Skip to content

Commit c11372f

Browse files
estringanaestringana
authored
Implement SSRF (#3014)
Implement SSRF
1 parent 09f23bd commit c11372f

32 files changed

+360
-126
lines changed

‎appsec/src/extension/ddappsec.c

Lines changed: 14 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -474,46 +474,41 @@ static PHP_FUNCTION(datadog_appsec_testing_request_exec)
474474
RETURN_TRUE;
475475
}
476476

477-
static PHP_FUNCTION(datadog_appsec_push_address)
477+
static PHP_FUNCTION(datadog_appsec_push_addresses)
478478
{
479479
struct timespec start;
480480
struct timespec end;
481481
clock_gettime(CLOCK_MONOTONIC_RAW, &start);
482482
long elapsed = 0;
483483
UNUSED(return_value);
484484
if (!DDAPPSEC_G(active)) {
485-
mlog(dd_log_debug, "Trying to access to push_address "
485+
mlog(dd_log_debug, "Trying to access to push_addresses "
486486
"function while appsec is disabled");
487487
return;
488488
}
489489

490-
zend_string *key = NULL;
491-
zval *value = NULL;
490+
zval *addresses = NULL;
492491
bool rasp = false;
493-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sz|b", &key, &value, &rasp) ==
492+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "z|b", &addresses, &rasp) ==
494493
FAILURE) {
495494
RETURN_FALSE;
496495
}
497496

497+
if (Z_TYPE_P(addresses) != IS_ARRAY) {
498+
RETURN_FALSE;
499+
}
500+
498501
if (rasp && !get_global_DD_APPSEC_RASP_ENABLED()) {
499502
return;
500503
}
501504

502-
zval parameters_zv;
503-
zend_array *parameters_arr = zend_new_array(1);
504-
ZVAL_ARR(&parameters_zv, parameters_arr);
505-
zend_hash_add(Z_ARRVAL(parameters_zv), key, value);
506-
Z_TRY_ADDREF_P(value);
507-
508505
dd_conn *conn = dd_helper_mgr_cur_conn();
509506
if (conn == NULL) {
510-
zval_ptr_dtor(&parameters_zv);
511-
mlog_g(dd_log_debug, "No connection; skipping push_address");
507+
mlog_g(dd_log_debug, "No connection; skipping push_addresses");
512508
return;
513509
}
514510

515-
dd_result res = dd_request_exec(conn, &parameters_zv, rasp);
516-
zval_ptr_dtor(&parameters_zv);
511+
dd_result res = dd_request_exec(conn, addresses, rasp);
517512

518513
if (rasp) {
519514
clock_gettime(CLOCK_MONOTONIC_RAW, &end);
@@ -549,16 +544,16 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(request_exec_arginfo, 0, 1, _IS_BOOL, 0)
549544
ZEND_ARG_INFO(0, "data")
550545
ZEND_END_ARG_INFO()
551546

552-
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(push_address_arginfo, 0, 0, IS_VOID, 1)
553-
ZEND_ARG_INFO(0, key)
554-
ZEND_ARG_INFO(0, value)
547+
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(
548+
push_addresses_arginfo, 0, 0, IS_VOID, 1)
549+
ZEND_ARG_INFO(0, addresses)
555550
ZEND_ARG_INFO(0, rasp)
556551
ZEND_END_ARG_INFO()
557552

558553
// clang-format off
559554
static const zend_function_entry functions[] = {
560555
ZEND_RAW_FENTRY(DD_APPSEC_NS "is_enabled", PHP_FN(datadog_appsec_is_enabled), void_ret_bool_arginfo, 0, NULL, NULL)
561-
ZEND_RAW_FENTRY(DD_APPSEC_NS "push_address", PHP_FN(datadog_appsec_push_address), push_address_arginfo, 0, NULL, NULL)
556+
ZEND_RAW_FENTRY(DD_APPSEC_NS "push_addresses", PHP_FN(datadog_appsec_push_addresses), push_addresses_arginfo, 0, NULL, NULL)
562557
PHP_FE_END
563558
};
564559
static const zend_function_entry testing_functions[] = {

‎appsec/src/helper/remote_config/listeners/engine_listener.hpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ class engine_listener : public listener_base {
3434
[[nodiscard]] std::unordered_set<product> get_supported_products() override
3535
{
3636
return {known_products::ASM, known_products::ASM_DD,
37-
known_products::ASM_DATA, known_products::ASM_RASP_LFI};
37+
known_products::ASM_DATA};
3838
}
3939

4040
protected:

‎appsec/src/helper/remote_config/product.hpp

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ struct known_products {
2929
static inline constexpr product ASM_DATA{std::string_view{"ASM_DATA"}};
3030
static inline constexpr product ASM_FEATURES{
3131
std::string_view{"ASM_FEATURES"}};
32-
static inline constexpr product ASM_RASP_LFI{
33-
std::string_view{"ASM_RASP_LFI"}};
3432
static inline constexpr product UNKNOWN{std::string_view{"UNKOWN"}};
3533

3634
static product for_name(std::string_view name)
@@ -47,10 +45,6 @@ struct known_products {
4745
if (name == ASM_FEATURES.name()) {
4846
return ASM_FEATURES;
4947
}
50-
if (name == ASM_RASP_LFI.name()) {
51-
return ASM_RASP_LFI;
52-
}
53-
5448
return UNKNOWN;
5549
}
5650
};

‎appsec/tests/extension/actions_handling_01.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -17,7 +17,7 @@ $helper = Helper::createInitedRun([
1717
]);
1818

1919
var_dump(rinit());
20-
push_address("server.request.path_params", ["some" => "params", "more" => "parameters"]);
20+
push_addresses(["server.request.path_params" => ["some" => "params", "more" => "parameters"]]);
2121
var_dump(rshutdown());
2222

2323
var_dump($helper->get_command("request_exec"));

‎appsec/tests/extension/push_params_block.phpt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -16,7 +16,7 @@ $helper = Helper::createInitedRun([
1616
]);
1717

1818
rinit();
19-
push_address("server.request.path_params", ["some" => "params", "more" => "parameters"]);
19+
push_addresses(["server.request.path_params" => ["some" => "params", "more" => "parameters"]]);
2020

2121
var_dump("THIS SHOULD NOT GET IN THE OUTPUT");
2222

@@ -26,4 +26,4 @@ Status: 404 Not Found
2626
Content-type: application/json
2727
--EXPECTF--
2828
{"errors": [{"title": "You've been blocked", "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}
29-
Warning: datadog\appsec\push_address(): Datadog blocked the request and presented a static error page in %s on line %d
29+
Warning: datadog\appsec\push_addresses(): Datadog blocked the request and presented a static error page in %s on line %d

‎appsec/tests/extension/push_params_block_02.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -25,7 +25,7 @@ class SomeIntegration {
2525
private static function hooked_function()
2626
{
2727
return static function (DDTrace\HookData $hook) {
28-
push_address("server.request.path_params", ["some" => "params", "more" => "parameters"]);
28+
push_addresses(["server.request.path_params", ["some" => "params", "more" => "parameters"]]);
2929
var_dump("This should be executed");
3030
};
3131
}

‎appsec/tests/extension/push_params_block_03.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -25,7 +25,7 @@ class SomeIntegration {
2525
private static function hooked_function()
2626
{
2727
return static function (DDTrace\HookData $hook) {
28-
push_address("server.request.path_params", ["some" => "params", "more" => "parameters"]);
28+
push_addresses(["server.request.path_params", ["some" => "params", "more" => "parameters"]]);
2929
var_dump("This should be executed");
3030
};
3131
}

‎appsec/tests/extension/push_params_ok_01.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -17,7 +17,7 @@ $helper = Helper::createInitedRun([
1717
]);
1818

1919
var_dump(rinit());
20-
push_address("server.request.path_params", ["some" => "params", "more" => "parameters"]);
20+
push_addresses(["server.request.path_params" => ["some" => "params", "more" => "parameters"]]);
2121
var_dump(rshutdown());
2222

2323
var_dump($helper->get_command("request_exec"));

‎appsec/tests/extension/push_params_ok_02.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -17,7 +17,7 @@ $helper = Helper::createInitedRun([
1717
]);
1818

1919
var_dump(rinit());
20-
push_address("server.request.path_params", "some string");
20+
push_addresses(["server.request.path_params" => "some string"]);
2121
var_dump(rshutdown());
2222

2323
var_dump($helper->get_command("request_exec"));

‎appsec/tests/extension/push_params_ok_03.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ datadog.appsec.enabled=1
66
--FILE--
77
<?php
88
use function datadog\appsec\testing\{rinit,rshutdown};
9-
use function datadog\appsec\push_address;
9+
use function datadog\appsec\push_addresses;
1010

1111
include __DIR__ . '/inc/mock_helper.php';
1212

@@ -17,7 +17,7 @@ $helper = Helper::createInitedRun([
1717
]);
1818

1919
var_dump(rinit());
20-
push_address("server.request.path_params", 1234);
20+
push_addresses(["server.request.path_params" => 1234]);
2121
var_dump(rshutdown());
2222

2323
var_dump($helper->get_command("request_exec"));

0 commit comments

Comments
 (0)