Skip to content

Commit f709af0

Browse files
manuel-alvarez-alvarezmanuel-alvarez-alvarez
authored
Fix tests related to IAST sources (#6700)
1 parent 79327cd commit f709af0

4 files changed

Lines changed: 36 additions & 32 deletions

File tree

  • dd-java-agent/instrumentation
    • akka-http-10.0/src/iastTest/groovy/datadog/trace/instrumentation/akkahttp/iast
    • pekko-http-1.0/src/iastTest/groovy/datadog/trace/instrumentation/pekkohttp/iast
    • spring-webflux-5/src/iastTest/groovy/datadog/trace/instrumentation/springwebflux/server
    • spring-webflux-6/src/iastTest/groovy/datadog/trace/instrumentation/springwebflux6/server

‎dd-java-agent/instrumentation/akka-http-10.0/src/iastTest/groovy/datadog/trace/instrumentation/akkahttp/iast/IastAkkaTest.groovy‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import spock.lang.Shared
1313
import java.nio.charset.StandardCharsets
1414

1515
import static org.hamcrest.Matchers.greaterThan
16-
import static org.hamcrest.Matchers.nullValue
1716

1817
class IastAkkaTest extends IastRequestTestRunner {
1918
@Shared
@@ -340,7 +339,7 @@ class IastAkkaTest extends IastRequestTestRunner {
340339
then:
341340
toc.hasTaintedObject {
342341
value 'var1=foo&var1=bar&var2=a+b+c'
343-
range 0, 28, source(SourceTypes.REQUEST_QUERY, null, null)
342+
range 0, 28, source(SourceTypes.REQUEST_QUERY, null, 'var1=foo&var1=bar&var2=a+b+c')
344343
}
345344
toc.hasTaintedObject {
346345
value 'var1'
@@ -486,14 +485,16 @@ class IastAkkaTest extends IastRequestTestRunner {
486485
}
487486

488487
void 'json request — #variant variant'() {
488+
given:
489+
final json = '''{
490+
"var1": "foo",
491+
"var2": ["foo2", "foo2"]
492+
}'''
493+
489494
when:
490495
String url = buildUrl "iast/$variant"
491496
def request = new Builder().url(url).post(
492-
RequestBody.create(MediaType.get("application/json"), '''{
493-
"var1": "foo",
494-
"var2": ["foo2", "foo2"]
495-
}'''.getBytes(StandardCharsets.US_ASCII))
496-
).build()
497+
RequestBody.create(MediaType.get("application/json"), json.getBytes(StandardCharsets.US_ASCII))).build()
497498
def response = client.newCall(request).execute()
498499
def respBody = response.body().string()
499500

@@ -505,21 +506,22 @@ class IastAkkaTest extends IastRequestTestRunner {
505506
def toc = finReqTaintedObjects
506507

507508
then:
509+
// source values take the value of the full body as it's converted to string at TaintFutureHelper
508510
toc.hasTaintedObject {
509511
value 'var1'
510-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
512+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', json)
511513
}
512514
toc.hasTaintedObject {
513515
value 'var2'
514-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
516+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', json)
515517
}
516518
toc.hasTaintedObject {
517519
value 'foo'
518-
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
520+
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', json)
519521
}
520522
toc.hasTaintedObject {
521523
value 'foo2'
522-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
524+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', json)
523525
}
524526

525527
where:

‎dd-java-agent/instrumentation/pekko-http-1.0/src/iastTest/groovy/datadog/trace/instrumentation/pekkohttp/iast/IastPekkoTest.groovy‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import spock.lang.Shared
1313
import java.nio.charset.StandardCharsets
1414

1515
import static org.hamcrest.Matchers.greaterThan
16-
import static org.hamcrest.Matchers.nullValue
1716

1817
class IastPekkoTest extends IastRequestTestRunner {
1918
@Shared
@@ -340,7 +339,7 @@ class IastPekkoTest extends IastRequestTestRunner {
340339
then:
341340
toc.hasTaintedObject {
342341
value 'var1=foo&var1=bar&var2=a+b+c'
343-
range 0, 28, source(SourceTypes.REQUEST_QUERY, null, null)
342+
range 0, 28, source(SourceTypes.REQUEST_QUERY, null, 'var1=foo&var1=bar&var2=a+b+c')
344343
}
345344
toc.hasTaintedObject {
346345
value 'var1'
@@ -486,14 +485,16 @@ class IastPekkoTest extends IastRequestTestRunner {
486485
}
487486

488487
void 'json request — #variant variant'() {
488+
given:
489+
final json = '''{
490+
"var1": "foo",
491+
"var2": ["foo2", "foo2"]
492+
}'''
493+
489494
when:
490495
String url = buildUrl "iast/$variant"
491496
def request = new Builder().url(url).post(
492-
RequestBody.create(MediaType.get("application/json"), '''{
493-
"var1": "foo",
494-
"var2": ["foo2", "foo2"]
495-
}'''.getBytes(StandardCharsets.US_ASCII))
496-
).build()
497+
RequestBody.create(MediaType.get("application/json"), json.getBytes(StandardCharsets.US_ASCII))).build()
497498
def response = client.newCall(request).execute()
498499
def respBody = response.body().string()
499500

@@ -505,21 +506,22 @@ class IastPekkoTest extends IastRequestTestRunner {
505506
def toc = finReqTaintedObjects
506507

507508
then:
509+
// source values take the value of the full body as it's converted to string at TaintFutureHelper
508510
toc.hasTaintedObject {
509511
value 'var1'
510-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
512+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', json)
511513
}
512514
toc.hasTaintedObject {
513515
value 'var2'
514-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
516+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', json)
515517
}
516518
toc.hasTaintedObject {
517519
value 'foo'
518-
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
520+
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', json)
519521
}
520522
toc.hasTaintedObject {
521523
value 'foo2'
522-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
524+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', json)
523525
}
524526

525527
where:

‎dd-java-agent/instrumentation/spring-webflux-5/src/iastTest/groovy/datadog/trace/instrumentation/springwebflux/server/IastWebFluxTest.groovy‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ import org.springframework.web.reactive.config.WebFluxConfigurer
2424
import java.nio.charset.StandardCharsets
2525

2626
import static org.hamcrest.Matchers.equalToIgnoringCase
27-
import static org.hamcrest.Matchers.nullValue
2827

2928
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT, classes = [Application])
3029
class IastWebFluxTest extends IastRequestTestRunner {
@@ -275,21 +274,22 @@ class IastWebFluxTest extends IastRequestTestRunner {
275274
def toc = finReqTaintedObjects
276275

277276
then:
277+
// source values take the value of the current object as the body is never converted to a CharSequence
278278
toc.hasTaintedObject {
279279
value 'var1'
280-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
280+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', 'var1')
281281
}
282282
toc.hasTaintedObject {
283283
value 'var2'
284-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
284+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', 'var2')
285285
}
286286
toc.hasTaintedObject {
287287
value 'foo'
288-
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
288+
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', 'foo')
289289
}
290290
toc.hasTaintedObject {
291291
value 'foo2'
292-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
292+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', 'foo2')
293293
}
294294
}
295295
}

‎dd-java-agent/instrumentation/spring-webflux-6/src/iastTest/groovy/datadog/trace/instrumentation/springwebflux6/server/IastWebFluxTest.groovy‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ import org.springframework.web.reactive.config.WebFluxConfigurer
2525
import java.nio.charset.StandardCharsets
2626

2727
import static org.hamcrest.Matchers.equalToIgnoringCase
28-
import static org.hamcrest.Matchers.nullValue
2928

3029
@SpringBootTest(
3130
properties = "spring.main.web-application-type=reactive",
@@ -278,21 +277,22 @@ class IastWebFluxTest extends IastRequestTestRunner {
278277
def toc = finReqTaintedObjects
279278

280279
then:
280+
// source values take the value of the current object as the body is never converted to a CharSequence
281281
toc.hasTaintedObject {
282282
value 'var1'
283-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
283+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1', 'var1')
284284
}
285285
toc.hasTaintedObject {
286286
value 'var2'
287-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
287+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', 'var2')
288288
}
289289
toc.hasTaintedObject {
290290
value 'foo'
291-
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', nullValue())
291+
range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1', 'foo')
292292
}
293293
toc.hasTaintedObject {
294294
value 'foo2'
295-
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', nullValue())
295+
range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2', 'foo2')
296296
}
297297
}
298298
}

0 commit comments

Comments
 (0)