Skip to content

Commit c286031

Browse files
author
‘niuerzhuang’
committed
feature API
1 parent f0954b7 commit c286031

File tree

14 files changed

+257
-4013
lines changed

14 files changed

+257
-4013
lines changed

‎iast-core/dependency-reduced-pom.xml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,38 @@
137137
<version>0.6.1</version>
138138
<scope>provided</scope>
139139
</dependency>
140+
<dependency>
141+
<groupId>org.springframework</groupId>
142+
<artifactId>spring-webmvc</artifactId>
143+
<version>5.2.8.RELEASE</version>
144+
<scope>provided</scope>
145+
<exclusions>
146+
<exclusion>
147+
<artifactId>spring-aop</artifactId>
148+
<groupId>org.springframework</groupId>
149+
</exclusion>
150+
<exclusion>
151+
<artifactId>spring-beans</artifactId>
152+
<groupId>org.springframework</groupId>
153+
</exclusion>
154+
<exclusion>
155+
<artifactId>spring-context</artifactId>
156+
<groupId>org.springframework</groupId>
157+
</exclusion>
158+
<exclusion>
159+
<artifactId>spring-core</artifactId>
160+
<groupId>org.springframework</groupId>
161+
</exclusion>
162+
<exclusion>
163+
<artifactId>spring-expression</artifactId>
164+
<groupId>org.springframework</groupId>
165+
</exclusion>
166+
<exclusion>
167+
<artifactId>spring-web</artifactId>
168+
<groupId>org.springframework</groupId>
169+
</exclusion>
170+
</exclusions>
171+
</dependency>
140172
</dependencies>
141173
<properties>
142174
<jdk.version.level>2</jdk.version.level>

‎iast-core/pom.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,13 @@
203203
<artifactId>json</artifactId>
204204
<version>${json.version}</version>
205205
</dependency>
206+
207+
<dependency>
208+
<groupId>org.springframework</groupId>
209+
<artifactId>spring-webmvc</artifactId>
210+
<version>5.2.8.RELEASE</version>
211+
<scope>provided</scope>
212+
</dependency>
206213
</dependencies>
207214

208215
</project>

‎iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,10 @@ public byte[] transform(final ClassLoader loader,
7575
EngineManager.turnOffLingzhi();
7676
}
7777

78+
if (internalClassName.equals("org/springframework/web/servlet/DispatcherServlet")){
79+
System.out.println("a");
80+
}
81+
7882
StopWatch clock = null;
7983
if (logger.isDebugEnabled()) {
8084
clock = new StopWatch();

‎iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/PluginRegister.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,13 @@ public ClassVisitor initial(ClassVisitor classVisitor, IastContext context) {
3333

3434
static {
3535
PLUGINS = new ArrayList<DispatchPlugin>();
36+
PLUGINS.add(new DispatchSpringApplication());
3637
//PLUGINS.add(new DispatchTechnologyPlugin());
3738
PLUGINS.add(new DispatchJ2ee());
3839
//PLUGINS.add(new DispatchJsp());
3940
PLUGINS.add(new DispatchCookie());
4041
//PLUGINS.add(new DispatchSpringAutoBinding());
4142
PLUGINS.add(new DispatchClassPlugin());
4243
//PLUGINS.add()
43-
PLUGINS.add(new DispatchSpringApplication());
4444
}
4545
}

‎iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/DispatchSpringApplication.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@
66

77
public class DispatchSpringApplication implements DispatchPlugin {
88

9-
static String autoBindClassname = " org.springframework.boot.SpringApplication".substring(1);
9+
static String autoBindClassname = " org.springframework.web.servlet.FrameworkServlet".substring(1);
10+
1011
private String classname;
1112

1213
@Override
1314
public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) {
1415
classname = context.getClassName();
15-
1616
System.out.println(classname);
1717
if (autoBindClassname.equals(classname)) {
1818
classVisitor = new SpringApplicationAdapter(classVisitor, context);

‎iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationAdapter.java

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,9 @@
11
package com.secnium.iast.core.enhance.plugins.api;
22

33
import com.secnium.iast.core.enhance.IastContext;
4-
import com.secnium.iast.core.enhance.plugins.AbstractAdviceAdapter;
54
import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor;
6-
import com.secnium.iast.core.enhance.plugins.core.adapter.PropagateAdviceAdapter;
7-
import com.secnium.iast.core.handler.controller.HookType;
85
import org.objectweb.asm.ClassVisitor;
96
import org.objectweb.asm.MethodVisitor;
10-
import org.objectweb.asm.Type;
117

128
public class SpringApplicationAdapter extends AbstractClassVisitor {
139

@@ -28,16 +24,8 @@ public MethodVisitor visitMethod(int access, String name, String descriptor, Str
2824
descriptor,
2925
signature,
3026
exceptions);
31-
if ("run".equals(name) && Type.getArgumentTypes(descriptor).length == 1) {
32-
System.out.println(context.getClassName());
33-
// methodVisitor = new SpringApplicationAdviceAdapter(methodVisitor,
34-
// access,
35-
// name,
36-
// descriptor,
37-
// context,
38-
// "spring",
39-
// "signature"
40-
// );
27+
if ("getWebApplicationContext".equals(name)) {
28+
// System.out.println(context.getClassName());
4129
methodVisitor = new SpringApplicationAdviceAdapter(
4230
methodVisitor,
4331
access,

‎iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationImpl.java

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
package com.secnium.iast.core.enhance.plugins.api;
2+
3+
import com.secnium.iast.core.handler.models.ApiDataModel;
4+
import com.secnium.iast.core.handler.models.MethodEvent;
5+
import org.springframework.aop.support.AopUtils;
6+
import org.springframework.context.ApplicationContext;
7+
import org.springframework.web.method.HandlerMethod;
8+
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
9+
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
10+
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
11+
12+
import java.lang.annotation.Annotation;
13+
import java.lang.reflect.Method;
14+
import java.lang.reflect.Parameter;
15+
import java.util.*;
16+
import java.util.concurrent.atomic.AtomicInteger;
17+
18+
import static com.secnium.iast.core.report.ApiReport.sendReport;
19+
20+
/**
21+
* [email protected]
22+
*/
23+
public class SpringApplicationImpl {
24+
25+
public static boolean isSend;
26+
27+
public static void getWebApplicationContext(MethodEvent event, AtomicInteger invokeIdSequencer) {
28+
ApplicationContext applicationContext = (ApplicationContext) event.returnValue;
29+
if(!isSend) {
30+
List<ApiDataModel> api = getAPI(applicationContext);
31+
sendReport(api);
32+
isSend = true;
33+
}
34+
}
35+
36+
public static List<ApiDataModel> getAPI(ApplicationContext applicationContext) {
37+
RequestMappingHandlerMapping mapping = applicationContext.getBean(RequestMappingHandlerMapping.class);
38+
Map<RequestMappingInfo, HandlerMethod> methodMap = mapping.getHandlerMethods();
39+
List<ApiDataModel> apiList = new ArrayList<>();
40+
for (RequestMappingInfo info : methodMap.keySet()) {
41+
ApiDataModel apiDataModel = new ApiDataModel();
42+
HandlerMethod handlerMethod = methodMap.get(info);
43+
String clazz = handlerMethod.getBeanType().toString().substring(6);
44+
apiDataModel.setClazz(clazz);
45+
String method = info.getMethodsCondition().toString().replace("[", "").replace("]", "");
46+
String[] methods;
47+
if ("".equals(method)) {
48+
methods = new String[2];
49+
methods[0] = "GET";
50+
methods[1] = "POST";
51+
}else {
52+
methods = new String[1];
53+
methods[0] = method;
54+
}
55+
apiDataModel.setMethod(methods);
56+
Method declaredMethod = null;
57+
try {
58+
HandlerMethod handlerMethodData = methodMap.get(info);
59+
String beanType = handlerMethodData.getBeanType().toString().substring(6);
60+
apiDataModel.setController(beanType);
61+
Method methodData = handlerMethodData.getMethod();
62+
String methodName = methodData.getName();
63+
Parameter[] parameters = methodData.getParameters();
64+
List<Class<?>> parameterList = new ArrayList<>();
65+
for (Parameter parameter : parameters
66+
) {
67+
parameterList.add(parameter.getType());
68+
}
69+
int parameterListSize = parameterList.size();
70+
Class<?>[] classes = new Class[parameterListSize];
71+
for (int i = 0; i < parameterListSize; i++) {
72+
classes[i] = parameterList.get(i);
73+
}
74+
declaredMethod = AopUtils.getTargetClass(applicationContext.getBean(handlerMethod.getBean().toString())).getDeclaredMethod(methodName, classes);
75+
parameters = declaredMethod.getParameters();
76+
List<Map<String, String>> parameterMaps = new ArrayList<>();
77+
for (Parameter parameter : parameters
78+
) {
79+
Map<String, String> parameterMap = new HashMap<>();
80+
String className = parameter.getName();
81+
String classType = parameter.getType().toString();
82+
if (classType.contains(" ")) {
83+
classType = classType.substring(classType.indexOf(" ") + 1);
84+
}
85+
Annotation[] declaredAnnotations = parameter.getDeclaredAnnotations();
86+
StringBuilder annos = new StringBuilder();
87+
for (Annotation annotation : declaredAnnotations
88+
) {
89+
String anno = annotation.annotationType().toString();
90+
anno = anno.substring(anno.lastIndexOf(".")+1);
91+
if ("PathVariable".equals(anno)){
92+
anno = "restful访问参数";
93+
}else if ("RequestHeader".equals(anno)){
94+
anno = "Header参数";
95+
}else if ("CookieValue".equals(anno)){
96+
anno = "Cookie参数";
97+
}else if ("RequestParam".equals(anno)){
98+
anno = "GET请求参数";
99+
}else if ("RequestBody".equals(anno)){
100+
anno = "POST请求的body参数";
101+
}else if ("Validated".equals(anno)){
102+
anno = "GET请求参数对象";
103+
}
104+
annos.append(anno);
105+
}
106+
parameterMap.put("name", className);
107+
parameterMap.put("type", classType);
108+
parameterMap.put("annotation", String.valueOf(annos));
109+
parameterMaps.add(parameterMap);
110+
}
111+
apiDataModel.setParameters(parameterMaps);
112+
String returnType = declaredMethod.getReturnType().toString();
113+
if (returnType.contains("class ")) {
114+
returnType = declaredMethod.getReturnType().toString().substring(6);
115+
}
116+
apiDataModel.setReturnType(returnType);
117+
} catch (NoSuchMethodException ignore) {
118+
}
119+
120+
121+
PatternsRequestCondition patternsCondition = info.getPatternsCondition();
122+
Set<String> patterns = patternsCondition.getPatterns();
123+
if (patterns.size()>1){
124+
for (String s:patterns
125+
) {
126+
String uri = s.replace("[", "").replace("]", "");
127+
apiDataModel.setUrl(uri);
128+
apiList.add(apiDataModel);
129+
}
130+
}else {
131+
String uri = info.getPatternsCondition().toString().replace("[", "").replace("]", "");
132+
apiDataModel.setUrl(uri);
133+
apiList.add(apiDataModel);
134+
}
135+
}
136+
return apiList;
137+
}
138+
139+
140+
}

‎iast-core/src/main/java/com/secnium/iast/core/handler/EventListenerHandlers.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.secnium.iast.core.handler;
22

33
import com.secnium.iast.core.EngineManager;
4+
import com.secnium.iast.core.enhance.plugins.api.SpringApplicationImpl;
45
import com.secnium.iast.core.handler.controller.HookType;
56
import com.secnium.iast.core.handler.controller.impl.HttpImpl;
67
import com.secnium.iast.core.handler.controller.impl.PropagatorImpl;
@@ -61,7 +62,7 @@ public static void onBefore(final String framework,
6162
SinkImpl.solveSink(event, INVOKE_ID_SEQUENCER);
6263
} else if (HookType.SPRINGAPPLICATION.equals(hookType)) {
6364
// todo
64-
System.out.println("a");
65+
SpringApplicationImpl.getWebApplicationContext(event,INVOKE_ID_SEQUENCER);
6566
}
6667
}
6768
}

‎iast-core/src/main/java/com/secnium/iast/core/handler/models/ApiDataModel.java

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.secnium.iast.core.handler.models;
22

3+
import java.util.List;
34
import java.util.Map;
45

56
/**
@@ -10,25 +11,37 @@
1011
public class ApiDataModel {
1112

1213
private String url;
13-
private String method;
14+
private String[] method;
1415
private String clazz;
15-
private Map<String,String>[] parameters;
16+
List<Map<String, String>> parameters;
1617
private String returnType;
1718
private String file;
1819
private String controller;
20+
private String description;
1921

2022
public ApiDataModel() {
2123
}
2224

23-
24-
public ApiDataModel(String url, String method, String clazz, Map<String, String>[] parameters, String returnType, String file, String controller) {
25+
public ApiDataModel(String url, String[] method, String clazz, List<Map<String, String>> parameters, String returnType, String file, String controller, String description) {
2526
this.url = url;
2627
this.method = method;
2728
this.clazz = clazz;
2829
this.parameters = parameters;
2930
this.returnType = returnType;
3031
this.file = file;
3132
this.controller = controller;
33+
this.description = description;
34+
}
35+
36+
public String getDescription() {
37+
if (description == null) {
38+
description = "";
39+
}
40+
return description;
41+
}
42+
43+
public void setDescription(String description) {
44+
this.description = description;
3245
}
3346

3447
public String getClazz() {
@@ -47,19 +60,19 @@ public void setUrl(String url) {
4760
this.url = url;
4861
}
4962

50-
public String getMethod() {
63+
public String[] getMethod() {
5164
return method;
5265
}
5366

54-
public void setMethod(String method) {
67+
public void setMethod(String[] method) {
5568
this.method = method;
5669
}
5770

58-
public Map<String, String>[] getParameters() {
71+
public List<Map<String, String>> getParameters() {
5972
return parameters;
6073
}
6174

62-
public void setParameters(Map<String, String>[] parameters) {
75+
public void setParameters(List<Map<String, String>> parameters) {
6376
this.parameters = parameters;
6477
}
6578

@@ -72,6 +85,9 @@ public void setReturnType(String returnType) {
7285
}
7386

7487
public String getFile() {
88+
if (file == null) {
89+
file = "";
90+
}
7591
return file;
7692
}
7793

‎iast-core/src/main/java/com/secnium/iast/core/handler/vulscan/ReportConstant.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,10 +92,12 @@ public class ReportConstant {
9292
public static final String API_DATA_URI = "uri";
9393
public static final String API_DATA_METHOD = "method";
9494
public static final String API_DATA_CLASS = "class";
95+
public static final String API_DATA_PARAMETERS = "parameters";
9596
public static final String API_DATA_PARAMETER_NAME = "name";
9697
public static final String API_DATA_PARAMETER_TYPE = "type";
9798
public static final String API_DATA_PARAMETER_ANNOTATION = "annotation";
9899
public static final String API_DATA_RETURN = "return_type";
99100
public static final String API_DATA_FILE = "file";
100101
public static final String API_DATA_CONTROLLER = "controller";
102+
public static final String API_DATA_DESCRIPTION = "description";
101103
}

0 commit comments

Comments
 (0)