/DubboImpl.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import io.dongtai.iast.core.handler.context.ContextManager;
99
import io.dongtai.iast.core.handler.hookpoint.IastClassLoader;
1010
import io.dongtai.iast.core.handler.hookpoint.models.MethodEvent;
11+
import io.dongtai.iast.core.handler.hookpoint.models.policy.PolicyNodeType;
1112
import io.dongtai.iast.core.handler.hookpoint.models.policy.SourceNode;
1213
import io.dongtai.iast.core.handler.hookpoint.models.policy.TaintPosition;
1314
import io.dongtai.iast.core.handler.hookpoint.models.taint.range.TaintRange;
@@ -178,6 +179,7 @@ public static void collectDubboRequestSource(Object handler, Object invocation,
178179

179180
int invokeId = invokeIdSequencer.getAndIncrement();
180181
event.setInvokeId(invokeId);
182+
event.setPolicyType(PolicyNodeType.SOURCE.getName());
181183

182184
event.source = true;
183185
event.setCallStacks(StackUtils.createCallStack(4));

0 commit comments

Comments
 (0)