Skip to content

Commit f71bc63

Browse files
NizernizerNizernizer
authored
Merge pull request #572 from HXSecurity/develop
Release v1.13.0
2 parents f3b28d3 + 75dab62 commit f71bc63

File tree

34 files changed

+366
-75
lines changed

34 files changed

+366
-75
lines changed

‎.github/workflows/code-check.yml‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -157,24 +157,18 @@ jobs:
157157
ossutil cp -rf dongtai-agent/src/main/resources/bin/agent_latest.tar.gz oss://dongtai-helm-charts/agent_${{ steps.version.outputs.GITHUB_REF }}/java/latest/ --meta x-oss-object-acl:public-read
158158
fi
159159
160-
- name: Set the value
161-
id: release
162-
run: |
163-
if [ ${{ steps.version.outputs.GITHUB_REF }} = develop ] ; then echo "helm_ns=test" >> $GITHUB_ENV; echo "helm_mysql=test" >> $GITHUB_ENV
164-
elif [ ${{ steps.version.outputs.GITHUB_REF }} = beta ] ; then echo "helm_ns=beta" >> $GITHUB_ENV; echo "helm_mysql=beta" >> $GITHUB_ENV
165-
else echo "helm_ns=main" >> $GITHUB_ENV ; echo "helm_mysql=temp" >> $GITHUB_ENV ;fi
160+
- name: deploy to cluster A
161+
uses: tscuite/kubectl-helm-action@main
162+
env:
163+
MAX: false
164+
PROJECT: agent
165+
TOKEN_SCA: ${{ secrets.TOKEN_SCA }}
166+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_TEST_DATA }}
166167

167-
- name: deploy to cluster
168-
uses: wahyd4/kubectl-helm-action@master
168+
- name: deploy to cluster B
169+
uses: tscuite/kubectl-helm-action@main
169170
env:
171+
MAX: true
172+
PROJECT: agent
173+
TOKEN_SCA: ${{ secrets.MAX_TOKEN_SCA }}
170174
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_TEST_DATA }}
171-
with:
172-
args: |
173-
git clone https://github.com/HXSecurity/DongTai.git
174-
helm upgrade --install huoxian --create-namespace -n iast-${{ env.helm_ns }} ./DongTai/deploy/kubernetes/helm/ \
175-
--set sca.sca_token=${{ secrets.TOKEN_SCA }} --set usb.usb_token=${{ secrets.TOKEN_SCA }} --set mysql.host=iast-mysql-${{ env.helm_mysql }}.huoxian.cn \
176-
--set tag=${{ steps.version.outputs.GITHUB_REF }}-latest --set build.agent_number=iast${{github.run_number}} --set develop.agentZip=${{ env.helm_ns }} --values https://charts.dongtai.io/devops.yaml
177-
helm upgrade --install huoxian --create-namespace -n iast-${{ env.helm_ns }}-max ./DongTai/deploy/kubernetes/helm/ \
178-
--set max=true --set sca.sca_token=${{ secrets.MAX_TOKEN_SCA }} --set usb.usb_token=${{ secrets.MAX_TOKEN_SCA }} --set mysql.host=iast-mysql-${{ env.helm_mysql }}-max.huoxian.cn \
179-
--set tag=max-${{ steps.version.outputs.GITHUB_REF }}-latest --set develop.agentZip=${{ env.helm_ns }} \
180-
--set build.agent_number=iast${{github.run_number}} --values https://charts.dongtai.io/devops.yaml

‎dongtai-agent/src/main/java/io/dongtai/iast/agent/IastProperties.java‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
public class IastProperties {
1818
public final static Map<String, String> ATTACH_ARG_MAP = new HashMap<String, String>() {{
1919
put("debug", PropertyConstant.PROPERTY_DEBUG);
20-
put("app_create", PropertyConstant.PROPERTY_APP_CREATE);
2120
put("app_name", PropertyConstant.PROPERTY_APP_NAME);
2221
put("app_version", PropertyConstant.PROPERTY_APP_VERSION);
2322
put("app_template", PropertyConstant.PROPERTY_APP_TEMPLATE);
@@ -129,20 +128,6 @@ public boolean isDebug() {
129128
return "true".equalsIgnoreCase(getDebugFlag());
130129
}
131130

132-
public Integer isAutoCreateProject() {
133-
if (null == isAutoCreateProject) {
134-
String result = System.getProperty(PropertyConstant.PROPERTY_APP_CREATE,
135-
System.getProperty("project.create", cfg.getProperty("project.create", "false"))
136-
);
137-
if ("true".equalsIgnoreCase(result)) {
138-
isAutoCreateProject = 1;
139-
} else {
140-
isAutoCreateProject = 0;
141-
}
142-
}
143-
return isAutoCreateProject;
144-
}
145-
146131
public String getProjectName() {
147132
if (null == projectName) {
148133
String[] names = new String[]{

‎dongtai-agent/src/main/java/io/dongtai/iast/agent/report/AgentRegisterReport.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ private String generateAgentRegisterMsg() {
6565
object.put("serverPath", ServerDetect.getWebServerPath());
6666
object.put("serverAddr", "");
6767
object.put("serverPort", "");
68-
object.put("autoCreateProject", IastProperties.getInstance().isAutoCreateProject());
6968
object.put("projectVersion", IastProperties.getInstance().getProjectVersion());
7069
object.put("projectTemplateId", IastProperties.getInstance().getProjectTemplate());
7170

‎dongtai-common/src/main/java/io/dongtai/iast/common/config/ConfigBuilder.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ private ConfigBuilder() {
2424
Config.<Boolean>create(ConfigKey.ENABLE_LOGGER));
2525
this.configMap.put(ConfigKey.LOGGER_LEVEL,
2626
Config.<String>create(ConfigKey.LOGGER_LEVEL));
27+
this.configMap.put(ConfigKey.VALIDATED_SINK,
28+
Config.<Boolean>create(ConfigKey.VALIDATED_SINK).setDefaultValue(false));
2729
}
2830

2931
public static ConfigBuilder getInstance() {
@@ -62,6 +64,7 @@ public void update(JSONObject config) {
6264
updateString(config, ConfigKey.JsonKey.JSON_VERSION_HEADER_KEY);
6365
updateBool(config, ConfigKey.JsonKey.JSON_ENABLE_LOGGER);
6466
updateString(config, ConfigKey.JsonKey.JSON_LOGGER_LEVEL);
67+
updateBool(config, ConfigKey.JsonKey.JSON_VALIDATED_SINK);
6568
updateRequestDenyList(config);
6669
}
6770

‎dongtai-common/src/main/java/io/dongtai/iast/common/config/ConfigKey.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ public enum ConfigKey {
88
VERSION_HEADER_KEY,
99
ENABLE_LOGGER,
1010
LOGGER_LEVEL,
11+
VALIDATED_SINK,
1112
;
1213

1314
public enum JsonKey {
@@ -18,6 +19,7 @@ public enum JsonKey {
1819
JSON_VERSION_HEADER_KEY("version_header_name", VERSION_HEADER_KEY),
1920
JSON_ENABLE_LOGGER("enable_log", ENABLE_LOGGER),
2021
JSON_LOGGER_LEVEL("log_level", LOGGER_LEVEL),
22+
JSON_VALIDATED_SINK("report_validated_sink", VALIDATED_SINK),
2123
;
2224

2325
private final String key;

‎dongtai-common/src/main/java/io/dongtai/iast/common/constants/AgentConstant.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package io.dongtai.iast.common.constants;
22

33
public class AgentConstant {
4-
public static final String VERSION_VALUE = "v1.12.0";
4+
public static final String VERSION_VALUE = "v1.13.0";
55
public static final String LANGUAGE = "JAVA";
66
public static final String THREAD_NAME_PREFIX = "DongTai-IAST-";
77
public static final String THREAD_NAME_PREFIX_CORE = "DongTai-IAST-Core-";

‎dongtai-common/src/main/java/io/dongtai/iast/common/constants/PropertyConstant.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
public class PropertyConstant {
44
public static final String PROPERTY_DEBUG = "dongtai.debug";
5-
public static final String PROPERTY_APP_CREATE = "dongtai.app.create";
65
public static final String PROPERTY_APP_NAME = "dongtai.app.name";
76
public static final String PROPERTY_APP_VERSION = "dongtai.app.version";
87
public static final String PROPERTY_APP_TEMPLATE = "dongtai.app.template";
@@ -32,5 +31,5 @@ public class PropertyConstant {
3231
public static final String PROPERTY_POLICY_PATH = "dongtai.policy.path";
3332
public static final String PROPERTY_UUID_PATH = "dongtai.uuid.path";
3433
public static final String PROPERTY_DISABLED_PLUGINS = "dongtai.disabled.plugins";
35-
public static final String PROPERTY_DISABLED_FEATURES = "dongtai.disabled_features";
34+
public static final String PROPERTY_DISABLED_FEATURES = "dongtai.disabled.features";
3635
}

‎dongtai-core/src/main/java/io/dongtai/iast/core/bytecode/IastClassFileTransformer.java‎

Lines changed: 30 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,13 @@ public static IastClassFileTransformer getInstance(Instrumentation inst, PolicyM
6262
return INSTANCE;
6363
}
6464

65+
public static IastClassFileTransformer getInstance() {
66+
if (null != INSTANCE) {
67+
return INSTANCE;
68+
}
69+
return null;
70+
}
71+
6572
IastClassFileTransformer(Instrumentation inst, PolicyManager policyManager) {
6673
this.inst = inst;
6774
this.isDumpClass = EngineManager.getInstance().isEnableDumpClass();
@@ -112,29 +119,34 @@ public byte[] transform(final ClassLoader loader,
112119
final Class<?> classBeingRedefined,
113120
final ProtectionDomain protectionDomain,
114121
final byte[] srcByteCodeArray) {
122+
String threadName = Thread.currentThread().getName();
123+
if (threadName.startsWith("DongTai-IAST-Core")) {
124+
return null;
125+
}
126+
127+
if (internalClassName == null
128+
|| internalClassName.startsWith("io/dongtai/")
129+
|| internalClassName.startsWith("com/secnium/iast/")
130+
|| internalClassName.startsWith("java/lang/iast/")
131+
|| internalClassName.startsWith("cn/huoxian/iast/")
132+
|| internalClassName.startsWith("META-INF/")
133+
|| "module-info".equals(internalClassName)) {
134+
return null;
135+
}
136+
137+
if (null != loader && loader.toString().toLowerCase().contains("rasp")) {
138+
return null;
139+
}
140+
115141
try {
116142
ScopeManager.SCOPE_TRACKER.getPolicyScope().enterAgent();
117143

118-
if (internalClassName == null
119-
|| internalClassName.startsWith("io/dongtai/")
120-
|| internalClassName.startsWith("com/secnium/iast/")
121-
|| internalClassName.startsWith("java/lang/iast/")
122-
|| internalClassName.startsWith("cn/huoxian/iast/")
123-
|| internalClassName.startsWith("META-INF/")
124-
|| "module-info".equals(internalClassName)) {
125-
return null;
126-
}
127-
128144
if (" com/alibaba/fastjson/JSON".substring(1).equals(internalClassName)) {
129145
FastjsonCheck.setJsonClassLoader(loader);
130146
} else if (" com/alibaba/fastjson/parser/ParserConfig".substring(1).equals(internalClassName)) {
131147
FastjsonCheck.setParseConfigClassLoader(loader);
132148
}
133149

134-
if (null != loader && loader.toString().toLowerCase().contains("rasp")) {
135-
return null;
136-
}
137-
138150
if (loader != null && protectionDomain != null) {
139151
final CodeSource codeSource = protectionDomain.getCodeSource();
140152
if (codeSource == null) {
@@ -156,7 +168,6 @@ public byte[] transform(final ClassLoader loader,
156168

157169
ClassContext classContext = new ClassContext(cr, loader);
158170
if (Modifier.isInterface(classContext.getModifier())) {
159-
sourceCodeBak = null;
160171
return null;
161172
}
162173
final String className = classContext.getClassName();
@@ -186,11 +197,9 @@ public byte[] transform(final ClassLoader loader,
186197
return dumpClassIfNecessary(cr.getClassName(), cw.toByteArray(), srcByteCodeArray);
187198
}
188199
}
189-
sourceCodeBak = null;
190200
} catch (Throwable throwable) {
191201
DongTaiLog.warn(ErrorCode.get("TRANSFORM_CLASS_FAILED"), internalClassName, throwable);
192202
} finally {
193-
classDiagram.setLoader(null);
194203
ScopeManager.SCOPE_TRACKER.getPolicyScope().leaveAgent();
195204
}
196205

@@ -347,5 +356,9 @@ public void reTransform() {
347356
public static HashMap<Object, byte[]> getTransformMap() {
348357
return transformMap;
349358
}
359+
360+
public IastClassDiagram getClassDiagram() {
361+
return classDiagram;
362+
}
350363
}
351364

‎dongtai-core/src/main/java/io/dongtai/iast/core/bytecode/enhance/asm/AsmMethods.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,12 @@ static Method getAsmMethod(final Class<?> clazz,
219219
SpyDispatcher.class,
220220
"isFirstLevelSink"
221221
);
222+
223+
Method SPY$enterValidator = InnerHelper.getAsmMethod(
224+
SpyDispatcher.class,
225+
"enterValidator"
226+
);
227+
222228
Method SPY$enterIgnoreInternal = InnerHelper.getAsmMethod(
223229
SpyDispatcher.class,
224230
"enterIgnoreInternal"

‎dongtai-core/src/main/java/io/dongtai/iast/core/bytecode/enhance/plugin/core/DispatchClassPlugin.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ public class ClassVisit extends AbstractClassVisitor {
5454
new SourceAdapter(),
5555
new PropagatorAdapter(),
5656
new SinkAdapter(),
57+
new ValidatorAdapter(),
5758
};
5859
}
5960

0 commit comments

Comments
 (0)