test(appsec): avoid shell execution in taint tracking tests (#9657)

The taint propagation matrix armed a one-second trace deadline before each synchronous shell command. One Windows invocation blocked the event loop for 3.293 seconds, so the web span could not flush before the expectation expired.

Author: BridgeAR

packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking-impl.spec.js

@@ -8,7 +8,7 @@ const { storage } = require('../../../../../datadog-core')
 const iastContextFunctions = require('../../../../src/appsec/iast/iast-context')
 const { newTaintedString, isTainted, getRanges } = require('../../../../src/appsec/iast/taint-tracking/operations')
 const { clearCache } = require('../../../../src/appsec/iast/vulnerability-reporter')
-const { prepareTestServerForIast, copyFileToTmp } = require('../utils')
+const { prepareTestServerForIast, copyFileToTmp, invokeCommandInjectionSink } = require('../utils')
 const propagationFns = [
   'appendStr',
   'arrayInVariableJoin',
@@ -78,12 +78,7 @@ describe('TaintTracking', () => {
               const commandResultOrig = propFnOriginal(commandTainted)
               assert.strictEqual(commandResult, commandResultOrig)
 
-              try {
-                const childProcess = require('child_process')
-                childProcess.execSync(commandResult, { stdio: 'ignore' })
-              } catch {
-                // do nothing
-              }
+              invokeCommandInjectionSink(commandResult)
             }, 'COMMAND_INJECTION')
           })
         })
@@ -117,12 +112,7 @@ describe('TaintTracking', () => {
         const resultOrig = propFnOriginal(jsonTainted)
         assert.deepStrictEqual(result, resultOrig)
 
-        try {
-          const childProcess = require('child_process')
-          childProcess.execSync(result.command, { stdio: 'ignore' })
-        } catch {
-          // do nothing
-        }
+        invokeCommandInjectionSink(result.command)
       }, 'COMMAND_INJECTION')
     })
   })

packages/dd-trace/test/appsec/iast/taint-tracking/taint-tracking.lodash.plugin.spec.js

@@ -10,7 +10,7 @@ const { storage } = require('../../../../../datadog-core')
 const iastContextFunctions = require('../../../../src/appsec/iast/iast-context')
 const { newTaintedString, isTainted } = require('../../../../src/appsec/iast/taint-tracking/operations')
 const { clearCache } = require('../../../../src/appsec/iast/vulnerability-reporter')
-const { prepareTestServerForIast, copyFileToTmp } = require('../utils')
+const { prepareTestServerForIast, copyFileToTmp, invokeCommandInjectionSink } = require('../utils')
 const commands = [
   '  ls -la  ',
   '  ls -la',
@@ -68,12 +68,7 @@ describe('TaintTracking lodash', () => {
               const commandResultOrig = propFnOriginal(_, commandTainted)
               assert.strictEqual(commandResult, commandResultOrig)
 
-              try {
-                const childProcess = require('child_process')
-                childProcess.execSync(commandResult, { stdio: 'ignore' })
-              } catch {
-                // do nothing
-              }
+              invokeCommandInjectionSink(commandResult)
             }, 'COMMAND_INJECTION')
           })
         })

packages/dd-trace/test/appsec/iast/utils.js

@@ -120,6 +120,22 @@ function copyFileToTmp (src) {
   return dest
 }
 
+/**
+ * @param {string} command
+ */
+function invokeCommandInjectionSink (command) {
+  const childProcess = require('node:child_process')
+
+  // The tracing start hook runs before Node rejects cwd, avoiding a child process.
+  assert.throws(
+    () => childProcess.execSync(command, { cwd: '\0' }),
+    {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /without null bytes/,
+    }
+  )
+}
+
 function beforeEachIastTest (iastConfig) {
   iastConfig = iastConfig || {
     enabled: true,
@@ -530,6 +546,7 @@ module.exports = {
   testOutsideRequestHasVulnerability,
   testInRequest,
   copyFileToTmp,
+  invokeCommandInjectionSink,
   prepareTestServerForIast,
   prepareTestServerForIastInExpress,
   prepareTestServerForIastInFastify,