Skip to content

Commit e6180bc

Browse files
author
‘niuerzhuang’
committed
fix: String hash enhance.
1 parent 13729c7 commit e6180bc

File tree

12 files changed

+74
-47
lines changed

12 files changed

+74
-47
lines changed

‎dongtai-core/src/main/java/io/dongtai/iast/core/EngineManager.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -136,16 +136,16 @@ public static void enterHttpEntry(Map<String, Object> requestMeta) {
136136
}
137137
REQUEST_CONTEXT.set(requestMeta);
138138
TRACK_MAP.set(new HashMap<Integer, MethodEvent>(1024));
139-
TAINT_HASH_CODES.set(new HashSet<Integer>());
140-
TAINT_RANGES_POOL.set(new HashMap<Integer, TaintRanges>());
139+
TAINT_HASH_CODES.set(new HashSet<Long>());
140+
TAINT_RANGES_POOL.set(new HashMap<Long, TaintRanges>());
141141
ScopeManager.SCOPE_TRACKER.getScope(Scope.HTTP_ENTRY).enter();
142142
}
143143

144144
public static void enterDubboEntry(Map<String, Object> requestMeta) {
145145
REQUEST_CONTEXT.set(requestMeta);
146146
TRACK_MAP.set(new HashMap<Integer, MethodEvent>(1024));
147-
TAINT_HASH_CODES.set(new HashSet<Integer>());
148-
TAINT_RANGES_POOL.set(new HashMap<Integer, TaintRanges>());
147+
TAINT_HASH_CODES.set(new HashSet<Long>());
148+
TAINT_RANGES_POOL.set(new HashMap<Long, TaintRanges>());
149149
ScopeManager.SCOPE_TRACKER.getScope(Scope.DUBBO_ENTRY).enter();
150150
}
151151
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/DubboImpl.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ public static void collectDubboRequestSource(Object handler, Object invocation,
101101

102102
// for display taint range (full arguments value)
103103
String fv = event.parameterValues.get(0).getValue();
104-
int hash = System.identityHashCode(fv);
104+
long hash = TaintPoolUtils.toStringHash(fv.hashCode(),System.identityHashCode(fv));
105105
int len = TaintRangesBuilder.getLength(fv);
106106
TaintRanges tr = new TaintRanges(new TaintRange(0, len));
107107
event.targetRanges.add(0, new MethodEvent.MethodEventTargetRange(hash, tr));

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ private static boolean setTarget(PropagatorNode propagatorNode, MethodEvent even
165165
}
166166

167167
private static TaintRanges getTaintRanges(Object obj) {
168-
int hash = System.identityHashCode(obj);
168+
long hash = TaintPoolUtils.getStringHash(obj);
169169
TaintRanges tr = EngineManager.TAINT_RANGES_POOL.get(hash);
170170
if (tr == null) {
171171
tr = new TaintRanges();
@@ -209,7 +209,7 @@ private static void trackTaintRange(PropagatorNode propagatorNode, MethodEvent e
209209
}
210210
}
211211

212-
int tgtHash = 0;
212+
long tgtHash = 0;
213213
Object tgt = null;
214214
Set<TaintPosition> targetLocs = propagatorNode.getTargets();
215215
// may have multiple targets?
@@ -218,17 +218,16 @@ private static void trackTaintRange(PropagatorNode propagatorNode, MethodEvent e
218218
}
219219
if (TaintPosition.hasObject(targetLocs)) {
220220
tgt = event.objectInstance;
221-
tgtHash = System.identityHashCode(tgt);
221+
tgtHash = TaintPoolUtils.getStringHash(tgt);
222222
oldTaintRanges = getTaintRanges(tgt);
223223
} else if (TaintPosition.hasReturn(targetLocs)) {
224-
tgt = event.returnInstance;
225-
tgtHash = System.identityHashCode(tgt);
224+
tgtHash = TaintPoolUtils.getStringHash(tgt);
226225
} else if (TaintPosition.hasParameter(targetLocs)) {
227226
for (TaintPosition targetLoc : targetLocs) {
228227
int parameterIndex = targetLoc.getParameterIndex();
229228
if (event.parameterInstances.length > parameterIndex) {
230229
tgt = event.parameterInstances[parameterIndex];
231-
tgtHash = System.identityHashCode(tgt);
230+
tgtHash = TaintPoolUtils.getStringHash(tgt);
232231
oldTaintRanges = getTaintRanges(tgt);
233232
}
234233
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,9 @@ public class MethodEvent {
8282
*/
8383
public String returnValue;
8484

85-
private final Set<Integer> sourceHashes = new HashSet<Integer>();
85+
private final Set<Long> sourceHashes = new HashSet<Long>();
8686

87-
private final Set<Integer> targetHashes = new HashSet<Integer>();
87+
private final Set<Long> targetHashes = new HashSet<Long>();
8888

8989
public List<MethodEventTargetRange> targetRanges = new ArrayList<MethodEventTargetRange>();
9090

@@ -118,10 +118,10 @@ public JSONObject toJson() {
118118
}
119119

120120
public static class MethodEventSourceType {
121-
private final Integer hash;
121+
private final Long hash;
122122
private final String type;
123123

124-
public MethodEventSourceType(Integer hash, String type) {
124+
public MethodEventSourceType(Long hash, String type) {
125125
this.hash = hash;
126126
this.type = type;
127127
}
@@ -135,10 +135,10 @@ public JSONObject toJson() {
135135
}
136136

137137
public static class MethodEventTargetRange {
138-
private final Integer hash;
138+
private final Long hash;
139139
private final TaintRanges ranges;
140140

141-
public MethodEventTargetRange(Integer hash, TaintRanges ranges) {
141+
public MethodEventTargetRange(Long hash, TaintRanges ranges) {
142142
this.hash = hash;
143143
this.ranges = ranges;
144144
}
@@ -234,19 +234,19 @@ private String formatValue(Object val, boolean hasTaint) {
234234
+ (hasTaint ? "*" : "") + String.valueOf(str.length());
235235
}
236236

237-
public Set<Integer> getSourceHashes() {
237+
public Set<Long> getSourceHashes() {
238238
return sourceHashes;
239239
}
240240

241-
public void addSourceHash(int hashcode) {
241+
public void addSourceHash(long hashcode) {
242242
this.sourceHashes.add(hashcode);
243243
}
244244

245-
public Set<Integer> getTargetHashes() {
245+
public Set<Long> getTargetHashes() {
246246
return targetHashes;
247247
}
248248

249-
public void addTargetHash(int hashCode) {
249+
public void addTargetHash(long hashCode) {
250250
this.targetHashes.add(hashCode);
251251
}
252252

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ private boolean sinkSourceHitTaintPool(MethodEvent event, SinkNode sinkNode) {
122122
if (VulnType.REFLECTED_XSS.equals(sinkNode.getVulType()) && !sourceInstances.isEmpty()) {
123123
boolean tagsHit = false;
124124
for (Object sourceInstance : sourceInstances) {
125-
int hash = System.identityHashCode(sourceInstance);
125+
long hash = TaintPoolUtils.getStringHash(sourceInstance);
126126
TaintRanges tr = EngineManager.TAINT_RANGES_POOL.get(hash);
127127
if (tr == null || tr.isEmpty()) {
128128
continue;

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/PathTraversalCheck.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ private boolean checkPath(String path, MethodEvent event) {
112112
return false;
113113
}
114114

115-
TaintRanges tr = EngineManager.TAINT_RANGES_POOL.get(System.identityHashCode(path));
115+
TaintRanges tr = EngineManager.TAINT_RANGES_POOL.get(TaintPoolUtils.toStringHash(path.hashCode(),System.identityHashCode(path)));
116116
if (tr.isEmpty()) {
117117
return false;
118118
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/SSRFSourceCheck.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -361,7 +361,8 @@ private boolean addSourceType(MethodEvent event, Map<String, Object> sourceMap)
361361

362362
private boolean checkTaintPool(MethodEvent event, String key, Object value) {
363363
if (!"".equals(value) && TaintPoolUtils.poolContains(value, event)) {
364-
event.sourceTypes.add(new MethodEvent.MethodEventSourceType(System.identityHashCode(value), key));
364+
long hash = TaintPoolUtils.getStringHash(value);
365+
event.sourceTypes.add(new MethodEvent.MethodEventSourceType(hash, key));
365366
return true;
366367
}
367368
return false;

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/UnvalidatedRedirectCheck.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,8 +125,8 @@ private boolean checkValue(Object val, MethodEvent event) {
125125
if (!TaintPoolUtils.poolContains(val, event)) {
126126
return false;
127127
}
128-
129-
TaintRanges tr = EngineManager.TAINT_RANGES_POOL.get(System.identityHashCode(val));
128+
long hash = TaintPoolUtils.getStringHash(val);
129+
TaintRanges tr = EngineManager.TAINT_RANGES_POOL.get(hash);
130130
if (tr.isEmpty()) {
131131
return false;
132132
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/utils/HashCode.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @author [email protected]
55
*/
66
public class HashCode {
7-
public static int calc(Object obj) {
7+
public static long calc(Object obj) {
88
if (obj instanceof String) {
99
return ((String) obj).hashCode();
1010
} else {

‎dongtai-core/src/main/java/io/dongtai/iast/core/utils/TaintPoolUtils.java‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,12 @@ public static boolean poolContains(Object obj, MethodEvent event) {
2929
return false;
3030
}
3131

32+
long hash = getStringHash(obj);
3233
boolean isContains;
3334
// check object hash exists
34-
isContains = contains(obj);
35+
isContains = contains(hash);
3536
if (isContains) {
36-
event.addSourceHash(System.identityHashCode(obj));
37+
event.addSourceHash(hash);
3738
return true;
3839
}
3940

@@ -59,11 +60,11 @@ public static boolean poolContains(Object obj, MethodEvent event) {
5960
/**
6061
* 判断污点是否匹配
6162
*
62-
* @param obj Object
63+
* @param hash long
6364
* @return boolean
6465
*/
65-
private static boolean contains(Object obj) {
66-
return EngineManager.TAINT_HASH_CODES.contains(System.identityHashCode(obj));
66+
private static boolean contains(long hash) {
67+
return EngineManager.TAINT_HASH_CODES.contains(hash);
6768
}
6869

6970
/**
@@ -141,10 +142,17 @@ public static void trackObject(MethodEvent event, PolicyNode policyNode, Object
141142
return;
142143
}
143144

144-
int hash = 0;
145+
long hash = 0;
146+
long identityHash = 0;
145147
boolean isSourceNode = policyNode instanceof SourceNode;
146148
if (isSourceNode) {
147-
hash = System.identityHashCode(obj);
149+
if (obj instanceof String){
150+
identityHash = System.identityHashCode(obj);
151+
hash = toStringHash(obj.hashCode(),identityHash);
152+
}else {
153+
hash = System.identityHashCode(obj);
154+
identityHash = hash;
155+
}
148156
if (EngineManager.TAINT_HASH_CODES.contains(hash)) {
149157
return;
150158
}
@@ -170,7 +178,7 @@ public static void trackObject(MethodEvent event, PolicyNode policyNode, Object
170178
} else {
171179
if (isSourceNode) {
172180
int len = TaintRangesBuilder.getLength(obj);
173-
if (hash == 0 || len == 0) {
181+
if (identityHash == 0 || len == 0) {
174182
return;
175183
}
176184

@@ -205,7 +213,7 @@ public static void trackObject(MethodEvent event, PolicyNode policyNode, Object
205213
}
206214
}
207215
} else {
208-
hash = System.identityHashCode(obj);
216+
hash = getStringHash(obj);
209217
if (EngineManager.TAINT_HASH_CODES.contains(hash)) {
210218
event.addSourceHash(hash);
211219
}
@@ -251,4 +259,19 @@ private static void trackOptional(MethodEvent event, PolicyNode policyNode, Obje
251259
} catch (Throwable ignore) {
252260
}
253261
}
262+
263+
public static Long toStringHash(long objectHashCode,long identityHashCode) {
264+
return (objectHashCode << 32) | (identityHashCode & 0xFFFFFFFFL);
265+
}
266+
267+
public static Long getStringHash(Object obj) {
268+
long hash;
269+
if (obj instanceof String){
270+
hash = TaintPoolUtils.toStringHash(obj.hashCode(),System.identityHashCode(obj));
271+
}else {
272+
hash = System.identityHashCode(obj);
273+
}
274+
return hash;
275+
}
276+
254277
}

0 commit comments

Comments
 (0)