diff --git a/iast-core/dependency-reduced-pom.xml b/iast-core/dependency-reduced-pom.xml
index 0c68b8b82..281e7adc2 100644
--- a/iast-core/dependency-reduced-pom.xml
+++ b/iast-core/dependency-reduced-pom.xml
@@ -137,6 +137,38 @@
0.6.1
provided
+
+ org.springframework
+ spring-webmvc
+ 5.2.8.RELEASE
+ provided
+
+
+ spring-aop
+ org.springframework
+
+
+ spring-beans
+ org.springframework
+
+
+ spring-context
+ org.springframework
+
+
+ spring-core
+ org.springframework
+
+
+ spring-expression
+ org.springframework
+
+
+ spring-web
+ org.springframework
+
+
+
2
diff --git a/iast-core/pom.xml b/iast-core/pom.xml
index 0d4a20d1a..f239ffd55 100755
--- a/iast-core/pom.xml
+++ b/iast-core/pom.xml
@@ -203,6 +203,13 @@
json
${json.version}
+
+
+ org.springframework
+ spring-webmvc
+ 5.2.8.RELEASE
+ provided
+
diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java
index 264149e1a..1f5bac065 100755
--- a/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java
+++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java
@@ -75,6 +75,10 @@ public byte[] transform(final ClassLoader loader,
EngineManager.turnOffLingzhi();
}
+ if (internalClassName.equals("org/springframework/web/servlet/DispatcherServlet")){
+ System.out.println("a");
+ }
+
StopWatch clock = null;
if (logger.isDebugEnabled()) {
clock = new StopWatch();
diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/PluginRegister.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/PluginRegister.java
index 55cf36185..c7879e467 100644
--- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/PluginRegister.java
+++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/PluginRegister.java
@@ -33,6 +33,7 @@ public ClassVisitor initial(ClassVisitor classVisitor, IastContext context) {
static {
PLUGINS = new ArrayList();
+ PLUGINS.add(new DispatchSpringApplication());
//PLUGINS.add(new DispatchTechnologyPlugin());
PLUGINS.add(new DispatchJ2ee());
//PLUGINS.add(new DispatchJsp());
@@ -40,6 +41,5 @@ public ClassVisitor initial(ClassVisitor classVisitor, IastContext context) {
//PLUGINS.add(new DispatchSpringAutoBinding());
PLUGINS.add(new DispatchClassPlugin());
//PLUGINS.add()
- PLUGINS.add(new DispatchSpringApplication());
}
}
diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/DispatchSpringApplication.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/DispatchSpringApplication.java
index 25cf9b479..9809f9e7b 100644
--- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/DispatchSpringApplication.java
+++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/DispatchSpringApplication.java
@@ -6,13 +6,13 @@
public class DispatchSpringApplication implements DispatchPlugin {
- static String autoBindClassname = " org.springframework.boot.SpringApplication".substring(1);
+ static String autoBindClassname = " org.springframework.web.servlet.FrameworkServlet".substring(1);
+
private String classname;
@Override
public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) {
classname = context.getClassName();
-
System.out.println(classname);
if (autoBindClassname.equals(classname)) {
classVisitor = new SpringApplicationAdapter(classVisitor, context);
diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationAdapter.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationAdapter.java
index 46e5156d2..9cef9b9db 100644
--- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationAdapter.java
+++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationAdapter.java
@@ -1,13 +1,9 @@
package com.secnium.iast.core.enhance.plugins.api;
import com.secnium.iast.core.enhance.IastContext;
-import com.secnium.iast.core.enhance.plugins.AbstractAdviceAdapter;
import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor;
-import com.secnium.iast.core.enhance.plugins.core.adapter.PropagateAdviceAdapter;
-import com.secnium.iast.core.handler.controller.HookType;
import org.objectweb.asm.ClassVisitor;
import org.objectweb.asm.MethodVisitor;
-import org.objectweb.asm.Type;
public class SpringApplicationAdapter extends AbstractClassVisitor {
@@ -28,16 +24,8 @@ public MethodVisitor visitMethod(int access, String name, String descriptor, Str
descriptor,
signature,
exceptions);
- if ("run".equals(name) && Type.getArgumentTypes(descriptor).length == 1) {
- System.out.println(context.getClassName());
-// methodVisitor = new SpringApplicationAdviceAdapter(methodVisitor,
-// access,
-// name,
-// descriptor,
-// context,
-// "spring",
-// "signature"
-// );
+ if ("getWebApplicationContext".equals(name)) {
+// System.out.println(context.getClassName());
methodVisitor = new SpringApplicationAdviceAdapter(
methodVisitor,
access,
diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationImpl.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationImpl.java
new file mode 100644
index 000000000..f919f7c59
--- /dev/null
+++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/api/SpringApplicationImpl.java
@@ -0,0 +1,140 @@
+package com.secnium.iast.core.enhance.plugins.api;
+
+import com.secnium.iast.core.handler.models.ApiDataModel;
+import com.secnium.iast.core.handler.models.MethodEvent;
+import org.springframework.aop.support.AopUtils;
+import org.springframework.context.ApplicationContext;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
+import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
+import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
+
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Method;
+import java.lang.reflect.Parameter;
+import java.util.*;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import static com.secnium.iast.core.report.ApiReport.sendReport;
+
+/**
+ * niuerzhuang@huoxian.cn
+ */
+public class SpringApplicationImpl {
+
+ public static boolean isSend;
+
+ public static void getWebApplicationContext(MethodEvent event, AtomicInteger invokeIdSequencer) {
+ ApplicationContext applicationContext = (ApplicationContext) event.returnValue;
+ if(!isSend) {
+ List api = getAPI(applicationContext);
+ sendReport(api);
+ isSend = true;
+ }
+ }
+
+ public static List getAPI(ApplicationContext applicationContext) {
+ RequestMappingHandlerMapping mapping = applicationContext.getBean(RequestMappingHandlerMapping.class);
+ Map methodMap = mapping.getHandlerMethods();
+ List apiList = new ArrayList<>();
+ for (RequestMappingInfo info : methodMap.keySet()) {
+ ApiDataModel apiDataModel = new ApiDataModel();
+ HandlerMethod handlerMethod = methodMap.get(info);
+ String clazz = handlerMethod.getBeanType().toString().substring(6);
+ apiDataModel.setClazz(clazz);
+ String method = info.getMethodsCondition().toString().replace("[", "").replace("]", "");
+ String[] methods;
+ if ("".equals(method)) {
+ methods = new String[2];
+ methods[0] = "GET";
+ methods[1] = "POST";
+ }else {
+ methods = new String[1];
+ methods[0] = method;
+ }
+ apiDataModel.setMethod(methods);
+ Method declaredMethod = null;
+ try {
+ HandlerMethod handlerMethodData = methodMap.get(info);
+ String beanType = handlerMethodData.getBeanType().toString().substring(6);
+ apiDataModel.setController(beanType);
+ Method methodData = handlerMethodData.getMethod();
+ String methodName = methodData.getName();
+ Parameter[] parameters = methodData.getParameters();
+ List> parameterList = new ArrayList<>();
+ for (Parameter parameter : parameters
+ ) {
+ parameterList.add(parameter.getType());
+ }
+ int parameterListSize = parameterList.size();
+ Class>[] classes = new Class[parameterListSize];
+ for (int i = 0; i < parameterListSize; i++) {
+ classes[i] = parameterList.get(i);
+ }
+ declaredMethod = AopUtils.getTargetClass(applicationContext.getBean(handlerMethod.getBean().toString())).getDeclaredMethod(methodName, classes);
+ parameters = declaredMethod.getParameters();
+ List