Merge pull request #119 from lostsnow/feature/release-1.4.0

release 1.4.0

Author: lostsnow

CHANGELOG.md

@@ -1,6 +1,17 @@
 # Changelog
 
+## [1.4.0](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.4.0)  - 2022-06-06
+
+* CHANGES
+  * Change SCA package name format and signature [#118](https://github.com/HXSecurity/DongTai-agent-python/pull/118)
+
+## [1.3.2](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.3.2)  - 2022-03-09
+
+* FEATURES
+  * Add str/bytes/bytearray concat hook [#106](https://github.com/HXSecurity/DongTai-agent-python/pull/106)
+
 ## [1.3.1](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.3.1)  - 2022-02-23
+
 * FEATURES
   * Add crypto bad cipher detection  [#107](https://github.com/HXSecurity/DongTai-agent-python/pull/107)
   * Add regular expression DOS attack detection  [#111](https://github.com/HXSecurity/DongTai-agent-python/pull/111)
@@ -12,7 +23,7 @@
 * ENHANCEMENTS
   * performance optimization [#116](https://github.com/HXSecurity/DongTai-agent-python/pull/116)
   * code cleanup [#110](https://github.com/HXSecurity/DongTai-agent-python/pull/110)
-* Build
+* BUILD
   * When the github action runs, it automatically triggers openapi to pull the latest agent package  [#113](https://github.com/HXSecurity/DongTai-agent-python/pull/113)
 
 ## [1.3.0](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.3.0)  - 2022-01-07

CHANGELOG_CN.md

@@ -1,6 +1,17 @@
 # 升级日志
 
+## [1.4.0](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.4.0)  - 2022-06-06
+
+* 变更
+  * 更改组件包的名称格式和签名 [#118](https://github.com/HXSecurity/DongTai-agent-python/pull/118)
+
+## [1.3.2](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.3.2)  - 2022-03-09
+
+* 功能
+  * 增加 str/bytes/bytearray 拼接(+) hook [#106](https://github.com/HXSecurity/DongTai-agent-python/pull/106)
+
 ## [1.3.1](https://github.com/HXSecurity/DongTai-agent-python/releases/tag/v1.3.1)  - 2022-02-23
+
 * 功能
   * 增加弱加密算法漏洞检测 [#107](https://github.com/HXSecurity/DongTai-agent-python/pull/107)
   * 增加正则表达式DOS攻击检测 [#111](https://github.com/HXSecurity/DongTai-agent-python/pull/111)

README.ZH_CN.md

@@ -7,16 +7,20 @@
 
 ## 项目介绍
 
-DongTai-agent-python 是 **洞态IAST** 针对 Python 应用开发的数据采集端。在添加 iast-agent 代理的 Python 应用中，通过改写类字节码的方式采集所需数据，然后将数据发送至
-DongTai-openapi 服务，再由云端引擎处理数据判断是否存在安全漏洞。
+DongTai-agent-python 是 **洞态IAST** 针对 Python 应用开发的数据采集端。在 Python 应用中，通过改写方法和函数的方式采集所需数据，然后将数据发送至
+DongTai OpenAPI 服务，再由云端引擎处理数据判断是否存在安全漏洞。
 
 DongTai-agent-python
 
-- `dongtai_agent_python/config.json`用于配置DongTai-openapi服务地址、Token、项目名称。
-- `dongtai_agent_python/cli`控制agent版本的热更新。
-- `dongtai_agent_python/middleware/`用于接入不同的python框架，目前支持Django、Flask,均以中间件方式引入。
-- `dongtai_agent_python/assess/`根据云端策略hook python 底层方法。
-- `dongtai_agent_python/report/`将agent采集数据上报至DongTai-openapi服务。
+- `dongtai_agent_python/api/` 将 agent 采集的数据上报至 DongTai OpenAPI 服务。
+- `dongtai_agent_python/assess/` 根据云端策略 hook python 方法。
+- `dongtai_agent_python/assess_ext/` 根据云端策略 hook cpython 底层方法。
+- `dongtai_agent_python/cli/` 控制 agent 版本的热更新。
+- `dongtai_agent_python/context/` 请求上下文和上下文跟踪。
+- `dongtai_agent_python/middleware/` 用于接入不同的 python 框架，目前支持 Django、Flask, 均以中间件方式引入。
+- `dongtai_agent_python/policy/` 策略规则及污点数据处理。
+- `dongtai_agent_python/setting/` Agent 配置.
+- `dongtai_agent_python/config.json` 用于配置 DongTai OpenAPI 服务地址、Token、项目名称等。
 
 ## 应用场景
 

README.md

@@ -7,26 +7,28 @@
 
 ## Project Introduction
 
-Dongtai-agent-python is DongTai Iast's data acquisition tool for Python applications. In a Python application with the
-iast agent added, the required data is collected by rewriting class bytecode, and then the data is sent to
-dongtai-OpenAPI service, and then the cloud engine processes the data to determine whether there are security holes.
+DongTai-agent-python is DongTai IAST's data acquisition tool for Python applications. In a Python application, the required data is collected through patching methods and functions, sent to the DongTai OpenAPI service, and then the cloud engine processes the data to determine if there are security vulnerabilities.
 
 DongTai-agent-python
 
-- `dongtai_agent_python/config.json` For configuration DongTai-openapi Url、Token、Web-ProjectName。
-- `dongtai_agent_python/cli` Control the hot update of the agent version。
+- `dongtai_agent_python/api/` Report the collected data to the DongTai OpenAPI service.
+- `dongtai_agent_python/assess/` Hook python methods according to the cloud strategy.
+- `dongtai_agent_python/assess_ext/` Hook cpython underlying methods according to cloud strategy.
+- `dongtai_agent_python/cli/` Control the hot update of the agent version.
+- `dongtai_agent_python/context/` Request context and context tracker.
 - `dongtai_agent_python/middleware/` Used to access different python frameworks, currently supports Django and Flask,
-  both of which are introduced in the form of middleware。
-- `dongtai_agent_python/assess/` Hook the underlying method of python according to the cloud strategy。
-- `dongtai_agent_python/report/` Report the collected data of the agent to the DongTai-openapi service。
+  both of which are introduced in the form of middleware.
+- `dongtai_agent_python/policy/` Strategy rules and tainted data processing.
+- `dongtai_agent_python/setting/` Agent configuration.
+- `dongtai_agent_python/config.json` For configuration DongTai OpenAPI Url, Token, Project Name.
 
 ## Application Scenarios
 
 - DevOps
 - Security test the application before it goes online
 - Third-party Component Management
 - Code audit
-- 0 Day digging
+- 0day digging
 
 ## Requirements
 
@@ -50,7 +52,7 @@ DongTai-agent-python
 
 ## Quick Start
 
-Please refer to the [Quick Start](https://doc.dongtai.io/en/02_start/index.html).
+Please refer to the [Quick Start](https://doc.dongtai.io/).
 
 ## Quick Development
 
@@ -60,12 +62,11 @@ Please refer to the [Quick Start](https://doc.dongtai.io/en/02_start/index.html)
     ```
 2. Write code to your needs.
 3. Modify the configuration file `dongtai_agent_python/config.json`
+   * iast.server.token: "3d6bb430bc3e0b20dcc2d00000000000000a"
+   * iast.server.url: "https://iast-test.huoxian.cn/openapi"
+   * project.name: "DemoProjectName"
 
-* iast.server.token: "3d6bb430bc3e0b20dcc2d00000000000000a"
-* iast.server.url: "https://iast-test.huoxian.cn/openapi"
-* project.name: "DemoProjectName"
-
-> URL and token from the hole state IAST-web page (eg: https://iast-test.huoxian.cn/deploy) > python-agent deployment page,Obtained from the shell command of downloading agent，Replace the url domain name and token respectively
+    > URL and token from the hole state IAST-web page (eg: https://iast-test.huoxian.cn/deploy) > python-agent deployment page,Obtained from the shell command of downloading agent，Replace the url domain name and token respectively
 
 4. The project is packaged and executed in the root directory of the agent project
     ```shell

dongtai_agent_python/api/openapi.py

@@ -36,7 +36,7 @@ def __init__(self, setting):
         }
 
         agent_prefix = platform.system() + ' ' + platform.release() + '-' + socket.gethostname()
-        self.agent_version = self.config.get('engine', {}).get('version', 'v1.0.0')
+        self.agent_version = self.setting.version
         self.agent_name = agent_prefix + '-' + self.agent_version + '-' + self.setting.engine_name
 
         self.system_info = SystemInfo()

dongtai_agent_python/middlewares/base_middleware.py

@@ -19,16 +19,17 @@ def __init__(self, container):
         if BaseMiddleware.loaded:
             return
 
-        logger.info("python agent init")
         start_time = time.time()
         scope.enter_scope(scope.SCOPE_AGENT)
 
+        self.init_setting()
+        logger.info("python agent init, version: " + self.setting.version)
+
+        self.setting.set_container(container)
+
         # middleware id
         self.id = id(self)
-        self.setting = None
         self.executor = ThreadPoolExecutor()
-        self.init_setting()
-        self.setting.set_container(container)
 
         self.openapi = OpenAPI(self.setting)
 

dongtai_agent_python/setting/setting.py

@@ -1,5 +1,6 @@
 import os
 
+from dongtai_agent_python import version
 from .config import Config
 from dongtai_agent_python.utils import Singleton
 
@@ -11,6 +12,7 @@ def init(self):
         if Setting.loaded:
             return
 
+        self.version = version.__version__
         self.paused = False
         self.manual_paused = False
         self.agent_id = 0

dongtai_agent_python/version.py

@@ -0,0 +1 @@
+__version__ = '1.4.0'

setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = dongtai_agent_python
-version = 1.3.0
+version = attr: dongtai_agent_python.version.__version__
 description = DongTai IAST Agent for Python
 long_description = file: README.md
 url = https://dongtai.io