Template injection vulnerability detection in handlebars and pug by IlyasShabi · Pull Request #4827 · DataDog/dd-trace-js

IlyasShabi · 2024-10-25T15:34:46Z

What does this PR do?

Add support to server Template injection using handlebars and pug

Plugin Checklist

Additional Notes

github-actions · 2024-10-25T15:35:36Z

Overall package size

Self size: 7.96 MB
Deduped: 64.98 MB
No deduping: 65.32 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | @datadog/native-appsec | 8.2.1 | 19.18 MB | 19.19 MB | | @datadog/native-iast-taint-tracking | 3.2.0 | 13.9 MB | 13.91 MB | | @datadog/pprof | 5.4.1 | 9.76 MB | 10.13 MB | | protobufjs | 7.2.5 | 2.77 MB | 5.16 MB | | @datadog/native-iast-rewriter | 2.5.0 | 2.51 MB | 2.65 MB | | @opentelemetry/core | 1.14.0 | 872.87 kB | 1.47 MB | | @datadog/native-metrics | 3.0.1 | 1.06 MB | 1.46 MB | | @opentelemetry/api | 1.8.0 | 1.21 MB | 1.21 MB | | import-in-the-middle | 1.11.2 | 112.74 kB | 826.22 kB | | msgpack-lite | 0.1.26 | 201.16 kB | 281.59 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | lru-cache | 7.18.3 | 133.92 kB | 133.92 kB | | pprof-format | 2.1.0 | 111.69 kB | 111.69 kB | | @datadog/sketches-js | 2.1.0 | 109.9 kB | 109.9 kB | | semver | 7.6.3 | 95.82 kB | 95.82 kB | | lodash.sortby | 4.7.0 | 75.76 kB | 75.76 kB | | ignore | 5.3.1 | 51.46 kB | 51.46 kB | | int64-buffer | 0.1.10 | 49.18 kB | 49.18 kB | | shell-quote | 1.8.1 | 44.96 kB | 44.96 kB | | istanbul-lib-coverage | 3.2.0 | 29.34 kB | 29.34 kB | | rfdc | 1.3.1 | 25.21 kB | 25.21 kB | | tlhunter-sorted-set | 0.1.0 | 24.94 kB | 24.94 kB | | limiter | 1.1.5 | 23.17 kB | 23.17 kB | | dc-polyfill | 0.1.4 | 23.1 kB | 23.1 kB | | retry | 0.13.1 | 18.85 kB | 18.85 kB | | jest-docblock | 29.7.0 | 8.99 kB | 12.76 kB | | crypto-randomuuid | 1.0.0 | 11.18 kB | 11.18 kB | | koalas | 1.0.2 | 6.47 kB | 6.47 kB | | path-to-regexp | 0.1.10 | 6.38 kB | 6.38 kB | | module-details-from-path | 1.0.3 | 4.47 kB | 4.47 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

pr-commenter · 2024-10-25T15:42:51Z

Benchmarks

Benchmark execution time: 2024-11-12 09:14:00

Comparing candidate commit 04a6184 in PR branch template-injection-handlebars with baseline commit 0a411ee in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 259 metrics, 7 unstable metrics.

codecov · 2024-10-28T08:09:29Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 86.88%. Comparing base (0b4dab7) to head (d22bf54).
Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4827      +/-   ##
==========================================
- Coverage   93.86%   86.88%   -6.98%     
==========================================
  Files         107       10      -97     
  Lines        3373      511    -2862     
==========================================
- Hits         3166      444    -2722     
+ Misses        207       67     -140

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

CarlesDD · 2024-11-06T12:27:46Z

In Handlebars there is one more vulnerable point that this PR is not covering: registerPartial.

Let's take the following code as an example:

  Handlebars.registerPartial('vulnerablePartial', req.query.partial).
  const templateSource = `{{> vulnerablePartial }}`
  const template = Handlebars.compile(templateSource)

This code is vulnerable to SSTi, but the tests I have run do not detect the vulnerability (and it is logical because registerPartial never calls compile or precompile).

datadog-datadog-prod-us1 · 2024-11-12T09:05:38Z

+      - run: yarn test:appsec:plugins:ci
+      - uses: ./.github/actions/node/latest
+      - run: yarn test:appsec:plugins:ci
+      - uses: codecov/codecov-action@v3


🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

* Template injection vulnerability detection in handlebars * template injection vulnerability detection in pug * fix lint and naming issues * create separate job for template injection * add support to registerPartial function * add tests for pug render function

IlyasShabi added asm-iast appsec labels Oct 25, 2024

IlyasShabi self-assigned this Oct 25, 2024

IlyasShabi force-pushed the template-injection-handlebars branch from a5f156b to 9e4e570 Compare October 25, 2024 15:42

IlyasShabi force-pushed the template-injection-handlebars branch from 9e4e570 to ae71ef5 Compare October 25, 2024 18:19

IlyasShabi added the semver-patch label Oct 25, 2024

IlyasShabi force-pushed the template-injection-handlebars branch 2 times, most recently from 5d7462b to 08105c7 Compare October 28, 2024 08:06

IlyasShabi force-pushed the template-injection-handlebars branch from 08105c7 to 7370611 Compare October 28, 2024 08:42

IlyasShabi marked this pull request as ready for review October 28, 2024 09:37

IlyasShabi requested review from a team as code owners October 28, 2024 09:37

uurien reviewed Oct 28, 2024

View reviewed changes

Comment thread ...es/dd-trace/test/appsec/iast/analyzers/template-injection-analyzer.handlebars.plugin.spec.js Outdated

IlyasShabi added semver-minor and removed semver-patch labels Oct 28, 2024

IlyasShabi force-pushed the template-injection-handlebars branch 4 times, most recently from 3cbe3cd to 8b78a14 Compare October 29, 2024 12:59

simon-id reviewed Oct 29, 2024

View reviewed changes

Comment thread packages/datadog-instrumentations/src/pug.js Outdated

simon-id reviewed Oct 29, 2024

View reviewed changes

Comment thread packages/datadog-instrumentations/src/handlebars.js Outdated

simon-id reviewed Oct 29, 2024

View reviewed changes

Comment thread packages/datadog-instrumentations/src/handlebars.js Outdated

IlyasShabi force-pushed the template-injection-handlebars branch from 8b78a14 to 57101bd Compare October 31, 2024 12:47

uurien reviewed Nov 4, 2024

View reviewed changes

IlyasShabi added 2 commits November 4, 2024 11:11

Template injection vulnerability detection in handlebars

fa72ef6

template injection vulnerability detection in pug

37742f0

Merge branch 'master' into template-injection-handlebars

016848b

CarlesDD reviewed Nov 6, 2024

View reviewed changes

Comment thread packages/dd-trace/test/appsec/iast/analyzers/template-injection-analyzer.pug.plugin.spec.js

add support to registerPartial function

4ab043c

CarlesDD reviewed Nov 6, 2024

View reviewed changes

Comment thread packages/datadog-instrumentations/src/handlebars.js Outdated

IlyasShabi force-pushed the template-injection-handlebars branch from 86c0eee to 66b9c86 Compare November 7, 2024 08:40

CarlesDD previously approved these changes Nov 7, 2024

View reviewed changes

IlyasShabi requested a review from uurien November 7, 2024 13:35

uurien reviewed Nov 7, 2024

View reviewed changes

Comment thread packages/datadog-instrumentations/src/handlebars.js Outdated

uurien previously approved these changes Nov 7, 2024

View reviewed changes

add tests for pug render function

0408305

IlyasShabi dismissed stale reviews from uurien and CarlesDD via 0408305 November 7, 2024 15:18

IlyasShabi force-pushed the template-injection-handlebars branch from d22bf54 to 0408305 Compare November 7, 2024 15:18

uurien approved these changes Nov 7, 2024

View reviewed changes

Merge branch 'master' into template-injection-handlebars

04a6184

datadog-datadog-prod-us1 Bot reviewed Nov 12, 2024

View reviewed changes

IlyasShabi requested review from CarlesDD and simon-id November 13, 2024 14:04

CarlesDD approved these changes Nov 13, 2024

View reviewed changes

IlyasShabi merged commit 985cb1d into master Nov 15, 2024

IlyasShabi deleted the template-injection-handlebars branch November 15, 2024 13:56

rochdev mentioned this pull request Nov 15, 2024

v4.50.0 proposal #4887

Merged

rochdev mentioned this pull request Nov 15, 2024

v5.26.0 proposal #4888

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Template injection vulnerability detection in handlebars and pug#4827

Template injection vulnerability detection in handlebars and pug#4827
IlyasShabi merged 8 commits intomasterfrom
template-injection-handlebars

IlyasShabi commented Oct 25, 2024 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 25, 2024 •

edited

Loading

Uh oh!

pr-commenter Bot commented Oct 25, 2024 •

edited

Loading

Uh oh!

codecov Bot commented Oct 28, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CarlesDD commented Nov 6, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadog-datadog-prod-us1 Bot Nov 12, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

IlyasShabi commented Oct 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Plugin Checklist

Additional Notes

Uh oh!

github-actions Bot commented Oct 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overall package size

Uh oh!

pr-commenter Bot commented Oct 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

codecov Bot commented Oct 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CarlesDD commented Nov 6, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadog-datadog-prod-us1 Bot Nov 12, 2024

Choose a reason for hiding this comment

🟠 Code Vulnerability

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

IlyasShabi commented Oct 25, 2024 •

edited

Loading

github-actions Bot commented Oct 25, 2024 •

edited

Loading

pr-commenter Bot commented Oct 25, 2024 •

edited

Loading

codecov Bot commented Oct 28, 2024 •

edited

Loading