-
Notifications
You must be signed in to change notification settings - Fork 292
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added NoHttpOnlyCookie Module and refactored InstrumentationBridge
- Loading branch information
1 parent
ce8a316
commit ec18d0e
Showing
29 changed files
with
368 additions
and
178 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
28 changes: 28 additions & 0 deletions
28
dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/NoHttpOnlyCookieModuleImpl.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| package com.datadog.iast.sink; | ||
|
|
||
| import com.datadog.iast.model.Evidence; | ||
| import com.datadog.iast.model.VulnerabilityType; | ||
| import com.datadog.iast.overhead.Operations; | ||
| import datadog.trace.api.iast.sink.NoHttpOnlyCookieModule; | ||
| import datadog.trace.bootstrap.instrumentation.api.AgentSpan; | ||
| import datadog.trace.bootstrap.instrumentation.api.AgentTracer; | ||
| import javax.annotation.Nonnull; | ||
|
|
||
| public class NoHttpOnlyCookieModuleImpl extends SinkModuleBase implements NoHttpOnlyCookieModule { | ||
|
|
||
| @Override | ||
| public void onCookie( | ||
| @Nonnull final String name, | ||
| final String value, | ||
| final boolean isSecure, | ||
| final boolean isHttpOnly, | ||
| final String sameSite) { | ||
| if (!isHttpOnly) { | ||
| final AgentSpan span = AgentTracer.activeSpan(); | ||
| if (!overheadController.consumeQuota(Operations.REPORT_VULNERABILITY, span)) { | ||
| return; | ||
| } | ||
| report(span, VulnerabilityType.NO_HTTPONLY_COOKIE, new Evidence(name)); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
122 changes: 122 additions & 0 deletions
122
dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/NoHttpCookieModuleTest.groovy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| package com.datadog.iast.sink | ||
|
|
||
| import com.datadog.iast.IastModuleImplTestBase | ||
| import com.datadog.iast.IastRequestContext | ||
| import com.datadog.iast.model.Vulnerability | ||
| import com.datadog.iast.model.VulnerabilityType | ||
| import datadog.trace.api.gateway.RequestContext | ||
| import datadog.trace.api.gateway.RequestContextSlot | ||
| import datadog.trace.bootstrap.instrumentation.api.AgentSpan | ||
| import groovy.transform.CompileDynamic | ||
|
|
||
| @CompileDynamic | ||
| class NoHttpCookieModuleTest extends IastModuleImplTestBase { | ||
|
|
||
| private List<Object> objectHolder | ||
|
|
||
| private IastRequestContext ctx | ||
|
|
||
| private NoHttpOnlyCookieModuleImpl module | ||
|
|
||
| private AgentSpan span | ||
|
|
||
| def setup() { | ||
| module = registerDependencies(new NoHttpOnlyCookieModuleImpl()) | ||
| objectHolder = [] | ||
| ctx = new IastRequestContext() | ||
| final reqCtx = Mock(RequestContext) { | ||
| getData(RequestContextSlot.IAST) >> ctx | ||
| } | ||
| span = Mock(AgentSpan) { | ||
| getSpanId() >> 123456 | ||
| getRequestContext() >> reqCtx | ||
| } | ||
| } | ||
|
|
||
| void 'report NoHttp cookie with InsecureCookieModule.onCookie'() { | ||
| given: | ||
| Vulnerability savedVul | ||
| final cookie = HttpCookie.parse(cookieValue).first() | ||
|
|
||
| when: | ||
| module.onCookie(cookie.name, cookie.value, cookie.secure, cookie.httpOnly, null) | ||
|
|
||
| then: | ||
| 1 * tracer.activeSpan() >> span | ||
| 1 * overheadController.consumeQuota(_, _) >> true | ||
| 1 * reporter.report(_, _ as Vulnerability) >> { savedVul = it[1] } | ||
| with(savedVul) { | ||
| type == VulnerabilityType.NO_HTTPONLY_COOKIE | ||
| location != null | ||
| with(evidence) { | ||
| value == expected | ||
| } | ||
| } | ||
|
|
||
| where: | ||
| cookieValue | expected | ||
| "user-id=7" | "user-id" | ||
| } | ||
|
|
||
| void 'report insecure cookie with NoHttpOnlyCookieModule.onCookie'() { | ||
| given: | ||
| Vulnerability savedVul | ||
| final cookie = new HttpCookie(cookieName, cookieValue) | ||
| cookie.httpOnly = isHttpOnly | ||
|
|
||
| when: | ||
| module.onCookie(cookie.name, cookie.value, cookie.secure, cookie.httpOnly, null) | ||
|
|
||
| then: | ||
| 1 * tracer.activeSpan() >> span | ||
| 1 * overheadController.consumeQuota(_, _) >> true | ||
| 1 * reporter.report(_, _ as Vulnerability) >> { savedVul = it[1] } | ||
| with(savedVul) { | ||
| type == VulnerabilityType.NO_HTTPONLY_COOKIE | ||
| location != null | ||
| with(evidence) { | ||
| value == expected | ||
| } | ||
| } | ||
|
|
||
| where: | ||
| cookieName | cookieValue | isHttpOnly | expected | ||
| "user-id" | "7" | false | "user-id" | ||
| } | ||
|
|
||
| void 'cases where nothing is reported during NoHttpModuleCookie.onCookie'() { | ||
| given: | ||
| final cookie = HttpCookie.parse(cookieValue).first() | ||
|
|
||
| when: | ||
| module.onCookie(cookie.name, cookie.value, cookie.secure, cookie.httpOnly, null) | ||
|
|
||
| then: | ||
| 0 * tracer.activeSpan() | ||
| 0 * overheadController._ | ||
| 0 * reporter._ | ||
|
|
||
| where: | ||
| cookieValue | _ | ||
| "user-id=7; HttpOnly" | _ | ||
| "user-id=7;HttpOnly" | _ | ||
| } | ||
|
|
||
| void 'insecure no http only is not reported with NoHttpOnlyCookieModule.onCookie'() { | ||
| given: | ||
| final cookie = new HttpCookie(cookieName, cookieValue) | ||
| cookie.httpOnly = isHttpOnly | ||
|
|
||
| when: | ||
| module.onCookie(cookie.name, cookie.value, cookie.secure, cookie.httpOnly, null) | ||
|
|
||
| then: | ||
| 0 * tracer.activeSpan() >> span | ||
| 0 * overheadController.consumeQuota(_, _) >> true | ||
| 0 * reporter.report(_, _ as Vulnerability) | ||
|
|
||
| where: | ||
| cookieName | cookieValue | isHttpOnly | ||
| "user-id" | "7" | true | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.