Skip to content

Commit bf4ee17

Browse files
NizernizerNizernizer
authored
Merge pull request HXSecurity#586 from Nizernizer/feature/costom-tag-config
Feature/costom tag config
2 parents 27bacc4 + cee0917 commit bf4ee17

File tree

3 files changed

+80
-20
lines changed

3 files changed

+80
-20
lines changed

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/tag/TaintTag.java‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,36 @@ public enum TaintTag {
3434
VBSCRIPT_ENCODED("vbscript-encoded"),
3535
HTTP_TOKEN_LIMITED_CHARS("http-token-limited-chars"),
3636
NUMERIC_LIMITED_CHARS("numeric-limited-chars"),
37+
CUSTOM_ENCODED_CMD_INJECTION("custom-encoded-cmd-injection"),
38+
CUSTOM_DECODED_CMD_INJECTION("custom-decoded-cmd-injection"),
39+
CUSTOM_ENCODED_JNDI_INJECTION("custom-encoded-jndi-injection"),
40+
CUSTOM_DECODED_JNDI_INJECTION("custom-decoded-jndi-injection"),
41+
CUSTOM_ENCODED_HQL_INJECTION("custom-encoded-hql-injection"),
42+
CUSTOM_DECODED_HQL_INJECTION("custom-decoded-hql-injection"),
43+
CUSTOM_ENCODED_NOSQL_INJECTION("custom-encoded-nosql-injection"),
44+
CUSTOM_DECODED_NOSQL_INJECTION("custom-decoded-nosql-injection"),
45+
CUSTOM_ENCODED_SMTP_INJECTION("custom-encoded-smtp-injection"),
46+
CUSTOM_DECODED_SMTP_INJECTION("custom-decoded-smtp-injection"),
47+
CUSTOM_ENCODED_XXE("custom-encoded-xxe"),
48+
CUSTOM_DECODED_XXE("custom-decoded-xxe"),
49+
CUSTOM_ENCODED_EL_INJECTION("custom-encoded-el-injection"),
50+
CUSTOM_DECODED_EL_INJECTION("custom-decoded-el-injection"),
51+
CUSTOM_ENCODED_REFLECTION_INJECTION("custom-encoded-reflection-injection"),
52+
CUSTOM_DECODED_("custom-decoded-reflection-injection"),
53+
CUSTOM_ENCODED_SSRF("custom-encoded-ssrf"),
54+
CUSTOM_DECODED_SSRF("custom-decoded-ssrf"),
55+
CUSTOM_ENCODED_PATH_TRAVERSAL("custom-encoded-path-traversal"),
56+
CUSTOM_DECODED_PATH_TRAVERSAL("custom-decoded-path-traversal"),
57+
CUSTOM_ENCODED_FILE_WRITE("custom-encoded-file-write"),
58+
CUSTOM_DECODED_FILE_WRITE("custom-encoded-file-write"),
59+
CUSTOM_ENCODED_REDOS("custom-encoded-redos"),
60+
CUSTOM_DECODED_REDOS("custom-decoded-redos"),
3761
VALIDATED("validated"),
3862
;
3963

4064
private final String key;
4165

42-
private static final Map<String, TaintTag> LOOKUP = new HashMap<String, TaintTag>();
66+
private static final Map<String, TaintTag> LOOKUP = new HashMap<>();
4367

4468
static {
4569
for (TaintTag t : TaintTag.values()) {

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/VulnType.java‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
public enum VulnType {
88

99
/**
10-
* 漏洞
10+
* 漏洞类型
1111
*/
1212
SQL_OVER_POWER("sql-over-power", "info", false),
1313
CRYPTO_WEAK_RANDOMNESS("crypto-weak-randomness", "low", false),
@@ -22,6 +22,14 @@ public enum VulnType {
2222
XPATH_INJECTION("xpath-injection", "high", true),
2323
PATH_TRAVERSAL("path-traversal", "high", true),
2424
XXE("xxe", "medium", true),
25+
JNDI_INJECTION("jndi-injection", "high", true),
26+
NOSQL_INJECTION("nosql-injection", "high", true),
27+
SMTP_INJECTION("smtp-injection", "high", true),
28+
EL_INJECTION("el-injection", "high", true),
29+
REFLECTION_INJECTION("reflection-injection", "high", true),
30+
SSRF("ssrf", "high", true),
31+
FILE_WRITE("file-write", "medium", true),
32+
REDOS("redos", "low", true),
2533
UNVALIDATED_REDIRECT("unvalidated-redirect", "low", true),
2634
;
2735

@@ -32,9 +40,9 @@ public String getName() {
3240
/**
3341
* 漏洞类型 值
3442
*/
35-
String name;
36-
String weight;
37-
boolean tracked;
43+
final String name;
44+
final String weight;
45+
final boolean tracked;
3846

3947
VulnType(String name, String weight, boolean tracked) {
4048
this.name = name;
@@ -46,13 +54,4 @@ public String getName() {
4654
public boolean equals(String name) {
4755
return this.name.equals(name);
4856
}
49-
50-
public static VulnType getTypeByName(String name) {
51-
for (VulnType vType : VulnType.values()) {
52-
if (vType.equals(name)) {
53-
return vType;
54-
}
55-
}
56-
return null;
57-
}
5857
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java‎

Lines changed: 43 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,18 @@
2323
* @author dongzhiyong@huoxian.cn
2424
*/
2525
public class DynamicPropagatorScanner implements IVulScan {
26-
private final static Set<SinkSafeChecker> SAFE_CHECKERS = new HashSet<SinkSafeChecker>(Arrays.asList(
26+
private final static Set<SinkSafeChecker> SAFE_CHECKERS = new HashSet<>(Arrays.asList(
2727
new FastjsonCheck(),
2828
new XXECheck()
2929
));
3030

31-
private final static Set<SinkSourceChecker> SOURCE_CHECKERS = new HashSet<SinkSourceChecker>(Arrays.asList(
31+
private final static Set<SinkSourceChecker> SOURCE_CHECKERS = new HashSet<>(Arrays.asList(
3232
new PathTraversalCheck(),
3333
new SSRFSourceCheck(),
3434
new UnvalidatedRedirectCheck()
3535
));
3636

37-
private static final Set<ServiceTrace> SERVICE_TRACES = new HashSet<ServiceTrace>(Collections.singletonList(
37+
private static final Set<ServiceTrace> SERVICE_TRACES = new HashSet<>(Collections.singletonList(
3838
new HttpService()
3939
));
4040

@@ -52,7 +52,8 @@ public class DynamicPropagatorScanner implements IVulScan {
5252
));
5353
put(VulnType.HQL_INJECTION.getName(), Arrays.asList(
5454
new TaintTag[]{TaintTag.UNTRUSTED},
55-
new TaintTag[]{TaintTag.SQL_ENCODED, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
55+
new TaintTag[]{TaintTag.SQL_ENCODED, TaintTag.CUSTOM_ENCODED_HQL_INJECTION,
56+
TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
5657
));
5758
put(VulnType.LDAP_INJECTION.getName(), Arrays.asList(
5859
new TaintTag[]{TaintTag.UNTRUSTED},
@@ -68,7 +69,7 @@ public class DynamicPropagatorScanner implements IVulScan {
6869
new TaintTag[]{TaintTag.UNTRUSTED},
6970
new TaintTag[]{TaintTag.BASE64_ENCODED, TaintTag.HTML_ENCODED, TaintTag.LDAP_ENCODED,
7071
TaintTag.SQL_ENCODED, TaintTag.URL_ENCODED, TaintTag.XML_ENCODED, TaintTag.XPATH_ENCODED,
71-
TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
72+
TaintTag.CUSTOM_ENCODED_CMD_INJECTION,TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
7273
));
7374
put(VulnType.PATH_TRAVERSAL.getName(), Arrays.asList(
7475
new TaintTag[]{TaintTag.UNTRUSTED},
@@ -80,6 +81,42 @@ public class DynamicPropagatorScanner implements IVulScan {
8081
new TaintTag[]{TaintTag.UNTRUSTED},
8182
new TaintTag[]{TaintTag.URL_ENCODED, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
8283
));
84+
put(VulnType.XXE.getName(),Arrays.asList(
85+
new TaintTag[]{TaintTag.UNTRUSTED},
86+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_XXE, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
87+
));
88+
put(VulnType.JNDI_INJECTION.getName(),Arrays.asList(
89+
new TaintTag[]{TaintTag.UNTRUSTED},
90+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_JNDI_INJECTION, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
91+
));
92+
put(VulnType.NOSQL_INJECTION.getName(),Arrays.asList(
93+
new TaintTag[]{TaintTag.UNTRUSTED},
94+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_NOSQL_INJECTION, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
95+
));
96+
put(VulnType.SMTP_INJECTION.getName(),Arrays.asList(
97+
new TaintTag[]{TaintTag.UNTRUSTED},
98+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_SMTP_INJECTION, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
99+
));
100+
put(VulnType.EL_INJECTION.getName(),Arrays.asList(
101+
new TaintTag[]{TaintTag.UNTRUSTED},
102+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_EL_INJECTION, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
103+
));
104+
put(VulnType.REFLECTION_INJECTION.getName(),Arrays.asList(
105+
new TaintTag[]{TaintTag.UNTRUSTED},
106+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_REFLECTION_INJECTION, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
107+
));
108+
put(VulnType.SSRF.getName(),Arrays.asList(
109+
new TaintTag[]{TaintTag.UNTRUSTED},
110+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_XXE, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
111+
));
112+
put(VulnType.FILE_WRITE.getName(),Arrays.asList(
113+
new TaintTag[]{TaintTag.UNTRUSTED},
114+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_FILE_WRITE, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
115+
));
116+
put(VulnType.REDOS.getName(),Arrays.asList(
117+
new TaintTag[]{TaintTag.UNTRUSTED},
118+
new TaintTag[]{TaintTag.CUSTOM_ENCODED_REDOS, TaintTag.HTTP_TOKEN_LIMITED_CHARS, TaintTag.NUMERIC_LIMITED_CHARS}
119+
));
83120
}};
84121

85122
@Override
@@ -133,7 +170,7 @@ private boolean sinkSourceHitTaintPool(MethodEvent event, SinkNode sinkNode) {
133170
}
134171
}
135172

136-
List<Object> sourceInstances = new ArrayList<Object>();
173+
List<Object> sourceInstances = new ArrayList<>();
137174
boolean hasTaint = false;
138175
boolean objHasTaint = false;
139176
Set<TaintPosition> sources = sinkNode.getSources();

0 commit comments

Comments
 (0)