[asm] IAST security controls #5117
Conversation
Overall package sizeSelf size: 8.68 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | @datadog/libdatadog | 0.4.0 | 29.44 MB | 29.44 MB | | @datadog/native-appsec | 8.4.0 | 19.25 MB | 19.26 MB | | @datadog/native-iast-taint-tracking | 3.3.0 | 13.77 MB | 13.78 MB | | @datadog/pprof | 5.5.1 | 9.79 MB | 10.17 MB | | protobufjs | 7.2.5 | 2.77 MB | 5.16 MB | | @datadog/native-iast-rewriter | 2.8.0 | 2.6 MB | 2.74 MB | | @opentelemetry/core | 1.14.0 | 872.87 kB | 1.47 MB | | @datadog/native-metrics | 3.1.0 | 1.06 MB | 1.46 MB | | @opentelemetry/api | 1.8.0 | 1.21 MB | 1.21 MB | | import-in-the-middle | 1.11.2 | 112.74 kB | 826.22 kB | | source-map | 0.7.4 | 226 kB | 226 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | lru-cache | 7.18.3 | 133.92 kB | 133.92 kB | | pprof-format | 2.1.0 | 111.69 kB | 111.69 kB | | @datadog/sketches-js | 2.1.0 | 109.9 kB | 109.9 kB | | semver | 7.6.3 | 95.82 kB | 95.82 kB | | lodash.sortby | 4.7.0 | 75.76 kB | 75.76 kB | | ignore | 5.3.1 | 51.46 kB | 51.46 kB | | shell-quote | 1.8.1 | 44.96 kB | 44.96 kB | | istanbul-lib-coverage | 3.2.0 | 29.34 kB | 29.34 kB | | rfdc | 1.3.1 | 25.21 kB | 25.21 kB | | @isaacs/ttlcache | 1.4.1 | 25.2 kB | 25.2 kB | | tlhunter-sorted-set | 0.1.0 | 24.94 kB | 24.94 kB | | limiter | 1.1.5 | 23.17 kB | 23.17 kB | | dc-polyfill | 0.1.4 | 23.1 kB | 23.1 kB | | retry | 0.13.1 | 18.85 kB | 18.85 kB | | jest-docblock | 29.7.0 | 8.99 kB | 12.76 kB | | crypto-randomuuid | 1.0.0 | 11.18 kB | 11.18 kB | | ttl-set | 1.0.0 | 4.61 kB | 9.69 kB | | path-to-regexp | 0.1.12 | 6.6 kB | 6.6 kB | | koalas | 1.0.2 | 6.47 kB | 6.47 kB | | module-details-from-path | 1.0.3 | 4.47 kB | 4.47 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
BenchmarksBenchmark execution time: 2025-02-05 10:00:14 Comparing candidate commit 6dc2181 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 908 metrics, 25 unstable metrics. |
…ginManager in the tests
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #5117 +/- ##
==========================================
+ Coverage 81.16% 81.26% +0.09%
==========================================
Files 482 487 +5
Lines 21522 21695 +173
==========================================
+ Hits 17468 17630 +162
- Misses 4054 4065 +11 ☔ View full report in Codecov by Sentry. |
packages/dd-trace/test/appsec/iast/analyzers/command-injection-analyzer.spec.js
Outdated
Show resolved
Hide resolved
| }) | ||
| const nodeOptions = '--import dd-trace/initialize.mjs' | ||
|
|
||
| describe('with --import', () => { |
There was a problem hiding this comment.
Is this with --import relevant? nodeOptions is defined as const out of the describe
| await agent.stop() | ||
| }) | ||
|
|
||
| it('test endpoint with iv not configured have COMMAND_INJECTION vulnerability', async function () { |
There was a problem hiding this comment.
could we have problems if we have a directory called node_modules? can we modify it to something like test_node_modules that we will rename when we copy that to the temp dir?
There was a problem hiding this comment.
they are not copied, just required with a relative path in the test...
| }, null, 1, true) | ||
| }) | ||
|
|
||
| it('test endpoint with default sanitizer do not have COMMAND_INJECTION vulnerability', async () => { |
There was a problem hiding this comment.
I miss a test checking that the usage of the input of the sanitizer is considered vulnerable:
const untrustedData = req.query.command
const safeData = sanitize(untrustedData)
exec(untrustedData) // this is vulnerable
exec(safeData) // this is not vulnerable
Datadog ReportBranch report: ✅ 0 Failed, 619 Passed, 0 Skipped, 15m 42.23s Total Time |
| .map(param => { | ||
| let parsedParam = parseInt(param, 10) | ||
|
|
||
| // TODO: should we discard the whole securityControl?? |
There was a problem hiding this comment.
I agree, if a string is set in a numeric column, there is a syntax error at least in that line, we should ignore the line or the security control. I think that it is not necessary to ignore all the security controls.
What does this PR do?
IAST security controls implementation
ST DataDog/system-tests#3872
APPSEC-56286
Motivation
Plugin Checklist
Additional Notes