Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Map JSP stack traces to file names #7005

Open
wants to merge 24 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
4d2f1fe
Add StratumManager and some tests
jandro996 Apr 30, 2024
fa33ab4
improve StratumManager
jandro996 May 7, 2024
6cc03b8
clean and link everything
jandro996 May 8, 2024
daea85c
no necessary
jandro996 May 8, 2024
5571e21
fix
jandro996 May 8, 2024
3fd121a
fix
jandro996 May 9, 2024
1841455
avoid String#split to fix forbiddenapis
jandro996 Jun 12, 2024
7ae5d1e
Update dd-java-agent/agent-tooling/src/main/java/datadog/trace/agent/…
jandro996 Jun 26, 2024
86fa888
Update dd-java-agent/agent-tooling/src/main/java/datadog/trace/agent/…
jandro996 Jun 26, 2024
23886b4
Update dd-java-agent/agent-tooling/src/test/groovy/datadog/trace/agen…
jandro996 Jun 26, 2024
3c8ca9e
Update dd-java-agent/agent-tooling/src/test/groovy/datadog/trace/agen…
jandro996 Jun 26, 2024
f17de3b
fix import
jandro996 Jul 4, 2024
d85598e
fix spotless
jandro996 Jul 4, 2024
bdc0720
remove debug leftovers
jandro996 Jul 5, 2024
3ee8144
Clean unused methods
jandro996 Jul 5, 2024
8049726
Fix test and solve code analysis warnings
jandro996 Jul 5, 2024
03d5b95
Fix test and solve code analysis warnings
jandro996 Jul 5, 2024
046289f
Disable by default and add limit to the mappings
jandro996 Jul 8, 2024
5351f62
Fix code analysis
jandro996 Jul 8, 2024
a6fefdb
Fix test
jandro996 Jul 9, 2024
e606985
Merge branch 'master' into alejandro.gonzalez/xss_jsp_filename
jandro996 Jul 9, 2024
428334d
remove unnecessary null check
jandro996 Jul 9, 2024
164331d
improve StratumManagerImpl
jandro996 Jul 9, 2024
ff841a0
Refactor
jandro996 Jul 10, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,12 @@
import com.datadog.iast.util.ObjectVisitor;
import com.datadog.iast.util.RangeBuilder;
import datadog.trace.api.Config;
import datadog.trace.api.Pair;
import datadog.trace.api.iast.IastContext;
import datadog.trace.bootstrap.instrumentation.api.AgentSpan;
import datadog.trace.bootstrap.instrumentation.api.AgentTracer;
import datadog.trace.instrumentation.iastinstrumenter.IastExclusionTrie;
import datadog.trace.instrumentation.iastinstrumenter.SourceMapperImpl;
import datadog.trace.util.stacktrace.StackWalker;
import java.util.Iterator;
import java.util.stream.Stream;
Expand Down Expand Up @@ -210,6 +212,7 @@ protected Evidence checkInjectionDeeply(final VulnerabilityType type, final Obje
}

@Nullable
@SuppressWarnings("unused")
protected Evidence checkInjectionDeeply(
final VulnerabilityType type,
final Object value,
Expand All @@ -218,6 +221,7 @@ protected Evidence checkInjectionDeeply(
}

@Nullable
@SuppressWarnings("unused")
protected Evidence checkInjectionDeeply(
final VulnerabilityType type,
final Object value,
Expand Down Expand Up @@ -301,7 +305,20 @@ protected Location buildLocation(
}

protected final StackTraceElement getCurrentStackTrace() {
return stackWalker.walk(SinkModuleBase::findValidPackageForVulnerability);
StackTraceElement stackTraceElement =
stackWalker.walk(SinkModuleBase::findValidPackageForVulnerability);
// If the source mapper is enabled, we should try to map the stack trace element to the original
// source file
if (SourceMapperImpl.INSTANCE != null) {
Pair<String, Integer> pair =
SourceMapperImpl.INSTANCE.getFileAndLine(
stackTraceElement.getClassName(), stackTraceElement.getLineNumber());
if (pair != null && pair.getLeft() != null && pair.getRight() != null) {
return new StackTraceElement(
pair.getLeft(), stackTraceElement.getMethodName(), pair.getLeft(), pair.getRight());
}
}
return stackTraceElement;
}

static StackTraceElement findValidPackageForVulnerability(
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package datadog.trace.agent.tooling.iast.stratum;

public abstract class AbstractStratum {
smola marked this conversation as resolved.
Show resolved Hide resolved
private String name;

public AbstractStratum(final String name) {
this.name = name;
}

public String getName() {
return name;
}

public void setName(final String name) {
this.name = name;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
package datadog.trace.agent.tooling.iast.stratum;

import java.util.ArrayList;
import java.util.List;

public class EmbeddedStratum extends AbstractStratum {
private final List<SourceMap> sourceMapList = new ArrayList<>();

public EmbeddedStratum() {
this("");
}

public EmbeddedStratum(final String name) {
super(name);
}

public List<SourceMap> getSourceMapList() {
return sourceMapList;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
package datadog.trace.agent.tooling.iast.stratum;

/**
* The fileInfo describes the translated-source file names <a
* href="https://jakarta.ee/specifications/debugging/2.0/jdsol-spec-2.0#filesection">...</a>
*/
public class FileInfo {
private int fileId = -1;

private String inputFileName;

private String inputFilePath;

public int getFileId() {
return fileId;
}

public void setFileId(final int fileId) {
this.fileId = fileId;
}

public String getInputFileName() {
return inputFileName;
}

public void setInputFileName(final String inputFileName) {
this.inputFileName = inputFileName;
}

public String getInputFilePath() {
if (inputFilePath == null) {
return inputFileName;
}
return inputFilePath;
}

public void setInputFilePath(final String inputFilePath) {
this.inputFilePath = inputFilePath;
}

@Override
public String toString() {
return "FileInfo [fileId="
+ fileId
+ ", inputFileName="
+ inputFileName
+ ", inputFilePath="
+ inputFilePath
+ "]";
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
package datadog.trace.agent.tooling.iast.stratum;

/**
* The line section associates line numbers in the output source with line numbers and source names
* in the input source.
*
* <p>The format of the line section is the line section marker *L on a line by itself, followed by
* the lines of LineInfo. Each LineInfo has the form:
*
* <p>InputStartLine # LineFileID , RepeatCount : OutputStartLine , OutputLineIncrement where all
* but
*
* <p>InputStartLine : OutputStartLine are optional.
*
* <p><a
* href="https://jakarta.ee/specifications/debugging/2.0/jdsol-spec-2.0#stratumsection">...</a>
*/
public class LineInfo {
private int fileId;

int inputStartLine;

int repeatCount;

int outputStartLine;

int outputLineIncrement;

private FileInfo fileInfo;

public LineInfo(
final int fileId,
final int inputStartLine,
final int repeatCount,
final int outputStartLine,
final int outputLineIncrement) {
this.fileId = fileId;
fileInfo = null;
this.inputStartLine = inputStartLine;
this.repeatCount = repeatCount;
this.outputStartLine = outputStartLine;
this.outputLineIncrement = outputLineIncrement;
}

public LineInfo(
final FileInfo fileInfo,
final int inputStartLine,
final int repeatCount,
final int outputStartLine,
final int outputLineIncrement) {
fileId = -1;
this.fileInfo = fileInfo;
this.inputStartLine = inputStartLine;
this.repeatCount = repeatCount;
this.outputStartLine = outputStartLine;
this.outputLineIncrement = outputLineIncrement;
}

public int getFileId() {
return fileId;
}

public int getInputStartLine() {
return inputStartLine;
}

public int getRepeatCount() {
return repeatCount;
}

public int getOutputStartLine() {
return outputStartLine;
}

public int getOutputLineIncrement() {
return outputLineIncrement;
}

public FileInfo getFileInfo() {
return fileInfo;
}

public void setFileInfo(final FileInfo fileInfo) {
this.fileInfo = fileInfo;
}

@Override
public String toString() {
return "LineInfo [fileId="
+ fileId
+ ", inputStartLine="
+ inputStartLine
+ ", repeatCount="
+ repeatCount
+ ", outputStartLine="
+ outputStartLine
+ ", outputLineIncrement="
+ outputLineIncrement
+ ", fileInfo="
+ fileInfo
+ "]\n";
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
package datadog.trace.agent.tooling.iast.stratum;

public class Location {
private final FileInfo fileInfo;

private final int lineNum;

public Location(final FileInfo fileInfo, final int lineNum) {
this.fileInfo = fileInfo;
this.lineNum = lineNum;
}

public FileInfo getFileInfo() {
return fileInfo;
}

public int getLineNum() {
return lineNum;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
package datadog.trace.agent.tooling.iast.stratum;

public class ParserException extends SourceMapException {
/** */
private static final long serialVersionUID = 4991227723777615317L;

public ParserException() {}

public ParserException(final String msg) {
super(msg);
}
}
Loading
Loading