[IAST] Improve RestSharp SSRF detection #6060
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
There was a problem hiding this comment. Could you add to the |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| // <copyright file="UrlEncode2Integration.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
|
|
||
| #nullable enable | ||
|
|
||
| using System; | ||
| using System.ComponentModel; | ||
| using Datadog.Trace.ClrProfiler.CallTarget; | ||
| using Datadog.Trace.Iast; | ||
| using Datadog.Trace.Vendors.Serilog; | ||
|
|
||
| namespace Datadog.Trace.ClrProfiler.AutoInstrumentation.RestSharp; | ||
|
|
||
| /// <summary> | ||
| /// System.Security.Cryptography.HashAlgorithm instrumentation | ||
| /// </summary> | ||
| [InstrumentMethod( | ||
| AssemblyName = "RestSharp", | ||
| TypeName = "RestSharp.Extensions.StringExtensions", | ||
| MethodName = "UrlEncode", | ||
| ReturnTypeName = ClrNames.String, | ||
| ParameterTypeNames = new[] { ClrNames.String, "System.Text.Encoding" }, | ||
| MinimumVersion = "104.0.0", | ||
| MaximumVersion = "112.*.*", | ||
| InstrumentationCategory = InstrumentationCategory.Iast, | ||
| IntegrationName = nameof(Configuration.IntegrationId.Ssrf))] | ||
| [Browsable(false)] | ||
| [EditorBrowsable(EditorBrowsableState.Never)] | ||
| public class UrlEncode2Integration | ||
| { | ||
| private static bool errorLogged = false; | ||
|
|
||
| /// <summary> | ||
| /// OnMethodBegin callback | ||
| /// </summary> | ||
| /// <param name="value">String being escaped.</param> | ||
| /// <param name="encoding">Encoding being used.</param> | ||
| /// <returns>Calltarget state value</returns> | ||
| internal static CallTargetState OnMethodBegin<TTarget>(string value, System.Text.Encoding encoding) | ||
| { | ||
| return new CallTargetState(null, value); | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// OnMethodEnd callback | ||
| /// </summary> | ||
| /// <typeparam name="TTarget">Type of the target</typeparam> | ||
| /// <typeparam name="TReturn">Type of the return value</typeparam> | ||
| /// <param name="returnValue">Return value.</param> | ||
| /// <param name="exception">Exception instance in case the original code threw an exception.</param> | ||
| /// <param name="state">Calltarget state value</param> | ||
| /// <returns>CallTargetReturn</returns> | ||
| internal static CallTargetReturn<TReturn> OnMethodEnd<TTarget, TReturn>(TReturn returnValue, Exception exception, CallTargetState state) | ||
| { | ||
| try | ||
| { | ||
| if (exception is null && returnValue is string value) | ||
| { | ||
| if (state.State is string input) | ||
| { | ||
| var newValue = IastModule.OnSsrfEscape(input, value); | ||
| if (newValue is not null) | ||
| { | ||
| returnValue = (TReturn)(object)newValue; | ||
| } | ||
| } | ||
| } | ||
| } | ||
| catch (Exception e) | ||
| { | ||
| if (!errorLogged) | ||
| { | ||
| Log.Error(e, "Error escaping Url with encoding"); | ||
| errorLogged = true; | ||
| } | ||
| } | ||
|
|
||
| return new CallTargetReturn<TReturn>(returnValue); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| // <copyright file="UrlEncodeIntegration.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
|
|
||
| #nullable enable | ||
|
|
||
| using System; | ||
| using System.ComponentModel; | ||
| using Datadog.Trace.ClrProfiler.CallTarget; | ||
| using Datadog.Trace.Iast; | ||
| using Datadog.Trace.Vendors.Serilog; | ||
|
|
||
| namespace Datadog.Trace.ClrProfiler.AutoInstrumentation.RestSharp; | ||
|
|
||
| /// <summary> | ||
| /// System.Security.Cryptography.HashAlgorithm instrumentation | ||
| /// </summary> | ||
| [InstrumentMethod( | ||
| AssemblyName = "RestSharp", | ||
| TypeName = "RestSharp.Extensions.StringExtensions", | ||
| MethodName = "UrlEncode", | ||
| ReturnTypeName = ClrNames.String, | ||
| ParameterTypeNames = new[] { ClrNames.String }, | ||
| MinimumVersion = "104.0.0", | ||
| MaximumVersion = "112.*.*", | ||
| InstrumentationCategory = InstrumentationCategory.Iast, | ||
| IntegrationName = nameof(Configuration.IntegrationId.Ssrf))] | ||
| [Browsable(false)] | ||
| [EditorBrowsable(EditorBrowsableState.Never)] | ||
| public class UrlEncodeIntegration | ||
| { | ||
| private static bool errorLogged = false; | ||
|
|
||
| /// <summary> | ||
| /// OnMethodBegin callback | ||
| /// </summary> | ||
| /// <param name="value">String being escaped.</param> | ||
| /// <returns>Calltarget state value</returns> | ||
| internal static CallTargetState OnMethodBegin<TTarget>(string value) | ||
| { | ||
| return new CallTargetState(null, value); | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// OnMethodEnd callback | ||
| /// </summary> | ||
| /// <typeparam name="TTarget">Type of the target</typeparam> | ||
| /// <typeparam name="TReturn">Type of the return value</typeparam> | ||
| /// <param name="returnValue">Return value.</param> | ||
| /// <param name="exception">Exception instance in case the original code threw an exception.</param> | ||
| /// <param name="state">Calltarget state value</param> | ||
| /// <returns>CallTargetReturn</returns> | ||
| internal static CallTargetReturn<TReturn> OnMethodEnd<TTarget, TReturn>(TReturn returnValue, Exception exception, CallTargetState state) | ||
| { | ||
|
There was a problem hiding this comment. NIT: Since the code of this method is the same as the one in UrlEncode2Integration.cs, it would probably make sense to create a common method that is called from both instrumentation points. |
||
| try | ||
| { | ||
| if (exception is null && returnValue is string value) | ||
| { | ||
| if (state.State is string input) | ||
| { | ||
| var newValue = IastModule.OnSsrfEscape(input, value); | ||
| if (newValue is not null) | ||
| { | ||
| returnValue = (TReturn)(object)newValue; | ||
| } | ||
| } | ||
| } | ||
| } | ||
| catch (Exception e) | ||
| { | ||
| if (!errorLogged) | ||
| { | ||
| Log.Error(e, "Error escaping Url"); | ||
| errorLogged = true; | ||
| } | ||
| } | ||
|
|
||
| return new CallTargetReturn<TReturn>(returnValue); | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I guess that these changes are done automatically when compiling the solution?