Taint request URI

Author: CarlesDD

packages/dd-trace/src/appsec/iast/index.js

@@ -54,7 +54,7 @@ function onIncomingHttpRequestStart (data) {
           const iastContext = iastContextFunctions.saveIastContext(store, topContext, { rootSpan, req: data.req })
           createTransaction(rootSpan.context().toSpanId(), iastContext)
           overheadController.initializeRequestContext(iastContext)
-          taintTrackingPlugin.taintHeaders(data.req.headers, iastContext)
+          taintTrackingPlugin.taintRequest(data.req, iastContext)
         }
         if (rootSpan.addTags) {
           rootSpan.addTags({

packages/dd-trace/src/appsec/iast/taint-tracking/origin-types.js

@@ -7,5 +7,6 @@ module.exports = {
   HTTP_REQUEST_HEADER_NAME: 'http.request.header.name',
   HTTP_REQUEST_HEADER_VALUE: 'http.request.header',
   HTTP_REQUEST_PARAMETER: 'http.request.parameter',
+  HTTP_REQUEST_PATH: 'http.request.path',
   HTTP_REQUEST_PATH_PARAM: 'http.request.path.parameter'
 }

packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -3,14 +3,15 @@
 const Plugin = require('../../../plugins/plugin')
 const { getIastContext } = require('../iast-context')
 const { storage } = require('../../../../../datadog-core')
-const { taintObject } = require('./operations')
+const { taintObject, newTaintedString } = require('./operations')
 const {
   HTTP_REQUEST_BODY,
   HTTP_REQUEST_COOKIE_VALUE,
   HTTP_REQUEST_COOKIE_NAME,
   HTTP_REQUEST_HEADER_VALUE,
   HTTP_REQUEST_HEADER_NAME,
   HTTP_REQUEST_PARAMETER,
+  HTTP_REQUEST_PATH,
   HTTP_REQUEST_PATH_PARAM
 
 } = require('./origin-types')
@@ -73,6 +74,11 @@ class TaintTrackingPlugin extends Plugin {
     taintObject(iastContext, headers, HTTP_REQUEST_HEADER_VALUE, true, HTTP_REQUEST_HEADER_NAME)
   }
 
+  taintRequest (req, iastContext) {
+    taintObject(iastContext, req.headers, HTTP_REQUEST_HEADER_VALUE, true, HTTP_REQUEST_HEADER_NAME)
+    req.url = newTaintedString(iastContext, req.url, 'req.url', HTTP_REQUEST_PATH)
+  }
+
   enable () {
     this.configure(true)
   }

packages/dd-trace/test/appsec/iast/taint-tracking/plugin.spec.js

@@ -7,6 +7,9 @@ const dc = require('../../../../../diagnostics_channel')
 const {
   HTTP_REQUEST_COOKIE_VALUE,
   HTTP_REQUEST_COOKIE_NAME,
+  HTTP_REQUEST_HEADER_NAME,
+  HTTP_REQUEST_HEADER_VALUE,
+  HTTP_REQUEST_PATH,
   HTTP_REQUEST_PATH_PARAM
 } = require('../../../../src/appsec/iast/taint-tracking/origin-types')
 
@@ -227,5 +230,30 @@ describe('IAST Taint tracking plugin', () => {
       processParamsStartCh.publish({ req })
       expect(taintTrackingOperations.taintObject).to.not.be.called
     })
+
+    it('Should taint headers and uri from request', () => {
+      const req = {
+        headers: {
+          'x-iast-header': 'header-value'
+        },
+        url: 'https://testurl'
+      }
+      taintTrackingPlugin.taintRequest(req, iastContext)
+
+      expect(taintTrackingOperations.taintObject).to.be.calledOnceWith(
+        iastContext,
+        req.headers,
+        HTTP_REQUEST_HEADER_VALUE,
+        true,
+        HTTP_REQUEST_HEADER_NAME
+      )
+
+      expect(taintTrackingOperations.newTaintedString).to.be.calledOnceWith(
+        iastContext,
+        req.url,
+        'req.url',
+        HTTP_REQUEST_PATH
+      )
+    })
   })
 })

packages/dd-trace/test/appsec/iast/taint-tracking/sources/taint-tracking.express.plugin.spec.js

@@ -9,7 +9,67 @@ const { storage } = require('../../../../../../datadog-core')
 const iast = require('../../../../../src/appsec/iast')
 const iastContextFunctions = require('../../../../../src/appsec/iast/iast-context')
 const { isTainted, getRanges } = require('../../../../../src/appsec/iast/taint-tracking/operations')
-const { HTTP_REQUEST_PATH_PARAM } = require('../../../../../src/appsec/iast/taint-tracking/origin-types')
+const {
+  HTTP_REQUEST_PATH,
+  HTTP_REQUEST_PATH_PARAM
+} = require('../../../../../src/appsec/iast/taint-tracking/origin-types')
+
+describe('Path sourcing with express', () => {
+  let express
+  let appListener
+
+  withVersions('express', 'express', version => {
+    before(() => {
+      return agent.load(['http', 'express'], { client: false })
+    })
+
+    after(() => {
+      return agent.close({ ritmReset: false })
+    })
+
+    beforeEach(() => {
+      iast.enable(new Config({
+        experimental: {
+          iast: {
+            enabled: true,
+            requestSampling: 100
+          }
+        }
+      }))
+
+      express = require(`../../../../../../../versions/express@${version}`).get()
+    })
+
+    afterEach(() => {
+      appListener && appListener.close()
+      appListener = null
+
+      iast.disable()
+    })
+
+    it('should taint path', done => {
+      const app = express()
+      app.get('/path/*', (req, res) => {
+        const store = storage.getStore()
+        const iastContext = iastContextFunctions.getIastContext(store)
+        const isPathTainted = isTainted(iastContext, req.url)
+        expect(isPathTainted).to.be.true
+        const taintedPathValueRanges = getRanges(iastContext, req.url)
+        expect(taintedPathValueRanges[0].iinfo.type).to.be.equal(HTTP_REQUEST_PATH)
+        res.status(200).send()
+      })
+
+      getPort().then(port => {
+        appListener = app.listen(port, 'localhost', () => {
+          axios
+            .get(`http://localhost:${port}/path/vulnerable`)
+            .then(() => done())
+            .catch(done)
+        })
+      })
+    })
+  })
+})
 
 describe('Path params sourcing with express', () => {
   let express