-
Notifications
You must be signed in to change notification settings - Fork 293
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Email HTML Injection detection in IAST (#8205)
* Email Injection detection in IAST --------- Co-authored-by: Alejandro González García <[email protected]> Co-authored-by: Santiago M. Mola <[email protected]> Co-authored-by: Mario Vidal Domínguez <[email protected]>
- Loading branch information
4 people
authored
Feb 5, 2025
1 parent
41a2e99
commit 9ec7fde
Showing
32 changed files
with
885 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
20 changes: 20 additions & 0 deletions
20
dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/EmailInjectionModuleImpl.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| package com.datadog.iast.sink; | ||
|
|
||
| import com.datadog.iast.Dependencies; | ||
| import com.datadog.iast.model.VulnerabilityType; | ||
| import datadog.trace.api.iast.sink.EmailInjectionModule; | ||
| import javax.annotation.Nullable; | ||
|
|
||
| public class EmailInjectionModuleImpl extends SinkModuleBase implements EmailInjectionModule { | ||
| public EmailInjectionModuleImpl(final Dependencies dependencies) { | ||
| super(dependencies); | ||
| } | ||
|
|
||
| @Override | ||
| public void onSendEmail(@Nullable final Object messageContent) { | ||
| if (messageContent == null) { | ||
| return; | ||
| } | ||
| checkInjection(VulnerabilityType.EMAIL_HTML_INJECTION, messageContent); | ||
| } | ||
| } |
47 changes: 47 additions & 0 deletions
47
...va-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/EmailInjectionModuleTest.groovy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package com.datadog.iast.sink | ||
|
|
||
| import com.datadog.iast.IastModuleImplTestBase | ||
| import com.datadog.iast.Reporter | ||
| import com.datadog.iast.model.Vulnerability | ||
| import com.datadog.iast.model.VulnerabilityType | ||
| import com.datadog.iast.propagation.PropagationModuleImpl | ||
| import datadog.trace.api.iast.SourceTypes | ||
|
|
||
| class EmailInjectionModuleTest extends IastModuleImplTestBase{ | ||
|
|
||
| private EmailInjectionModuleImpl module | ||
|
|
||
| def setup() { | ||
| module = new EmailInjectionModuleImpl(dependencies) | ||
| } | ||
|
|
||
| @Override | ||
| protected Reporter buildReporter() { | ||
| return Mock(Reporter) | ||
| } | ||
|
|
||
| def "test onSendEmail with null messageContent"() { | ||
| when: | ||
| module.onSendEmail(null) | ||
|
|
||
| then: | ||
| noExceptionThrown() | ||
| } | ||
|
|
||
| def "test onSendEmail with non-null messageContent"() { | ||
| given: | ||
| def messageContent = "test message" | ||
| def propagationModule = new PropagationModuleImpl() | ||
| propagationModule.taintObject(messageContent, SourceTypes.NONE) | ||
|
|
||
| when: | ||
| module.onSendEmail(messageContent) | ||
|
|
||
| then: | ||
| 1 * reporter.report(_, _) >> { args -> | ||
| def vulnerability = args[1] as Vulnerability | ||
| vulnerability.type == VulnerabilityType.EMAIL_HTML_INJECTION && | ||
| vulnerability.evidence == messageContent | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| muzzle { | ||
| pass { | ||
| group = 'jakarta.mail' | ||
| module = 'jakarta.mail-api' | ||
| versions = '[2.0.1, ]' | ||
| } | ||
| } | ||
|
|
||
| apply from: "$rootDir/gradle/java.gradle" | ||
|
|
||
| addTestSuiteForDir('latestDepTest', 'test') | ||
|
|
||
| dependencies { | ||
| testRuntimeOnly project(':dd-java-agent:instrumentation:iast-instrumenter') | ||
| compileOnly 'jakarta.mail:jakarta.mail-api:2.0.1' | ||
| testImplementation 'jakarta.mail:jakarta.mail-api:2.0.1' | ||
| compileOnly 'com.sun.mail:jakarta.mail:2.0.1' | ||
| testImplementation 'com.sun.mail:jakarta.mail:2.0.1' | ||
| compileOnly 'jakarta.activation:jakarta.activation-api:2.0.1' | ||
| testImplementation 'jakarta.activation:jakarta.activation-api:2.0.1' | ||
| } |
69 changes: 69 additions & 0 deletions
69
.../src/main/java/datadog/trace/instrumentation/jakarta/mail/JakartaMailInstrumentation.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package datadog.trace.instrumentation.jakarta.mail; | ||
|
|
||
| import static datadog.trace.agent.tooling.bytebuddy.matcher.NameMatchers.named; | ||
| import static net.bytebuddy.matcher.ElementMatchers.takesArgument; | ||
|
|
||
| import com.google.auto.service.AutoService; | ||
| import datadog.trace.agent.tooling.Instrumenter; | ||
| import datadog.trace.agent.tooling.InstrumenterModule; | ||
| import datadog.trace.api.iast.InstrumentationBridge; | ||
| import datadog.trace.api.iast.Sink; | ||
| import datadog.trace.api.iast.VulnerabilityTypes; | ||
| import datadog.trace.api.iast.sink.EmailInjectionModule; | ||
| import jakarta.mail.Message; | ||
| import jakarta.mail.MessagingException; | ||
| import jakarta.mail.Multipart; | ||
| import jakarta.mail.Part; | ||
| import java.io.IOException; | ||
| import net.bytebuddy.asm.Advice; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| @AutoService(InstrumenterModule.class) | ||
| public class JakartaMailInstrumentation extends InstrumenterModule.Iast | ||
| implements Instrumenter.ForSingleType, Instrumenter.HasMethodAdvice { | ||
|
|
||
| private static Logger LOGGER = LoggerFactory.getLogger(JakartaMailInstrumentation.class); | ||
|
|
||
| public JakartaMailInstrumentation() { | ||
| super("jakarta-mail", "jakarta-mail-transport"); | ||
| } | ||
|
|
||
| @Override | ||
| public void methodAdvice(MethodTransformer transformer) { | ||
| transformer.applyAdvice( | ||
| named("send0").and(takesArgument(0, named("jakarta.mail.Message"))), | ||
| JakartaMailInstrumentation.class.getName() + "$MailInjectionAdvice"); | ||
| } | ||
|
|
||
| @Override | ||
| public String instrumentedType() { | ||
| return "jakarta.mail.Transport"; | ||
| } | ||
|
|
||
| public static class MailInjectionAdvice { | ||
| @Sink(VulnerabilityTypes.EMAIL_HTML_INJECTION) | ||
| @Advice.OnMethodEnter(suppress = Throwable.class) | ||
| public static void onSend(@Advice.Argument(0) final Message message) | ||
| throws MessagingException, IOException { | ||
| EmailInjectionModule emailInjectionModule = InstrumentationBridge.EMAIL_INJECTION; | ||
| if (emailInjectionModule == null) { | ||
| return; | ||
| } | ||
| if (message == null || message.getContent() == null) { | ||
| return; | ||
| } | ||
| if (message.isMimeType("text/html")) { | ||
| emailInjectionModule.onSendEmail(message.getContent()); | ||
| } else if (message.isMimeType("multipart/*")) { | ||
| Multipart parts = (Multipart) message.getContent(); | ||
| for (int i = 0; i < parts.getCount(); i++) { | ||
| final Part part = parts.getBodyPart(i); | ||
| if (part != null && part.isMimeType("text/html")) { | ||
| emailInjectionModule.onSendEmail(part.getContent()); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
68 changes: 68 additions & 0 deletions
68
.../main/java/datadog/trace/instrumentation/jakarta/mail/JakartaMailPartInstrumentation.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package datadog.trace.instrumentation.jakarta.mail; | ||
|
|
||
| import static datadog.trace.agent.tooling.bytebuddy.matcher.HierarchyMatchers.implementsInterface; | ||
| import static datadog.trace.agent.tooling.bytebuddy.matcher.NameMatchers.named; | ||
| import static net.bytebuddy.matcher.ElementMatchers.takesArgument; | ||
|
|
||
| import com.google.auto.service.AutoService; | ||
| import datadog.trace.agent.tooling.Instrumenter; | ||
| import datadog.trace.agent.tooling.InstrumenterModule; | ||
| import datadog.trace.api.iast.InstrumentationBridge; | ||
| import datadog.trace.api.iast.Propagation; | ||
| import datadog.trace.api.iast.propagation.PropagationModule; | ||
| import jakarta.mail.Part; | ||
| import net.bytebuddy.asm.Advice; | ||
| import net.bytebuddy.description.type.TypeDescription; | ||
| import net.bytebuddy.matcher.ElementMatcher; | ||
|
|
||
| @AutoService(InstrumenterModule.class) | ||
| public class JakartaMailPartInstrumentation extends InstrumenterModule.Iast | ||
| implements Instrumenter.ForTypeHierarchy, Instrumenter.HasMethodAdvice { | ||
|
|
||
| public JakartaMailPartInstrumentation() { | ||
| super("jakarta-mail", "jakarta-mail-body"); | ||
| } | ||
|
|
||
| @Override | ||
| public void methodAdvice(MethodTransformer transformer) { | ||
| transformer.applyAdvice( | ||
| named("setContent").and(takesArgument(0, Object.class)), | ||
| JakartaMailPartInstrumentation.class.getName() + "$ContentInjectionAdvice"); | ||
| transformer.applyAdvice( | ||
| named("setText").and(takesArgument(0, String.class)), | ||
| JakartaMailPartInstrumentation.class.getName() + "$TextInjectionAdvice"); | ||
| } | ||
|
|
||
| @Override | ||
| public String hierarchyMarkerType() { | ||
| return "jakarta.mail.Part"; | ||
| } | ||
|
|
||
| @Override | ||
| public ElementMatcher<TypeDescription> hierarchyMatcher() { | ||
| return implementsInterface(named(hierarchyMarkerType())); | ||
| } | ||
|
|
||
| public static class ContentInjectionAdvice { | ||
| @Propagation | ||
| @Advice.OnMethodEnter(suppress = Throwable.class) | ||
| private static void onSetContent( | ||
| @Advice.This Part part, @Advice.Argument(0) final Object content) { | ||
| PropagationModule propagationModule = InstrumentationBridge.PROPAGATION; | ||
| if (propagationModule != null && content != null) { | ||
| propagationModule.taintObjectIfTainted(part, content); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| public static class TextInjectionAdvice { | ||
| @Propagation | ||
| @Advice.OnMethodEnter(suppress = Throwable.class) | ||
| private static void onSetText(@Advice.This Part part, @Advice.Argument(0) final String text) { | ||
| PropagationModule propagationModule = InstrumentationBridge.PROPAGATION; | ||
| if (propagationModule != null && text != null) { | ||
| propagationModule.taintObjectIfTainted(part, text); | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.