Summary of changes

Implementation of insecure hashing and some of the basic classes that will be used in IAST, taking as a model the Java implementation.

Reason for change

The IAST implementation starts with the insecure hashing implementation.

Implementation details

Implementation of insecure hashing and some of the basic classes that will be used in IAST, taking as a model the Java implementation.

Work included:
Hashing instrumentation for netcore.
Weak hashing detection and span creation.
Basic IAST infrastructure classes and configuration.
Integration tests for weak hashing calls.

Work NOT included:
Implement the request related variables:
https://datadoghq.atlassian.net/wiki/spaces/APS/pages/2604597520/ASM+IAST+Configuration+Properties
Implement DD_IAST_MAX_CONCURRENT_REQUESTS
Implement DD_IAST_MAX_CONTEXT_OPERATIONS
Implement DD_IAST_REQUEST_SAMPLING
Avoid sending repeated vulnerabilities within a request
Net framework support is not implemented in this PR: it would require to instrumentate mscorlib

Notes:
Right now, with this PR, we send a span everytime a weak hashing method is called. In the future, if we are in a request, we will send all the vulnerabilities after the request finishes and we will eliminate the repeated ones.
In the IastJson label of the span, a Json is sent containing the vulnerability data. The filename and line number of the vulnerability should be sent if possible. Otherwise, the full methodName is sent.
We were using in the tracer the class MD5 for uuid generation. This algorithm is considered insecure and would raise a span. The callsite instrumentation will avoid us sending spans generated from our own code. Anyway, the MD5 class has been replaced by a secure one.
Right now, we always set the IastEnabled tag to "1" in the span, but in the future, it might be zero to indicate that a request has not been analyzed

This is the actual tag field of the span:
Tags: {
_dd.iast.enabled: 1,
_dd.iast.json:
{
"Vulnerabilities": [
{
"Type": "WEAK_HASH",
"Location": {
"Path": "c:\myfile.cs",
"Line": 50
},
"Evidence": {
"Value": "System.Security.Cryptography.HMACMD5"
}
}
]
}
}

Test coverage

Other details