Always taint the resulting URL

DataDog · Jul 11, 2024 · 49ed213 · 49ed213
1 parent f3bece5
commit 49ed213
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/dd-java-agent/agent-iast/src/main/java/com/datadog/iast/propagation/CodecModuleImpl.java b/dd-java-agent/agent-iast/src/main/java/com/datadog/iast/propagation/CodecModuleImpl.java
@@ -84,18 +84,25 @@ private void taintUrlIfAnyTainted(@Nonnull final Object url, @Nonnull final Obje
     final TaintedObjects to = ctx.getTaintedObjects();
     final String toString = url.toString();
     final RangeBuilder builder = new RangeBuilder();
+    boolean hasTainted = false;
     for (final Object arg : args) {
       final TaintedObject tainted = to.get(arg);
       if (tainted != null) {
+        hasTainted = true;
         final int offset = toString.indexOf(arg.toString());
         if (offset >= 0) {
           builder.add(tainted.getRanges(), offset);
         }
       }
     }
-    if (builder.isEmpty()) {
+    if (!hasTainted) {
       return;
     }
-    to.taint(url, builder.toArray());
+    if (builder.isEmpty()) {
+      // no mappings of tainted values in the URL, resort to fully tainting it
+      propagationModule.taintObjectIfAnyTainted(url, args);
+    } else {
+      to.taint(url, builder.toArray());
+    }
   }
 }